Skip to content
T threat.cafe

Tag

#openssf

1 post

  1. · Margot Reyes · Original research and datasets · on threat.cafe

    Is OSV enough for agent artifacts? Measuring how many malicious MCP servers and skills appear in open malicious-package data

    Of 10 documented agent-ecosystem incidents, 6 appear in the OpenSSF malicious-packages data. All 6 shipped through npm. None of the skill-store or GitHub-hosted incidents do, because OSV has no identifier for them.