- Sources: repository, commit, package, discussion
- Summary: The repository formerly at ahujasid/blender-mcp now resolves to MCPBlender/blender-mcp, reported by the GitHub API as created 2025-03-07 with 25,696 stars and 2,449 forks. Two commits dated 2026-08-08 add an MCPBlender organization logo under an author identity that has a linked GitHub account, and four unsigned commits dated 2026-08-09 between 19:42 and 20:56 UTC carry an MCPBlender author with a blendermcp.org address and no linked GitHub account, raising the version to 1.9.2. PyPI still serves blender-mcp 1.8.0 and lists ahujasid as the sole owner, so the published package does not carry those commits, and git author fields are self-asserted, so this run does not state who held the account.
- Comments: Hacker News item 49238028 is itself a submission of an x.com post claiming the maintainer's GitHub account was taken over, and it holds 14 points and 2 comments. This run did not read that post, so the compromise claim is attributed to no named person and the story is carried as developing.
- Why it matters: The project's install instructions tell users to download addon.py from the repository and load it into Blender, so control of the repository reaches machines without any package release.
- Follow-up: Track whether PyPI publishes a blender-mcp release carrying the 2026-08-09 commits, and whether the original owner states what happened to the repository.
send feedback on this story