Is identity trustable?
The entire agentic commerce stack is betting on it.. Trusted Agent Protocol. Verifiable Intent. Agent Payments Protocol. Agentic Commerce Protocol. Universal Commerce Protocol. On-chain agent registries with reputation scores and NFT-based identity.. Every major payment provider and every major AI lab is building on the same foundation: verify who you're dealing with and you'll be safe🤞
Yesterday, someone hijacked 170+ packages across TanStack, Mistral AI, Guardrails AI, UiPath, and OpenSearch. 518 million cumulative downloads. The packages had valid SLSA Build Level 3 provenance. Cryptographic proof they were built from a trusted source.
They were! But the source had been poisoned.
The attacker hijacked the CI/CD runner mid-workflow, extracted a token from process memory, and minted a legitimate publish credential. The packages were signed under TanStack's real identity. The commit was spoofed to look like Anthropic's Claude Code GitHub App.
Every provenance check passed. Every identity was "verified." Every package was malware.
The payload steals GitHub tokens, npm tokens, AWS keys, cloud secrets, crypto wallets, even your 1Password vault. Then it writes itself into .claude/settings.json and .vscode/tasks.json so it re-executes on every tool event. Uninstall the package. The malware stays. Revoke your GitHub token without cleaning the hook? It runs rm -rf ~/.
82% of organizations have unknown AI agents in their infrastructure. 78% have no policy for managing AI identities. OWASP put Identity and Privilege Abuse at #
3# on their agentic threat list. Gartner calls it the top cybersecurity trend of 2026.
And yet. Every protocol I listed answers the same question: "Is this agent who it claims to be?" Not one answers: "Is this action allowed?"
Identity is a costume. A forged signature passes the same check as a real one. A reputation score of 98 means nothing if the agent got owned ten minutes ago.
PreFlight doesn't check identity. It checks actions.
You write a policy in plain English: "Never send credentials to any external endpoint. Never write to agent config directories. Never push commits to unapproved repos."
We compile it to formal logic. An SMT solver checks every action before it executes. SAT means allowed. UNSAT means blocked.
The solver doesn't know what SLSA is. Doesn't know what a trust score is. It sees one thing: the action. "Send AWS keys to ip address" violates the policy. "Write to .claude/settings.json" violates the policy. Every time.
Six protocols that answer "who is this?" We built the one that answers "should this happen?"
If your agent is doing things you don't fully understand, start there. Our /explain endpoint is free. Send it any tool call and it tells you what the action actually does in plain English. view our docs below 👇
Check the action, not the identity.
‼️🚨 BREAKING: A new npm supply-chain attack uses a dead-man's switch. The payload plants a watcher on your machine that nukes your home directory the second you revoke the GitHub token it stole from you.
The compromise happened today, across 42 official tanstack npm packages, 84 malicious versions in total. tanstack/react-router alone pulls more than 12 million weekly downloads.
The attacker forked TanStack's repository and pushed a single hidden commit. From there, they tricked TanStack's own release system into signing the malicious packages as if they were the real thing. To npm, and to anyone checking the cryptographic proof of origin (SLSA provenance), the poisoned versions looked 100% legitimate.
Maintainer Tanner Linsley confirmed the whole team had 2FA enabled. It didn't matter. This is the first documented npm worm in history that ships with a valid, signed certificate of authenticity, the same one defenders rely on to know a package wasn't tampered with.
Show more