I gave my coding agents a supply-chain tripwire (and a radar)
My coding agents install packages all day. I don't read the names. Do you? Thought not. And that's a problem, because agents are brilliant at a few specific mistakes: they invent package names that don't exist (and attackers register exactly those names, it's called slopsquatting) they fall for typosquats ( reqeusts , lodahs ) they grab a release that went up an hour ago , which is precisely the…
My coding agents install packages all day. However, they often make mistakes such as inventing non-existent package names, falling for typosquats, or grabbing a recently updated release that may be hijacked. To address these issues, I created Omnis Watchtower, a Claude Code plugin that checks every npm and PyPI install before it runs.
This plugin understands various package managers like npm, pnpm, yarn, bun, npx, pip, uv, poetry, and pipx. It checks each package against live data to determine if it exists, if it's known malware, if it resembles a popular package, and how old it is. Depending on the outcome, the plugin either refuses the package, pins a newer release that is at least 72 hours old, or sends a Sentinel, a hidden, read-only subagent, to investigate further.
The Sentinel conducts a thorough investigation by reading the registry page, the repository, and the install scripts. The agent continues with its work, and the Sentinel's verdict is delivered when the agent retries the operation. The plugin provides a real-time radar in the terminal, displaying packages in green, amber, or red based on their safety status.
The plugin has been thoroughly tested, scoring highly against popular packages on npm and PyPI. Although it only supports npm and PyPI at the moment, its sister project, PoisonBox, is available for running packages in a throwaway microVM for a more comprehensive sandbox environment. Omnis Watchtower is free and open source, encouraging users to try it out and challenge it with potential attacks.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
