A package called refbase-mcp, named to sit inside the Model Context Protocol convention that agent tooling now uses, was published to npm carrying malware, drew 298 downloads, and was pulled and replaced with a security stub about an hour and a half later.
The timeline, from the registry itself
Version 1.0.0 went up at 20:23:38 UTC on July 31. At 21:54:59 UTC it was replaced by version 0.0.1-security, npm's 428-byte security-holding placeholder. That is a 92-minute exposure window. The advisory followed at 22:00:13 UTC. All three timestamps come from the registry and advisory APIs rather than from any write-up.
What the name was doing
The -mcp suffix is the lure. Agent toolchains install MCP servers with the same trust they extend to any other dependency, and the convention is now established enough to be worth impersonating. Nothing on the record establishes that the package actually functioned as an MCP server — the suffix is a naming choice, not a capability.
The frightening sentence is a template
The advisory says any machine with the package installed "should be considered fully compromised" and that all secrets and keys should be rotated. That is npm's generic malware boilerplate, applied to every takedown of this class. No payload analysis was published, so what the package actually did is not on the record — and reporting the boilerplate as a finding about this package would be wrong.
298 downloads is not 298 victims
The curve — 254 on July 31, 44 on August 1, zero on every earlier day — is what a brand-new package looks like when registry mirrors, security scanners and CI caches find it. Treating the count as an infection count overstates it substantially. The narrower reading is the useful one: the takedown loop closed in 92 minutes, and 92 minutes is long enough to reach a build system.