From the counter
52 posts
-
Who flagged it first? Public timestamps from nine 2025-2026 supply-chain incidents, from publish to KEV
Where public timestamps exist, malicious npm releases were flagged within minutes and pulled within about 3 to 5 hours. Open malware feeds caught up near removal time. CVEs and KEV listings came days to six months later.
-
Official-looking isn't official: how to verify who published an MCP server named after a real vendor
The first malicious MCP server in the wild, postmark-mcp, was a copy of a real vendor's code under an unrelated npm account. A ten-minute routine that starts from the vendor's own docs catches that pattern before install.
-
Valid provenance, malicious package: what npm trusted publishing does and doesn't protect your agents from
Trusted publishing removes stored publish tokens, and provenance proves where a package was built. Neither says the code is benign. In 2026 malicious releases shipped both without provenance and with valid provenance.
-
Slopsquatting when no human types the name: what changes for package policy once agents choose and install dependencies
Most hallucinated package names are not typos, and many repeat, so typo checks miss them. When an agent installs on its own, check existence, age and known-bad status before the install runs.
-
Skills inherit everything your agent can touch: scoping credentials and shell access per skill and MCP server
A skill or local MCP server runs with the agent's environment, files and network. The working least-privilege unit is the credential and command surface each one can reach, set in sandbox, permission and server config, not in the prompt.
-
Markdown is executable now: why SKILL.md instructions slip past code scanners, and what a skill review must actually read
A skill's behaviour lives in its prose, its frontmatter and its load-time commands, not only its scripts. Code scanners read the scripts. This one-page rubric reviews the rest as code.
-
Six agent-security indicators a CISO can report every quarter without vanity metrics
Report coverage, checked-install share, unknown-artifact rate, time to answer "are we exposed?", canary pass rate and approval-tier mix. Each has a numerator, a denominator and a data source you already own.
-
Shadow AI's $670,000: how to read IBM's breach-cost figure before it goes into your budget request
The $670,000 is an average cost gap between breached organisations with high and low shadow-AI use, from a 600-organisation study of 2024-25 breaches. It supports prioritisation, not a savings claim, and a newer edition is out.
-
Release-age cooldowns for agent installs: the cheap control that would have stopped axios, and its cost
Hijacked releases of axios and nx were live for roughly 2 to 12 hours. A one-day minimum release age blocks that window for every agent install. The cost is delayed fixes, so set an exact-version fast lane.
-
Popular isn't vetted: install counts, stars and 'official-looking' names are the signals attackers fake first
Documented agent-ecosystem attacks faked forks and contributors, borrowed vendor names and topped AI search results. Rank trust signals by how cheaply they can be forged, and let audit and provenance outrank popularity.
-
OWASP's two agent Top 10s, ASI and AST, mapped to controls you can actually test
OWASP's Agentic Applications list (ASI) and its incubating Agentic Skills list (AST) overlap on supply chain, drift and privilege. This crosswalk pairs each AST item with ASI risks, a test, and an honest tooling status.
-
Is OSV enough for agent artifacts? Measuring how many malicious MCP servers and skills appear in open malicious-package data
Of 10 documented agent-ecosystem incidents, 6 appear in the OpenSSF malicious-packages data. All 6 shipped through npm. None of the skill-store or GitHub-hosted incidents do, because OSV has no identifier for them.
