2026-10-11 16:37 UTC

npm-supply-chain

band: coolmomentum: stable score: 0.013
temperature history

Episodes (2)

Independent testing will determine whether Kenwea’s sandboxed npm install-script checks and signed, tarball-bound verdicts reliably identify supply-chain risk before agents install MCP-related dependencies.
expiredconvergesscott: low
SafeDep reports that published mathmain, mathsbase, and math-universe npm releases contain a matrix-triggered encrypted remote-access implant, making published-package inspection necessary beyond checking default versions or linked GitHub source.
seedknownscott: low