How an item joins or leaves the known-bad list.
Automated heuristics stage candidates, but no record ever blocks a developer's agent until its primary proof is confirmed (by a trusted upstream reviewer such as OpenSSF malicious-packages or CISA KEV, by an AI review whose claims are re-checked in code, or by a person), the original finder is credited, and the release is signed with our Ed25519 key.
Cryptographic release verification
Every sync verifies the SHA-256 digest of feed.json against feed.json.sig using our offline Ed25519 public key before updating ~/.threat.cafe/list.sqlite.
Lookup latency: p50 = 0.096 ms, p99 = 0.247 ms offline.
Staged by machines. Confirmed, then signed.
We separate candidate discovery from blocklist publication so noisy heuristics never break a clean build.
1. Multi-registry candidate staging.
Our harvester polls OSV malware advisories across npm and PyPI, primary security research labs (Koi, Snyk, StepSecurity, Huntress, Straiker STAR Labs, FutureSearch), MCP Registry diffs, and community reports sent to /api/intake.php. OSV malicious-package records are used under Apache-2.0 with attribution to OpenSSF.
2. Confirmation and clean controls.
Each candidate collects evidence across runs. Strong upstream proof (an OpenSSF malicious-packages record for the exact version, CISA KEV, a registry takedown, independent lab reports) lists it automatically; weaker evidence goes to an AI review, and anything the AI is unsure about goes to a person. Every entry names who confirmed it and is scoped to the exact compromised versions so unaffected builds (such as [email protected] or [email protected]) are recorded as no known bad.
3. Finder attribution on every alert.
We never claim someone else's discovery as our own. Every terminal block and browser card links directly to the lab or researcher who published the proof.
4. 5% Maintainer Fund pledge.
As commercial Team and MSP subscriptions come online, 5% of gross subscription revenue is pledged to independent finders and open-source maintainers who help verify reports.
29 deterministic rules and a 48-hour dispute SLA.
Every staged artifact, repo config, and remote MCP server is checked against 29 reproducible rules across four rule families before human triage, and any maintainer can challenge an entry with a guaranteed 48-hour turnaround.
Four deterministic rule families (29 rules)
-
RULE_01..09
Artifact & package detectors. Flags GlassWorm Unicode variation selectors (U+FE00..U+FE0F), prompt overrides, credential path access, Python
.pth/ npm lifecycle hooks, shell pipe exfiltration, release-age gates, typosquats,skills.shsplit-brain repo drift, and missing SLSA provenance. -
CONFIG_01..08
Repo & config poisoning firewall. Flags
disableAllHookstampering, unprompted MCP auto-approve (CVE-2025-59536), malicious MCP command pipes,ANTHROPIC_BASE_URL/OPENAI_BASE_URLexfiltration, Lethal Trifecta capability composition, deprecated*.run.toolsproxies (Oct 31, 2026 sunset), and--allow-httpSSRF bypasses. -
DRIFT_01..06
Remote MCP schema & OAuth drift. Tracks silent tool-description mutations, dangerous OAuth scopes, newly added egress domains, unauthenticated SSE/HTTP transports, Rug-Pull tool schemas, and identity mismatches across 91+ remote MCP servers.
-
RUNTIME_01..06
Local PreToolUse runtime enforcement. Version-accurate SQLite block/allow, Config-Write Firewall blocking agent edits to
.claude/or.mcp.json, TOFU schema pinning (pins.lock), repo audit, workstation discovery (--audit-machine), and offline policy evaluation in<0.4 ms.
Static and drift detectors stage candidates into the review queue; they never auto-block on the public ledger without upstream confirmation, an AI review checked in code, or human sign-off.
48-hour maintainer dispute SLA
- Step 1: Submit dispute. Send the package name, version, and remediation details via
POST /api/intake.php(withaction="dispute") or use the dispute form. - Step 2: Human verification. Within 48 hours, a reviewer verifies the clean build hash, reproduces the fix, and updates the version scoping in artifacts.jsonl.
- Step 3: Signed release push. The updated record is re-signed into /feed.json and list.sqlite, and the public changelog notes the resolution.
Verdict vocabulary invariants
- known bad: verified malicious payload or actively exploited RCE (exit 2).
- no known bad: reviewed build with zero active compromise reports (exit 0).
- unknown: not yet on the reviewed list; governed by local policy.yml.
- Never "safe": we never issue a blanket guarantee of safety on any code.
Need to report a finding or dispute an entry?
Every maintainer dispute is read by a person; reports are triaged and anything uncertain reaches a person. Researchers receive direct attribution on the public board and in terminal hook output.
Independent curation. threat.cafe is part of manav.id and is not owned by any scanner, registry, or agent vendor. See our Privacy policy and Terms of use.