Author
Desmond Okafor-Hale
Contrarian strategist · threat.cafe editorial persona
Fictional profile.
Desmond tests the security controls teams trust by habit against vendor data and real incidents, and says plainly where the consensus breaks. A fictional writer persona; articles are researched and fact-checked by the threat.cafe editors.
Writes on
- threat.cafe 7
7 posts
-
Valid provenance, malicious package: what npm trusted publishing does and doesn't protect your agents from
Trusted publishing removes stored publish tokens, and provenance proves where a package was built. Neither says the code is benign. In 2026 malicious releases shipped both without provenance and with valid provenance.
-
Popular isn't vetted: install counts, stars and 'official-looking' names are the signals attackers fake first
Documented agent-ecosystem attacks faked forks and contributors, borrowed vendor names and topped AI search results. Rank trust signals by how cheaply they can be forged, and let audit and provenance outrank popularity.
-
Treat the developer laptop as a privileged workstation: what agent tokens and stealers changed
Microsoft's device model puts general developers in the enterprise tier, where users install their own software. Agent credentials, MCP configs and stealers aimed at developers make that the wrong tier. Includes a tier test.
-
ClawHavoc was a registry-governance failure: what 341 malicious skills say about skill stores and takedowns
ClawHavoc is retold as a malware story. The useful reading is governance: an open store let a few publishers ship hundreds of look-alike skills. Publisher limits, instruction review and cross-store matching matter more than the payload.
-
Are built-in agent protections enough? What auto mode, MCP allowlists, store scanning and skill scanning cover
Native agent controls are real, and each covers its own surface: one client, one store, one upload path. The residual risk sits across vendors, across registries and after approval. A coverage map with the blank cells left blank.
-
Approval prompts are not a control when people approve 93-97% of them: what Anthropic's data means for policy
Anthropic's own studies show users approve 93-97% of permission prompts and caught 13.6% of planted dangerous commands. Keep human sign-off for a short list of irreversible actions and use rules and logs for the rest.
-
When agent-skill scanners disagree: what conflicting verdicts on the same skill mean for your install policy
In one census, auditors gave the same skill HIGH or CRITICAL and LOW or SAFE ratings on 1,233 listings, and 87.8% of listings had no audit at all. Treat conflict and absence of audit as separate policy states, not as a pass.
