---
id: compromised-package-ioc
track: coding
version: 0.1.1
label: blocks
keyword: block
where: write turn-end
sha256: 8f8fc20f88f9b73f426593843a0c2df1429fa4cade2fd297c9b7355297bbd641
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/compromised-package-ioc
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Block Known-Malicious Packages

compromised-package-ioc · version 0.1.1

Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: at commit (Chock refuses the commit, locally and in CI.)



## What it does

Blocks adding a known-malicious package version (npm, PyPI, crates, Go, RubyGems, Packagist manifests and lockfiles), a re-pointed action ref, or an IOC file name, from a dated, sourced list (data/ioc.json, CI fails 120 days after as_of). Runs: commit, agent write, turn's end; only additions judged. Exact versions only: a range is not resolved. A snapshot, not a feed; friction, not a boundary. Adopt under rollout observe.

## Its label on each agent

- Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=compromised-package-ioc
- Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=cursor&p=compromised-package-ioc
- Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=compromised-package-ioc
- GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=compromised-package-ioc
- Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=compromised-package-ioc
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=compromised-package-ioc
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=compromised-package-ioc
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=compromised-package-ioc
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=compromised-package-ioc
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=compromised-package-ioc
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=compromised-package-ioc

## What it misses

This policy does not state what it misses.

## Examples

- Refused: A commit adds a package-lock.json that resolves axios to 1.14.1.
- Allowed: package-lock.json resolves the patched axios 1.14.0.

## Latest change

0.1.1 · 2026-10-27 — Title wording only (IR-F40): "Compromised Package IOC" is now "Block Known-Malicious Packages". The id, guard and tests are unchanged.

## Provenance

- Tested by 43 of 43 cases run automatically
- SHA-256: `8f8fc20f88f9b73f426593843a0c2df1429fa4cade2fd297c9b7355297bbd641`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/compromised-package-ioc (catalog path `base/compromised-package-ioc`)
- Presets: Packages and supply chain
- JSON: `/api/coding/policies/compromised-package-ioc.json`
- Report a problem: https://chock.sh/report/?policy=compromised-package-ioc&version=0.1.1&page=%2Fcoding%2Fpolicies%2Fcompromised-package-ioc%2F