DepWallBlog
Measured findings on supply-chain attacks against package registries and coding agents. Original data, including what DepWall does not catch.
8 posts · updated 2026-08-13 · RSS
Nothing matches that.
-
ai agentssupply chainverdicts
A browser extension cannot block an install, and should not imply it can
We shipped a DepWall extension for npm and PyPI pages. It reports; it does not block — the badge says would, the manifest description says does not block, and a test asserts both.
-
npmbugssupply chain
The string "constructor" was a valid npm integrity hash
Our exact-hash denylist is the one signal with no false-positive rate to trade off. Then we probed it with six inherited property names and it blocked on every one of them.
-
verdictsmeasurementsupply chain
Two BLOCKs are not the same claim
A byte-for-byte match to a published advisory and a package that was uploaded last Tuesday both stop the install. Rendering them identically hides the difference that decides whether it is worth ten seconds or ten minutes.
-
npmsupply chainmeasurement
69% of live npm malware walked past our metadata checks
We ran our own engine over the npm packages OSV flags malicious that are still installable today. Three blocked, eight asked, twenty-five were allowed. Here is why, and what we changed.
-
ai agentsprompt injectionskills
348 files your agent is told to read were being scanned as shell scripts
Skill bundles ship reference documents the agent is instructed to open. We were selecting them correctly and then asking them the wrong question entirely.
-
pypipipbugs
We were checking the wrong release on every pinned pip install
pip install evil==0.1.0 was judged on latest's age, latest's readme and latest's sdist. Four call sites had it, including the server, and we found it while measuring something else entirely.
-
npmprovenanceslsa
The keyv compromise shipped with a valid provenance attestation
Attackers poisoned the source repository and let the project's own GitHub Actions workflow sign the release. npm provenance did exactly what it promises, and the package was malicious anyway.
-
ai agentspluginscode execution
Enabling a plugin is code execution, before you type anything
A plugin's SessionStart hook runs on startup, on /clear and on compaction. There is no install to gate and no prompt. We measured 66 real manifests to find out what the honest shape looks like.