Everybody wants to build infra. Automate something which is known and well understood. Hoping someone else will use it to solve end user's problem which is hard to understand, messy and often highly contextual.

To summarize: Everyone wants to automate stuff. Most people do not want to touch boring, large problems.

110 tools. That’s probably a reason why Anthropic is probably switching to sandboxed code execution over MCPs.

It’s just easier to write code and do something specific for a task than load so many tool metadata.

I did not go past IDA. But I remember idc and IDA python. I wonder if it’s a better approach to expose a single tool to execute scripts to query what the agent needs.

I see this as “libs” for the agents. They can discover relevant skills by searching a known index, extend their capability for on a given task.

While this makes sense for higher autonomy, it brings the well known supply chain security issue.

Currently all index list skills that are unverified. There are already examples of malicious skills.

LFS. Brings back so many painful memories. But then, learned so much.

Loved the idea of AI talking to AI and inventing something new.

Sure. You can dump the DB. Most of the data was public anyway.

Until this was fixed you could also just write to the DB.

uh, the api keys certainly weren't

Tried installing clawdbot. Got blocked by (my own) sandbox because it tried to git clone some stuff which in turn was accessing my private keys.

- clawdbot depends on @whiskeysockets/baileys

- @whiskeysockets/baileys depends on libsignal

npm view @whiskeysockets/baileys dependencies

[..] libsignal: 'git+https://github.com/whiskeysockets/libsignal-node.git', [..]

libsignal is not a regular npm package but a GitHub repository, which need to be cloned and built locally.

So suddenly, my sandbox profile, tuned for npm package installation no longer works because npm decides to treat my system as a build environment.

May be genuine use-case but its hard to keep up.

I still think metadata associated with packages (like stars, download count and more) are easy to fake and not the best metric. OpenSSF scorecard has some adoption among project maintainers but hardly any adoption in terms of making security decision based on it.

IMHO code is the source of truth. It may seem infeasible to mass analyse OSS code, but given the recent incidents (Shai-Hulud et.al) I think that’s the way forward. Personally am more bullish on SLSA or other artefact provenance technology adoption. Till that happens, metadata will be misused by attackers.

Thank you for this thoughtful critique—you're absolutely right about metadata manipulation risks.

To be clear: OSS Sustain Guard is not a security tool. I have deep respect for OpenSSF Scorecard, SLSA, and supply chain security work. That's the critical path forward.

We're solving a different problem: maintainer well-being and sustainability. Not "Is this code secure?" but "Are the humans behind it okay?" I want to surface which projects might need community support.

You're right about the limitations:

- Metadata can be gamed

- Private work is invisible

- These are proxies, not truth

Where we're complementary:

- SLSA/Scorecard: "Is this artifact secure?"

- OSS Sustain Guard: "Does the maintainer need support?"

A solo maintainer with perfect security practices can still burn out without funding. That's the conversation I want to start--not to criticize, but to encourage support.

I'd genuinely value your input: Given your expertise in supply chain security, what would you want to see from a sustainability-focused tool that would make it more useful alongside provenance technologies? Are there signals that would be harder to manipulate?

Thank you for taking the time to engage with this project. These conversations help me stay grounded and improve.

Documenting technical details and payload analysis here: https://safedep.io/shai-hulud-second-coming-supply-chain-att...

Like previous variant, it has credential harvesting, self-replication and GitHub public repository based exfiltration.

Double base64 encoded credentials being exposed using GitHub repositories: https://github.com/search?q=%22Sha1-Hulud%3A%20The%20Second%...

This is crazy. The internet has so much direct and transitive dependency on Cloudflare today. Pretty much the #1 dev slacking excuse today is no longer code compiling but cloudflare is down.

Building vet. The goal is to automate open source package vetting beyond just CVE but actually identify code capabilities, malicious code and other security sensitive attributes through code analysis.

https://github.com/safedep/vet