WorkflowsSection 11 of 13 · 1 workflow

Supply Chain & Trust

Every section above hands your agent more context and more autonomy. This one is the bill that arrives with it. The files you added to the repository so the agent would read them are now the highest-value place in your codebase to put an attack, they arrive through the same registry your components do, and nothing in your pipeline has ever read them.

12 min readThe Untrusted CheckoutOn 4 August 2026 an npm worm stopped bothering with npm install. It committed hooks into .claude/settings.json and .vscode/tasks.json and waited for somebody to open the repository. Agent configuration is executable code that ships through your dependency graph, and your scanners do not read it. Neither does your reviewer.Read

Private workshop

Meet our team for a private workshop.

Book a 15-min call. We'll assess your workflow and match you with the right workshop.

Book a 15-min call

Private Workshop

Want to bring AI into your Frontend workflow?

We help product teams adopt AI-powered development practices, from agent workflows to custom skills and tooling, on whichever coding agent they already run.

What happens next

01
Tell us what you are building.
Your stack, the AI tools you use, where you are stuck.
02
We book a 15-minute call.
We look at how your team works with agents today.
03
We shape the workshop.
Private and hands-on, on your own codebase.