Pattern: MCP Security Threat Surface Growing Faster Than Ecosystem Hardening

Multiple (Trend Micro, OX Security, Infosecurity Magazine)·high signal

Across three independent reports this month — Trend Micro (exposed servers tripled to 1,467), OX Security (systemic RCE across 150M downloads), and Infosecurity Magazine (STDIO transport vulnerability) — the MCP security picture is deteriorating. NGINX integration CVE at 9.8, Alibaba refusing to patch, and Apache Doris SQL injection show that MCP server authors treat security as optional. The attack surface compounds with adoption: every new MCP server in a coding agent's config is a potential entry point. The ecosystem needs an npm-audit equivalent for MCP configs.