Home / Blog
Blog
Notes on verifying what agents install
Supply-chain attacks, malware detection, false positives, and paying per call over x402.
- How to vet an MCP server before you connect it to your agent
An MCP server runs with your agent’s access to files, tools, and credentials. A practical checklist for deciding whether to trust one, before you connect it.
- Why an automated dependency scan flags packages that are fine
We ran a behavioral scan over the most-installed npm packages. Most are clean, and the ones that get flagged are mostly legitimate code that happens to look like an attack. Here is how to tell the difference.
- Scan your dependencies for malware in GitHub Actions
Add one step to CI and every pull request that touches your dependencies gets checked for malicious behavior before it merges. Here is how, with the Lazaretto GitHub Action.
- How to tell if an npm package is malicious before you install it
Most malicious npm packages give themselves away if you know where to look: install scripts, credential reads, odd network calls, obfuscation. Here is what to check, and how to automate it.
- Why a scan verdict has to be tied to a hash
A scan tells you a package was fine when it was scanned, not when you install it. Binding the verdict to a content hash closes that time-of-check to time-of-use gap.
- SSH keys, cloud creds, wallets: what a malicious agent skill actually steals
Malicious AI-agent skills and packages target the same high-value secrets every time. Here is what they go after, how they hide it, and how to check a skill before it runs on a machine full of credentials.
- How to check an MCP server for malware before you add it
MCP servers run with real access to your tools and data. Before an agent connects to a third-party one, verify it: a free known-bad lookup and a deterministic scan of the package it ships.
- Pay-per-call verification: how an agent scans a package without an account
Lazaretto is priced per call over x402 (USDC on Base), so an autonomous agent can discover the price, pay, and get a scan inline, with no signup and no key. Here is how the flow works.
- How to verify a skill or package before your AI agent installs it
Autonomous agents install third-party skills, MCP servers, and npm packages on the fly. Here is how to check one for malicious behavior before it runs, with a free known-bad lookup and a deterministic scan.