Blog
Measured findings on supply-chain attacks against package registries and coding agents. Original data, including what DepWall does not catch.
18 posts · updated 2026-09-20 · RSS
Nothing matches that.
-
npmhow-tosupply chain
How to check if an npm package is safe before you install it
Seven checks you can run in under a minute, what each one actually proves, and — the part most guides skip — the specific attacks that pass all seven.
-
incident responsenpmsupply chain
What to do after you installed a compromised npm package
Removing the package is the least important step and most teams stop there. The credentials it already took are the incident. An ordered response, and the reasoning behind the order.
-
npmsupply chainshai-hulud
How npm supply-chain attacks actually reach your machine
Five delivery paths, ranked by how much of the real traffic each one carries — and what Shai-Hulud changed by making the compromised maintainer the delivery mechanism.
-
ai-agentsclaude-codecursor
Securing AI coding agents: the install is the part you can actually control
Claude Code, Cursor and Codex install dependencies faster than anyone reviews them, and the package gets to talk back. What a prompt instruction cannot do, and what a shell-level gate can.
-
slopsquattingai-agentssupply chain
Slopsquatting: what it is, and why AI agents made an old attack work again
Typosquatting needed you to make a mistake. Slopsquatting only needs a model to be confident. The measured hallucination rates, the names attackers are actually waiting on, and what closes the gap.
-
policyverdictssupply chain
Org policy can tighten a verdict. It can never unblock one.
Letting a web dashboard influence a security gate is one compromised account away from installing the package the engine just stopped. So the merge is asymmetric: block always applies, allow only ever reaches ASK, and BLOCK is not negotiable by configuration.
-
measurementtestingsupply chain
Zero false positives is also what a broken scan reports
flagged: 0 is both the result the measurement exists to produce and exactly what a silently muted rule prints. So the harness now re-proves, from inert fixtures, that the scan it just ran was capable of failing.
-
privacyai agentsverdicts
Writing the privacy page found the sentence our pitch could not support
Private repo scans never leave the machine is only true with the LLM judge switched off. Auditing every outbound request in the source, rather than writing the page from the pitch, is what surfaced it.
-
pypisignalsmeasurement
Following an import out of setup.py flagged a clean PyPI package
Reading the module a setup.py imports closed the last known gap in our build-script corpus and immediately broke a top-300 package. nodeenv went to BLOCK because two ordinary lines sat 40KB apart in one file.
-
civerdictssupply chain
There are two exit-code contracts in this CLI, and one fails open
depwall guard exits 1 on BLOCK and 2 on ASK, fail-closed. depwall check exits 0 on everything except BLOCK, including on an error. It is the command a person reaches for first, and it is the wrong one for a build gate.
-
ai agentssupply chainverdicts
A browser extension cannot block an install, and should not imply it can
We shipped a DepWall extension for npm and PyPI pages. It reports; it does not block — the badge says would, the manifest description says does not block, and a test asserts both.
-
npmbugssupply chain
The string "constructor" was a valid npm integrity hash
Our exact-hash denylist is the one signal with no false-positive rate to trade off. Then we probed it with six inherited property names and it blocked on every one of them.
-
verdictsmeasurementsupply chain
Two BLOCKs are not the same claim
A byte-for-byte match to a published advisory and a package that was uploaded last Tuesday both stop the install. Rendering them identically hides the difference that decides whether it is worth ten seconds or ten minutes.
-
npmsupply chainmeasurement
69% of live npm malware walked past our metadata checks
We ran our own engine over the npm packages OSV flags malicious that are still installable today. Three blocked, eight asked, twenty-five were allowed. Here is why, and what we changed.
-
ai agentsprompt injectionskills
348 files your agent is told to read were being scanned as shell scripts
Skill bundles ship reference documents the agent is instructed to open. We were selecting them correctly and then asking them the wrong question entirely.
-
pypipipbugs
We were checking the wrong release on every pinned pip install
pip install evil==0.1.0 was judged on latest's age, latest's readme and latest's sdist. Four call sites had it, including the server, and we found it while measuring something else entirely.
-
npmprovenanceslsa
The keyv compromise shipped with a valid provenance attestation
Attackers poisoned the source repository and let the project's own GitHub Actions workflow sign the release. npm provenance did exactly what it promises, and the package was malicious anyway.
-
ai agentspluginscode execution
Enabling a plugin is code execution, before you type anything
A plugin's SessionStart hook runs on startup, on /clear and on compaction. There is no install to gate and no prompt. We measured 66 real manifests to find out what the honest shape looks like.