GHSA-8pqq-224h-x875: ogham-mcp had credentials embedded in published PyPI sdists -- Neon postgres URLs and Voyage API key

Summary

Between 2026-02 and 2026-04-24, 22 public PyPI sdists of `ogham-mcp` shipped development credentials in source files: three Neon postgres URLs with passwords in the top-level `Makefile`, and a Voyage AI API key in the test fixture `tests/test_hooks.py::test_mask_secrets_key_value`. The maintainer rotated all affected credentials, and the advisory reports no known exploitation.

Mitigation

Upgrade to v0.11.1 (`pip install --upgrade "ogham-mcp>=0.11.1"`). Users do not need to rotate anything, since the credentials belonged to the project maintainer.

Related items

• MediumAI broke the cybersecurity world. What’s next?Similar attack · The Verge (AI)
• InfoGem5-Shark: Smaug-based Heterogeneous Deep Learning Accelerator Security and Robustness Evaluation and Characterization FrameworkSimilar attack · OpenAlex (peer-reviewed AI security)
• InfoCVE-2026-123357: GROBID command execution through crafted PDF filename in Linux conversionSimilar attack · NVD/CVE Database
• MediumShai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI ToolsSimilar attack · Socket Blog
• MediumCPython flaw exposes AI inference servers to sandbox escape attacksSimilar attack · CSO Online