build1 publisher
Eighteen flagged agent packages still install from npm weeks after the feeds listed them
AgentGate read the shipped code behind 30-plus OSV and GHSA flags, verified 19 npm packages as malicious, and found 18 still resolvable on publication day. Removal, not detection, is where the chain stopped.
Publishers:dev.to
Reality
- Evidence48
- Adoption20
- Hype gap+22
- Incentives78