Security · 1h ago
Malware Found in npm Package Posing as SkillsGuard
Three packages on npm claim the name 'SkillsGuard', but one shipped malware and was pulled from ClawHub. Only AgentGuard by GoPlus Security is a verified, open-source runtime guard at v1.1.28. Over 13% of marketplace skills contain critical vulnerabilities, making it crucial to verify package sources.
Meridian48 take
The story highlights a supply-chain risk in the AI agent ecosystem, where a security tool itself became the attack vector.
npm-malwaresupply-chain-security