MCP Token Theft in Claude Code: A Man-in-the-Middle Attack Chain

This report details a technique where a malicious npm postinstall hook seeds trusted project paths and rewrites Claude Code’s MCP configuration (~/.claude.json) to point at an attacker-controlled proxy, enabling interception and long-lived theft of OAuth bearer/refresh tokens for SaaS like Jira/Confluence; the hook persists by reseeding on each load so token rotation alone is insufficient, and defenders are advised to monitor MCP endpoints, config changes, local proxies, and unusual SaaS activity.