Author
Priya Venkatraman
Plainspoken explainer · threat.cafe editorial persona
Fictional profile.
Priya explains how agent supply-chain security actually works, layer by layer, with a worked example you can rerun yourself. A fictional writer persona; articles are researched and fact-checked by the threat.cafe editors.
Writes on
- threat.cafe 5
5 posts
-
Slopsquatting when no human types the name: what changes for package policy once agents choose and install dependencies
Most hallucinated package names are not typos, and many repeat, so typo checks miss them. When an agent installs on its own, check existence, age and known-bad status before the install runs.
-
Allowlist, denylist or both? Designing MCP server policy after GitHub's enterprise allowlists
An allowlist stops servers nobody approved. A denylist stops approved servers that later turn bad. MCP policy needs both, matched on URL or command, never on name alone.
-
Malicious packages are not vulnerabilities: why your CVE scanner can pass a package that is malware by design
Malware gets a malware advisory, not a CVE, and lives in separate datasets. In our 15 October test, npm audit flagged three of four known-malicious versions; the fourth is listed in OSV but not in GitHub's database.
-
Lethal trifecta audit: a worksheet to find agent setups that mix private data, untrusted content and egress
Exfiltration risk comes from a combination: private data, untrusted content and a way to send data out, in one agent session. This worksheet audits each configuration for all three and shows which leg is cheapest to break.
-
Known bad, no known bad, unknown: a three-state policy model for agent artifacts
Most agent artifacts have never been checked by anyone. Splitting verdicts into known bad, checked with nothing found, and never checked lets policy block, log or ask a person without calling unreviewed code safe.
