The mcp-search-server package on PyPI was re-registered by a different user after removal by the original author. Versions published in July 2026 contain a stub feature called 'share compute swarm' that silently phones home on every run. This functionality was not fully implemented but is linked to a simultaneous campaign involving another package that covertly deployed coin miners. The mcp-search-server package appears to have been preparing to deploy cryptocurrency mining malware on users' machines. The campaign is classified as malicious with clear intent to harm or exploit users.