Blog
Notes from the watch path
Supply chain risk, coding agents, MCP configs, and what passive sensors can see on developer Macs, without the fear-mongering.
Homebrew Supply Chain Risks on macOS Developer Fleets
Homebrew is the default package manager on developer Macs, yet most fleet visibility tools and EDRs provide little structured insight into taps, formulae, casks, and unrequested installs. Here is what actually lands on disk and how to monitor it continuously with fleet rules.
- homebrew
- macos
- supply-chain
- fleet-rules
- fleet
IronWorm npm Supply Chain Attack June 2026: Full Analysis, IOCs, and Koban Detection Rules
IronWorm, a Rust-built eBPF worm, hit 37 npm packages in the Arweave and WeaveDB ecosystem in early June 2026. Details on the attack, affected packages, propagation via OIDC, and practical Koban fleet rules with sample configurations to detect it on developer machines.
- npm
- supply-chain
- ironworm
- koban
- fleet-rules
- javascript-packages
June 2026 npm Supply Chain Worms Playbook: Miasma and IronWorm Detection with Koban
The first week of June 2026 saw two major npm worm campaigns (Miasma with the Red Hat and binding.gyp variants, plus IronWorm). This playbook explains the attacks, lists IOCs, and provides ready-to-use Koban fleet rules and full sample configurations to protect developer machines.
- npm
- supply-chain
- miasma
- ironworm
- koban
- fleet-rules
- javascript-packages
- supply-chain-security
Catching Miasma with Koban fleet rules
We expanded the built-in known malicious JavaScript package list and here are the exact YAML rules you can deploy today for the June 2026 waves.
- koban
- rules
- npm
- miasma
- supply-chain
Miasma worm compromises Red Hat npm packages on June 1
A compromised GitHub account let attackers publish trojanized versions of 32 @redhat-cloud-services packages through legitimate CI. The payload stole credentials and tried to spread.
- npm
- supply-chain
- miasma
- red-hat
Phantom Gyp and the binding.gyp bypass in the Miasma npm worm
Attackers stopped declaring preinstall scripts and started abusing node-gyp and a 157-byte binding.gyp file instead. The technique slipped past many script-focused checks.
- npm
- supply-chain
- miasma
- binding-gyp
- phantom-gyp
Coding agents install faster than your review process
Cursor and Claude Code run package managers in the background. By the time a human opens the diff, the dependency is already on disk.
- coding-agents
- supply-chain
- macos
MCP servers are an unsigned install path
Model Context Protocol configs land on disk with no registry, semver policy, or SBOM. A new MCP entry is a supply chain event most stacks never modeled.
- mcp
- supply-chain
- ai-agents
Microsoft's durabletask PyPI compromise of May 19, 2026
Three malicious durabletask versions hit PyPI in 35 minutes with no matching GitHub release. Importing the SDK was enough to run the stealer.
- pypi
- microsoft
- python
- supply-chain
Nx Console, GitHub, and the May 18 supply chain breach
A trojanized VS Code extension lived on the marketplace for roughly 11 minutes. GitHub disclosed exfiltration of about 3,800 internal repositories on May 19, 2026.
- vscode
- github
- supply-chain
- extensions
The TanStack npm compromise of May 11, 2026
TeamPCP chained pull_request_target, GitHub Actions cache poisoning, and OIDC token extraction to publish 84 malicious @tanstack versions in six minutes.
- tanstack
- npm
- github-actions
- supply-chain
Lessons from the XZ Utils backdoor for developer Macs
CVE-2024-3094 showed that upstream compromise can hide in release tarballs for years. Developer laptops pull those packages before any central scanner runs.
- supply-chain
- xz-utils
- macos
The Axios npm compromise of March 2026
On March 31, 2026, UNC1069 published backdoored axios versions for 174 minutes. plain-crypto-js dropped WAVESHAPER.V2 across macOS, Windows, and Linux.
- npm
- axios
- supply-chain
Typosquatting when agents run npm install
Agents resolve package names from context, not careful spelling. Typosquats that humans catch in review slip through when npm install runs unsupervised.
- typosquatting
- npm
- coding-agents
Agent mishaps when automation deletes production
Replit's July 2025 database incident and Cursor's MCP trust bypass show how agent tooling fails without visibility into what changed on disk.
- coding-agents
- incidents
- operations
The Shai-Hulud worm and what it means for npm on Macs
Starting September 15, 2025, a self-propagating npm worm compromised 500+ packages. Developer Macs that ran npm install during the window were in blast radius.
- npm
- supply-chain
- shai-hulud
Why passive sensors beat blocking on agent-heavy Macs
Approval gates slow humans. Agents still install packages and MCP servers in the background. Visibility answers what actually landed on disk.
- passive-sensor
- macos
- fleet
Lockfiles tell you what landed, not who installed it
Koban inventories packages from disk without attributing them to a process. That is a feature, not a gap, and here is why.
- inventory
- lockfiles
- macos
Fleet visibility on macOS without another EDR
Developer Macs need package and MCP inventory, not kernel hooks. A passive sensor fills the gap between MDM and endpoint agents.
- macos
- fleet
- edr
From annual audit to continuous diff
Supply chain incidents unfold in days. Quarterly snapshots cannot show what an agent installed yesterday. Heartbeat diffs can.
- fleet
- visibility
- compliance
YAML policy rules for MCP and package drift
Fleet rules turn inventory diffs into actionable alerts: allowlisted MCP servers, denied package names, and watched version strings.
- fleet-rules
- yaml
- mcp