I gave my coding agents a supply-chain tripwire (and a radar)

My coding agents install packages all day. I don't read the names. Do you?

Thought not. And that's a problem, because agents are brilliant at a few specific mistakes:

• they invent package names that don't exist (and attackers register exactly those names, it's called slopsquatting)
• they fall for typosquats (reqeusts, lodahs)
• they grab a release that went up an hour ago, which is precisely the window when a hijacked release is live (remember chalk 5.6.1?)

So I built Omnis Watchtower, a Claude Code plugin that checks every npm and PyPI install any agent tries to run, BEFORE it runs.

What it actually does

Every Bash call goes through a parser that understands npm, pnpm, yarn, bun, npx, pip, uv, poetry and pipx (chains, cd, env prefixes, requirements files, lockfile diffs, the lot). Each package gets scored against live data: does it exist, is it known malware (OSV, matched to the version that will really install), does it look like a popular package, how old is it, does it run install scripts.

Then one of three things happens:

• Refused. Invented names, malware, typosquats, dependency confusion against your private registry. The agent gets the evidence and nearly always picks the right package on its own.
• Pinned. A brand-new release of a popular package gets rewritten to the newest release that's at least 72 hours old. npm i zod quietly runs as npm i zod@4.6.5 and the agent is told why. No hold, no fuss.
• Held. Anything suspicious but not conclusive gets a Sentinel: a hidden, read-only subagent that goes off and reads the registry page, the repository and the install scripts, then rules on it. The agent carries on with other work, and the verdict lands when it retries.

And because I grew up on 8-bit demos, the whole fleet runs on a radar in your terminal. Agents orbit the ship, packages fly in and turn green, amber or red at the ring, Sentinels fly out to scan. There's a cracktro theme too (copper bars, rainbow scrolltext, you know the drill).

Measured, not claimed

Every number here has a write-up in the repo:

• 1,000 popular packages (top 500 npm, top 500 PyPI) scored against the live registries: 998 passed (59 of them pinned), 0 refused, 2 held, and each of those two had two genuine warning signs
• 1.06 s to decide at the 95th percentile for a package it hasn't seen before, instant from cache
• 20 out of 20 live Sentinel investigations reached a verdict, in 43 to 116 seconds
• zero runtime dependencies, because a supply-chain tool with its own supply chain would be a bit rich

What broke on the way

Plenty, and all of it's in the changelog and the validation docs:

• My first malware rule matched the word "malicious" in advisory summaries. Turns out ordinary vulnerability advisories say things like "via a malicious website", so it refused pnpm, undici and vitest. Fixed: it now looks for advisories that say the package itself is malware.
• It ignored OSV's version ranges, so litellm's advisory for two hijacked releases condemned every version. Fixed by asking OSV about the exact version that would install.
• The Sentinel refused 3 perfectly good releases (execa, google-auth-library, google-logging-utils) because I'd told it "use block when unsure". It took me literally. It now works from a rubric: block on a concrete red flag, allow releases that continue the package's history. All three now pass.
• A code review found an agent could add --registry https://anything and walk straight past the lot. Command-line registries are now never trusted.

What it isn't: it's not a sandbox (curl | sh is flagged, not analysed), it's npm and PyPI only for now, and the map is terminal-only. If you want the sandbox, that's its sister project, PoisonBox, which runs an install in a throwaway microVM and records everything it touches.

Try it

/plugin marketplace add Fortitude-Group/omnis-watchtower
/plugin install omnis-watchtower@omnis-watchtower

Then /watchtower for mission control, or /watchtower demo for a scripted attack, offline.

It's free and open source. Go on, try and get something past it :)

oooh , look at those pixels ;)