My coding agent installed loadash. how do you hard-block fake packages before postinstall runs
Summary
Discusses the problem of AI coding agents installing typo-squatted npm packages (like loadash) and asks for methods to block such fakes before postinstall scripts run.
Similar Articles
Show HN: Safe-install – safer NPM installs with trusted build dependencies
A new npm package called safe-install is introduced to enhance supply chain security by allowing developers to disable install scripts by default and block exotic sub-dependencies, addressing ongoing vulnerabilities.
Giving an AI coding agent a deterministic "architecture linter" so it stops faking "done"
The article describes giving an AI coding agent a deterministic architecture linter that checks Event Storming diagrams for mechanical gaps and open questions, ensuring the agent doesn't fake completion.
@DeRonin_: USE THIS GUIDE TO PROTECT YOUR COMPUTER FROM NPM HACKS THAT STEAL EVERYTHING IN ONE INSTALL TanStack, a code library us…
The article details a supply-chain attack on the TanStack library via NPM, offering a comprehensive guide to protect development environments by locking dependency ages, pinning versions, and auditing CI/CD pipelines and IDE extensions.
run coding agents in localised airlocked microVMs
code-airlock is an open-source tool that runs AI coding agents inside disposable microVMs to avoid granting them direct access to the host filesystem. It clones the repo into a sandbox so agents can work freely, and after completion, users review and pull back only desired changes.
Do your AI coding agents ever step on each other?
AvailSync is a small MCP tool that prevents multiple AI coding agents from conflicting by checking repo availability before allowing an agent to start working.