Skip to content
T threat.cafe

· Nadia Ferreira-Strand (editorial persona) · Incident response · on threat.cafe

Your agent installed a known-bad package: the first hour, including the credentials you forgot it could reach

If your coding agent installed a package, skill or MCP server that is now known to be malicious, treat the machine as compromised. In the first hour: isolate it, preserve the agent's logs and configuration, rotate every credential the agent could read, from a different and clean machine, check agent memory files and persistence, and then find every other machine and CI run that pulled the same version. The step teams skip is the agent's own credential set: MCP server configs, CLI logins and tokens the agent used on your behalf.

This runbook draws on the response guidance published for the axios compromise by StepSecurity and for malicious agent skills by Snyk. It covers defensive steps only.

Outcome, time and access

Outcome. The malicious code can no longer reach your secrets, every credential it could have read is dead, and you know which other machines are affected.

Time. Plan for 60 minutes of focused work for one laptop. Scoping across an organisation takes longer.

People and access you need before minute 0:

  • A second machine you trust. A phone is not enough for most rotations.
  • Admin access to your identity provider, cloud consoles, Git host and package registry.
  • Someone who can isolate the device: you, IT, or your MSP.
  • Write access to a shared incident note. Log every action with a UTC timestamp.

Use this runbook if, and not if

Use it if an alert, scanner, hook log or advisory says an agent session installed or ran an artifact that is now listed as malicious. Examples include [email protected] and [email protected], which GitHub's advisory GHSA-fw8c-xr5c-95f9 classifies as malware, or a skill from a confirmed malicious campaign.

Do not use it if the artifact has an ordinary vulnerability (a CVE) and no evidence of malicious intent. That is patch management, not incident response.

Do not use it alone if you hold regulated data or have contractual breach-notice duties. This is general information, not legal advice. Bring in your counsel or incident-response retainer early, because notification clocks can start at discovery.

Minute 0 to 10: isolate

  1. Stop every agent session on the machine. Close the terminal sessions. Quit the IDE.
  2. Disconnect the machine from the network. Pull Wi-Fi and Ethernet, or use your EDR's network isolation.
  3. Do not wipe yet. Do not uninstall the package yet. You need the evidence first.
  4. Do not log in to anything new from this machine. Any new token typed here may be captured.
  5. Verify: the machine has no network route. Run ping -c 1 1.1.1.1. It must fail.

Failure trap. StepSecurity reports that the axios dropper deleted its own script and replaced its package.json with a clean stub reporting a different version, so npm list can mislead responders. The presence of node_modules/plain-crypto-js alone indicated that the dropper ran. Trust the advisory and the lockfile over what the package manager reports now.

Minute 10 to 25: preserve the agent's evidence

Agents leave more evidence than a human install does. Copy it to external storage before you change anything.

  1. Copy the project's lockfiles: package-lock.json, pnpm-lock.yaml, yarn.lock, poetry.lock, requirements.txt.
  2. Copy the agent's session transcripts. For Claude Code these sit under ~/.claude/projects/ by default.
  3. Copy your hook and policy logs, if you run PreToolUse hooks or a package wrapper.
  4. Copy agent configuration. For Claude Code, the MCP documentation lists ~/.claude.json (user and local scope) and .mcp.json in the project root. For Cursor, the Cursor MCP documentation lists ~/.cursor/mcp.json and .cursor/mcp.json.
  5. Copy agent memory and instruction files. Snyk advises reviewing SOUL.md and MEMORY.md for unauthorised changes after a malicious skill, because skills can poison memory for persistence. Include CLAUDE.md, AGENTS.md and any skill folders.
  6. Record the exact artifact name, version and the time of first install from the lockfile history or transcript.
  7. Verify: compute hashes of the copies with shasum -a 256 and write them into the incident note.

Minute 25 to 45: the agent credential inventory, then rotate

The blast radius is whatever the agent could read, not whatever you typed. StepSecurity's axios guidance says to rotate all credentials from a separate clean machine, and lists npm tokens, SSH keys, cloud credentials, Git and container registry tokens, Kubernetes configs, .env secrets and browser sessions. Agents add more.

