Category
Agent artifact supply chain
9 posts
-
Official-looking isn't official: how to verify who published an MCP server named after a real vendor
The first malicious MCP server in the wild, postmark-mcp, was a copy of a real vendor's code under an unrelated npm account. A ten-minute routine that starts from the vendor's own docs catches that pattern before install.
-
Valid provenance, malicious package: what npm trusted publishing does and doesn't protect your agents from
Trusted publishing removes stored publish tokens, and provenance proves where a package was built. Neither says the code is benign. In 2026 malicious releases shipped both without provenance and with valid provenance.
-
Slopsquatting when no human types the name: what changes for package policy once agents choose and install dependencies
Most hallucinated package names are not typos, and many repeat, so typo checks miss them. When an agent installs on its own, check existence, age and known-bad status before the install runs.
-
Skills inherit everything your agent can touch: scoping credentials and shell access per skill and MCP server
A skill or local MCP server runs with the agent's environment, files and network. The working least-privilege unit is the credential and command surface each one can reach, set in sandbox, permission and server config, not in the prompt.
-
Markdown is executable now: why SKILL.md instructions slip past code scanners, and what a skill review must actually read
A skill's behaviour lives in its prose, its frontmatter and its load-time commands, not only its scripts. Code scanners read the scripts. This one-page rubric reviews the rest as code.
-
Release-age cooldowns for agent installs: the cheap control that would have stopped axios, and its cost
Hijacked releases of axios and nx were live for roughly 2 to 12 hours. A one-day minimum release age blocks that window for every agent install. The cost is delayed fixes, so set an exact-version fast lane.
-
Popular isn't vetted: install counts, stars and 'official-looking' names are the signals attackers fake first
Documented agent-ecosystem attacks faked forks and contributors, borrowed vendor names and topped AI search results. Rank trust signals by how cheaply they can be forged, and let audit and provenance outrank popularity.
-
Approved last month, malicious today: a re-verification cadence for MCP servers and skills
Install-time vetting decays the moment a server or skill changes. Tie every approval to an immutable version or hash, re-check on every change, and sweep on a schedule. Cadence by artifact type inside.
-
You can't govern what you can't list: an inventory of skills, MCP servers and hooks across developer laptops
Agent add-ons live in per-user JSON files and folders that MDM, EDR and SIEM do not parse. Build the inventory from those files on every laptop and every checkout. Config-path map dated 15 October 2026, plus a collection script.
