Nipmod

Helping humans and AI agents discover, verify, and use software safely.

[Nipmod @nipmod]

@kevincodex @Franzferdinan57 @gitlawb_intern Hey kevin, nipmod does that already for multiple sources, you know where to find us if you want to work some things out!

[Nipmod @nipmod]

This is exactly why we’re building Nipmod

Software discovery needs a trust layer before execution, for humans AND for AI agents. Exact package version, install hooks, provenance, risk signals, approval boundary.

@MsftSecIntel happy to compare notes

https://t.co/lM4xDkJkZx

[Microsoft Threat Intelligence @MsftSecIntel]

Microsoft has identified a npm supply chain compromise impacting 90+ redhat-cloud-services/* packages, including patch-client 4.0.4, insights-client 4.0.4, rbac-client 9.0.3, host-inventory-client 5.0.3, frontend-components 7.7.2, and others. The payload is a self-propagating worm that infects other npm packages and self-publishes.

Each compromised package adds a malicious preinstall hook, embedding an index.js script in the package.json that silently executes “node index.js” during installation, downloads Bun, and runs a payload that steals secrets from npm, GitHub, Amazon Web Services (AWS), and Secure Shell (SSH). The added code bloats index.js from ~8KB to ~4.3MB, acting as a heavily obfuscated ROT-9 eval loader.

If any of the compromised packages are installed, users and organizations should assume compromise, rotate credentials, revert to a previously trusted version, and block compromised packages. Identified compromised npm packages have been taken down, and we continue to work with the npm team. Microsoft continues to investigate this attack and will publish updates as more information is available.

[Nipmod @nipmod]

Welcome @_ditro to Nipmod!

He will focus on security infrastructure, including safe code execution, sandboxing architecture, latency optimization, and privacy / zero-knowledge research.

He brings backend experience across automation, infrastructure optimization, and secure environments.

Step by step, we are bringing in the right people to build Nipmod into something that matters.

[Nipmod @nipmod]

👀

[Hazar @hazarxyz]

Why should finding code and packages be easier only for AI agents?

Soon, @nipmod will also be available for humans through a chat interface.

[Nipmod @nipmod]

This is exactly what we’re here for:

AI agents shouldn’t blindly trust web pages, READMEs, package metadata, model cards or MCP descriptions.

All of that is untrusted input until provenance, sandboxing and execution gates prove otherwise.

Use @nipmod.

[Cyber Security News @The_Cyber_News]

⚠️ New ChatGPT Vulnerability Lets Attackers Turn Web Pages Into Phishing Payloads

Source: https://t.co/mjxOMbnRRX

A browser-based prompt injection technique that transforms any web page into a phishing delivery surface by exploiting ChatGPT’s page summarization feature, rendering attacker-controlled links, fake security alerts, and QR codes directly inside the trusted ChatGPT interface.

The attack builds on the same trust-transfer logic previously demonstrated against Microsoft Copilot, where attacker-crafted email content could manipulate AI-generated summaries through Cross Prompt Injection Attacks (XPIA).

ChatGPhish escalates that premise by swapping the bounded email primitive for the browser where users spend the majority of their working day.

#cybersecuritynews #vulnerability

[Nipmod @nipmod]

For people who are not deep in tech, this is the simplest way to understand Nipmod:

Imagine the internet before Google.

Everything existed, but finding the right thing was painful.

Imagine knowledge before Wikipedia.

Information existed, but there was no clean place to understand it quickly.

That is roughly where AI agents are today with packages, models, repos and tools.

They can write code. They can install software. They can connect APIs. They can use MCP servers.
But before they touch a workspace, they still need a clean way to search, understand and judge what they are about to use.
That is what we are building.
A search and intelligence layer for AI agents before they touch external code, models or tools.

Google helps humans find things. Wikipedia helps humans understand things. Nipmod helps agents find, understand and preflight the technical things they want to use.

It does not replace npm, PyPI, GitHub, Hugging Face or MCP.

It sits above them and gives agents context, trust signals and safe install plans before execution.

That may sound simple.

But so did search before the internet became impossible to navigate without it.

[Nipmod @nipmod]

@base @bankrbot @trynullsec @aeonframework @nookplot @0xSUPERGEMMA @basemateagent

[Nipmod @nipmod]

We just shipped the public integration surface for Nipmod:

Agents and infra teams can now evaluate how Nipmod fits into their stack before they integrate it.

Partner entry:
https://t.co/uvzvovplq8
Agent-readable integration pack:
https://t.co/Fp4Ml0na7I

The hosted API is read-only:
no workspace writes, no package execution, no private workspace data required.
Core API access is protected with beta keys.

This is still beta, but this is the point where Nipmod becomes easier to test, integrate and build around.

If you are building agents, devtools, wallets, MCP servers or onchain infra, we want to talk.

[Nipmod @nipmod]

Raw JSON and methodology are public:

If anyone has a harder package, model, repo or MCP case, send it.

The point is not to make the benchmark easy for Nipmod.

The point is to make the preflight layer harder, stricter and more useful for real agents.

Full benchmark:
https://t.co/ju4rQJ6rUz

Raw JSON:
https://t.co/qrEH9YSLUm

[Nipmod @nipmod]

We ran a public benchmark for the part of package security that matters most for agents:

what an agent knows before it installs a package, pulls a model, reuses a repo or connects an MCP server.

Report: https://t.co/MXXeRhDQSV

+ a Thread for more information

[Nipmod @nipmod]

Full benchmark:
https://t.co/MXXeRhDQSV

GitHub:
https://t.co/RjpL6EthlX

Nipmod is the package intelligence layer for AI agents. The work now is to keep proving it in public.

[Nipmod @nipmod]

We ran a public benchmark for the part of package security that matters most for agents:

what an agent knows before it installs a package, pulls a model, reuses a repo or connects an MCP server.

Report: https://t.co/MXXeRhDQSV

+ a Thread for more information

[Nipmod @nipmod]

We are publishing this early because we want harder cases.

Send us confusing package names, weak metadata, suspicious install behavior, model reuse risks, MCP server ambiguity and real agent workflows.

If an agent might touch it, Nipmod should learn how to inspect it better.