#security

Three self-propagating npm campaigns in twelve months: the TanStack compromise in May, ChainDrop through keyv in August, 400 plus packages backdoored from one stolen token. You cannot audit your way out of this. Here is the set of controls that actually stops a worm at the door, with the config for each.

Every agent I audited this year had the same shape of problem: it authenticated as a service account with more access than any human on the team, on behalf of a user whose identity was lost the moment the request left the browser. The question 'who is this call for' had no answer in the logs. Fixing it is mostly an OAuth problem, and the pieces exist now.

A single GitHub issue was enough to make a coding agent leak a private repo through the official MCP server. The Git MCP server fell to path traversal from a prompt alone in January. None of these were model failures. They were the same mistake we made with SQL in 2004: letting data and instructions travel on the same wire.