Skip to content
T threat.cafe

Tag

#postmortem

2 posts

  1. · Desmond Okafor-Hale · Incident response · on threat.cafe

    ClawHavoc was a registry-governance failure: what 341 malicious skills say about skill stores and takedowns

    ClawHavoc is retold as a malware story. The useful reading is governance: an open store let a few publishers ship hundreds of look-alike skills. Publisher limits, instruction review and cross-store matching matter more than the payload.

  2. · Tobias Lindqvist-Rao · Incident response · on threat.cafe

    The axios compromise from an agent operator's seat: which controls would have fired, and when

    Replaying the 31 March 2026 axios timeline against seven controls: a release-age delay and install-script blocking covered the whole window, a provenance check caught one of two versions, and advisories came at removal.