By ByteBot
Yesterday, LiteLLM 1.107.0 was live on PyPI for two hours with a credential stealer embedded in every wheel. Anyone who ran pip install litellm during that window handed over AWS keys, GitHub tokens, and Anthropic API credentials to an attacker who had compromised a developer release pipeline. That attack targeted developers making a manual install. The scarier problem targets your AI coding agent, which installs packages, configures MCP servers, and pulls dependencies all day, autonomously, without anyone reviewing a single pull. Sonatype new Nexus Repository Pro+ is built specifically for this problem.
The Problem Nobody Has Solved Yet
Traditional supply chain defenses assume a human is somewhere in the loop. You get a Dependabot alert, you review it, you decide. Snyk flags a vulnerability, you investigate. Even GitHub Package Firewall focuses on npm and still assumes a developer is reading the output.
AI coding agents break this model entirely. An agent working through a task installs whatever dependency it decides it needs — npm packages, PyPI libraries, AI models, MCP servers — without pausing to check. Attackers have adapted. Supply chain attacks are up 188% year-over-year in 2026, with 149,000 malicious packages indexed in Q3 alone according to Sonatype Q3 Open Source Malware Index.
MCP servers make this worse. Unlike PyPI or npm, there is no central registry gatekeeping MCP server publication. Anyone can register a plausible-sounding server name and wait for an AI agent to pull it. The Cloud Security Alliance documented active MCP tool poisoning attacks in May 2026, including a case where a malicious MCP package spent over a week silently forwarding thousands of corporate emails daily to an attacker, completely undetected.
What Nexus Repository Pro+ Does Differently
Sonatype approach moves the firewall inside the repository itself. Every component request — from a developer running npm install or from an AI agent pulling a model — passes through an evaluation layer before the package reaches the machine. The decision happens at the proxy, not after the install.
Pro+ bundles Sonatype Repository Firewall directly into Nexus Repository, covering 15+ package formats: npm, PyPI, Maven, NuGet, container images, AI model binaries, and MCP servers. The screening draws on Sonatype catalog of more than 333 million components and nearly two million logged malicious packages. Policy enforcement extends beyond malware detection — you can block packages that are too old, fail license checks, or fall outside custom organizational rules. Anything blocked never reaches a build or an agent active environment.
MCP Servers as a First-Class Risk Category
The inclusion of MCP servers in the screened format list is significant. No other major repository product has formally treated MCP server distribution as a supply chain risk category. Sonatype is the first. Snyk ToxicSkills audit earlier this year found a 36% flaw rate across nearly 4,000 scanned agent skills, with 76 confirmed malicious payloads actively running. Pro+ screening MCP servers at the repository layer means an AI agent trying to pull a compromised MCP server through a Nexus proxy gets stopped before the server ever initializes.
How It Compares
| Approach | When It Catches Threats | Covers MCP Servers? |
|---|---|---|
| Dependabot and Snyk | After package is installed | No |
| GitHub Package Firewall | At npm download only | No |
| Nexus Repository Pro+ | At any pull, before install | Yes |
What You Should Do Now
If your organization already runs Nexus Repository Pro, evaluate the Pro+ upgrade. The Repository Firewall capability was previously a separate add-on — Pro+ integrates it into a single product. If you are using the free community edition, you can still enforce a Nexus proxy layer to funnel all pulls through a single auditable point, even without the automated screening.
If your CI/CD runners or AI coding agents pull packages directly from public registries with no proxy in the path, you have no pull-time protection. That is the first thing to fix — regardless of which repository product you choose. Check LiteLLM incident report for a concrete example of what a two-hour exposure window looks like in practice.
The supply chain problem is not new. What changed in 2026 is autonomous agents pulling dependencies without human review — and MCP servers giving attackers a new, underpoliced distribution channel. Sonatype moving to explicitly screen MCP servers at the repository layer is the right architectural response. The question is whether your build environment is set up to use it.
