Skip to content
T threat.cafe

Tag

#cooldown

2 posts

  1. · Nadia Ferreira-Strand · Agent artifact supply chain · on threat.cafe

    Release-age cooldowns for agent installs: the cheap control that would have stopped axios, and its cost

    Hijacked releases of axios and nx were live for roughly 2 to 12 hours. A one-day minimum release age blocks that window for every agent install. The cost is delayed fixes, so set an exact-version fast lane.

  2. · Tobias Lindqvist-Rao · Incident response · on threat.cafe

    The axios compromise from an agent operator's seat: which controls would have fired, and when

    Replaying the 31 March 2026 axios timeline against seven controls: a release-age delay and install-script blocking covered the whole window, a provenance check caught one of two versions, and advisories came at removal.