Original data studies on MCP, supply chain and .id security

Studies

• I Checked DMARC on 4,437 Indonesian .id Domains. 47% of go.id Can Still Be Spoofed

  3,301 of 4,437 .id domains (74.4%) have no DMARC or only p=none, including 222 of 469 go.id domains (47.3%).

  Sample:

  4,437 .id domains (DNS only)

  Data collected:

  25 Oct 2026

  Bahasa Indonesia

  Cite as: Kiell Tampubolon, I Checked DMARC on 4,437 Indonesian .id Domains. 47% of go.id Can Still Be Spoofed, kielltampubolon.id, 2026-10-25

• Let's Encrypt Is Going to 64 Days. I Checked 520 .id Sites. 3 in 4 go.id Sites Still Run Long-Lived Certificates

  Of 81 go.id sites that answered, 61 (75%) serve a certificate valid for 198 days or more.

  Sample:

  520 .id domains (477 answered TLS)

  Data collected:

  25 Oct 2026

  Bahasa Indonesia

  Cite as: Kiell Tampubolon, Let's Encrypt Is Going to 64 Days. I Checked 520 .id Sites. 3 in 4 go.id Sites Still Run Long-Lived Certificates, kielltampubolon.id, 2026-10-25

• A 1-Day Cooldown Would Have Blocked 70% of 2026's Hijacked npm Releases. Against Typosquats, 7 Days Still Misses 45%

  A 1-day cooldown blocks 70.4% of hijacked npm releases, while a 7-day cooldown still lets 45% of born-malicious npm packages through.

  Sample:

  11,556 malicious npm and PyPI packages

  Advisory window:

  1 Jan to 24 Oct 2026

  Bahasa Indonesia

  Cite as: Kiell Tampubolon, A 1-Day Cooldown Would Have Blocked 70% of 2026's Hijacked npm Releases. Against Typosquats, 7 Days Still Misses 45%, kielltampubolon.id, 2026-10-25

• Python 3.15 Is Out. I Checked the Top 500 PyPI Packages: 97% Install From a Wheel, 12 Still Run Build Scripts

  485 of the top 500 PyPI packages (97.0%) install from a wheel on Python 3.15, and 12 of the other 15 download a source archive and run its build code.

  Sample:

  Top 500 PyPI packages by downloads

  Data collected:

  25 Oct 2026

  Cite as: Kiell Tampubolon, Python 3.15 Is Out. I Checked the Top 500 PyPI Packages: 97% Install From a Wheel, 12 Still Run Build Scripts, kielltampubolon.id, 2026-10-25

• The eMudhra Fallout, Part 2: I Scanned 30 Docker Images. 10 Still Trust the Root Chrome Is Dropping

  10 of 30 popular Docker images still ship emSign ECC Root CA - G3, which Mozilla's NSS has removed and Chrome is about to drop.

  Sample:

  30 popular Docker images

  Data collected:

  24 Oct 2026

  Bahasa Indonesia

  Cite as: Kiell Tampubolon, The eMudhra Fallout, Part 2: I Scanned 30 Docker Images. 10 Still Trust the Root Chrome Is Dropping, kielltampubolon.id, 2026-10-25

• I Wrote an MCP Server Auth Test Harness for the 2026-07-28 Spec. Here Is What Broke First

  A 10-test harness scored a deliberately typical MCP server at 2 of 10 and a hardened version at 10 of 10.

  Sample:

  10 auth tests, 2 versions of one MCP server

  Published:

  25 Oct 2026

  Cite as: Kiell Tampubolon, I Wrote an MCP Server Auth Test Harness for the 2026-07-28 Spec. Here Is What Broke First, kielltampubolon.id, 2026-10-25

• I Pointed 3 Static Scanners at an MCP Server That Fails 8 Auth Tests. They Found 0, Including Mine

  mcpscan, Semgrep with 200 rules and Bandit all found 0 of the 8 authorization bugs, and five custom Semgrep rules caught 3 of 8.

  Sample:

  3 static scanners, 8 auth bugs, 2 MCP servers

  Published:

  25 Oct 2026

  Cite as: Kiell Tampubolon, I Pointed 3 Static Scanners at an MCP Server That Fails 8 Auth Tests. They Found 0, Including Mine, kielltampubolon.id, 2026-10-25

• Benchmarking My MCP Security Scanner: 14 of 14 Findings, Zero False Positives

  The scanner detected 14 of 14 planted findings with 0 false positives, at a median of 82 microseconds per manifest, on synthetic manifests rather than real-world servers.

  Sample:

  5 synthetic fixtures, 24 tools

  Published:

  12 Sep 2026

  Cite as: Kiell Tampubolon, Benchmarking My MCP Security Scanner: 14 of 14 Findings, Zero False Positives, kielltampubolon.id, 2026-09-12

• We Planted 10 Vulnerabilities to Test Free Semgrep. It Reported 3.

  Free zero-config Semgrep reported 3 of 10 planted vulnerabilities, up from 1 of 10 with generic mock code.

  Sample:

  10 planted vulnerabilities in one React and TypeScript app

  Published:

  16 Jul 2026

  Cite as: Kiell Tampubolon, We Planted 10 Vulnerabilities to Test Free Semgrep. It Reported 3., kielltampubolon.id, 2026-07-16

• My Scanner Passed Until I Built a Harness That Lied to It on Purpose

  6 of 7 synthetic attack fixtures fired, and the miss was an API key in a JSON config.

  Sample:

  7 synthetic attack fixtures, one per detection rule

  Published:

  14 Sep 2026

  Cite as: Kiell Tampubolon, My Scanner Passed Until I Built a Harness That Lied to It on Purpose, kielltampubolon.id, 2026-09-14

• I Traced 29 CVEs in One MCP Server to 4 Root Causes

  NVD published 29 CVE records for mcp-atlassian on September 22, and they trace back to 4 root causes.

  Sample:

  29 mcp-atlassian CVE records

  Published:

  4 Oct 2026

  Cite as: Kiell Tampubolon, I Traced 29 CVEs in One MCP Server to 4 Root Causes, kielltampubolon.id, 2026-10-04