Work through this list on the clean machine. Rotate or revoke each item. Tick it in the incident note with a timestamp.

AGENT CREDENTIAL INVENTORY                                   ROTATED (UTC)
[ ] MCP server secrets in env/headers blocks of
    ~/.claude.json, .mcp.json, ~/.cursor/mcp.json, .cursor/mcp.json   ______
[ ] .env and envFile files referenced by MCP servers                   ______
[ ] OAuth grants the agent's MCP servers hold (GitHub, Google,
    Slack, Linear, Notion, databases): revoke in each provider          ______
[ ] Model provider API keys used by the agent                          ______
[ ] Git host tokens and SSH keys (gh auth, credential helper)          ______
[ ] Package registry tokens (npm, PyPI) - check npm token list         ______
[ ] Cloud CLI sessions and keys (aws, gcloud, az)                      ______
[ ] kubeconfig contexts and service-account tokens                     ______
[ ] Container registry credentials                                     ______
[ ] Browser sessions on this machine (sign out everywhere)             ______
[ ] Secrets in the agent's memory, notes or transcript history         ______
[ ] CI secrets the same repo exposes to workflows                      ______

Rotate in this order: identity provider and Git host first, then cloud and registry tokens, then everything else. The first two can be used to publish or deploy, which turns one laptop into many.

Verify each rotation. Try the old credential from the clean machine where safe, for example with a read-only API call. It must fail.

Minute 45 to 60: scope and notify

  1. Search every repository's lockfiles for the bad version. For the axios case, StepSecurity recommends searching lockfiles for the compromised versions and for plain-crypto-js.
  2. Search CI logs for runs that installed it during the exposure window. StepSecurity advises rotating any secret a workflow could access during a compromised run, and treating self-hosted runners like compromised developer machines.
  3. Check other developers' machines. One agent rarely acts alone if the dependency is shared.
  4. Look for OS-level persistence and the file artefacts named in the finder's advisory.
  5. Notify your security lead, the package maintainer or registry if they do not already know, and counsel if required.
  6. Verify: you have a list of affected machines and CI runs, each with an owner.

Three failure modes and the fix

Failure 1: rotating from the infected machine. New secrets typed on a compromised laptop can be captured. Fix: rotate only from the clean machine. If someone already rotated from the infected one, rotate those credentials again.

Failure 2: forgetting the agent's own grants. Teams rotate their personal tokens and miss the OAuth grants held by MCP servers, or the keys in an MCP config's env block. Those grants often reach production systems. Fix: walk the inventory above, file by file. Revoke OAuth grants in each provider's "connected apps" page, not only in the local config.

Failure 3: trusting the cleanup. The package is gone, npm list looks clean, and the team moves on. StepSecurity's guidance is to reformat and rebuild the affected machine from a known-good state. Huntress, writing about fake OpenClaw installers, notes that OpenClaw configurations hold passwords and API keys that infostealers can harvest (Huntress, March 2026). Assume anything readable was read. Fix: rebuild, do not clean.

After the hour: rebuild and re-enable

  1. Reimage the machine. Restore code from the Git host, not from the old disk.
  2. Pin the dependency to a known-good version with overrides or resolutions. For axios, StepSecurity names 1.14.0 and 0.30.3.
  3. Re-enable agents only with a known-bad check in front of installs, and a release-age delay on new versions.
  4. Write the timeline: first install, detection, isolation, last rotation. Keep it with the evidence hashes.

Health check. The rebuilt machine has no old tokens. The old tokens fail. The lockfiles no longer reference the bad version. The agent's hook log shows the next attempt to install it was blocked.

What this runbook does not cover

Forensic depth, memory capture and attribution belong to your IR provider. Legal and regulatory notification depends on your jurisdiction and contracts; check with counsel or your regulator's official guidance. Specific indicators of compromise change with each incident. Always pull them from the finder's own write-up.

If you want warning before the install rather than after it, the threat.cafe board lists publicly documented malicious agent artifacts with their sources.

Sources

#incident-response #runbook #credential-rotation #mcp #supply-chain

All posts