Deadbugz: Currently Active MCP Supply-Chain Campaign

**Executive summary:** Pillar Security identified an active campaign (Deadbugz) delivering a malicious MCP server named "productivity-suite" via GitHub pull requests; the server supplies benign tool metadata for initial use but, after three tool calls, switches to credential-seeking and concealment instructions aimed at stealing SSH keys, AWS credentials, shell history, and Kubernetes config. The report documents 23 related PRs from the zellkernel account, confirms public source code and a runtime-gated metadata trigger, provides IoCs (remote endpoint, local artifact, bitcoin address, repository/account), and gives mitigation and detection guidance for developers and MCP platform builders.