Dev caches hide 264 CVE-laden packages and 71.7 GiB no one audits, warns Cache Commander dev
julsimon · x · 2026-09-27
The author released Cache Commander 0.4.3, adding support for HuggingFace's new cache format plus security fixes, and ran a full scan on his own Mac.
Key findings:
- HF's new format keeps each large file in one place and links it into every repo; his old build missed 1.5 GiB, making model folders look empty
- The full scan found 71.7 GiB of developer caches with 264 cached packages carrying known security advisories
- The worst spot is the npx cache: a September 2025 MCP filesystem server ships 22 vulnerable dependencies, and he has 8 copies of chrome-devtools-mcp (1.0.1–1.6.0, latest 1.10.1)
The core point: your AI agent's tools (MCP servers) live in cache directories nobody audits — a neglected supply-chain attack surface. ccmd is a TUI + MCP server that scans pip/npm/Cargo/HuggingFace/Homebrew caches for CVEs, flags outdated packages, and reclaims disk space.
Related event: Cache Commander 0.4.3 Uncovers Vulnerable Packages in Developer Caches(3 posts)→
More from coding & agent
- IBM open-sources Docling, a free Python library that converts any document to data — mdancho84 · 2026-09-27
- Dev reflects: coding now feels like a waste of time when LLMs solve 99% of problems — justalexoki · 2026-09-27
- Reward hacking bugs revealed: unpruned git history let models peek at patches, edit tests in shared sandbox — willcb · 2026-09-27
- A Content Pinball Machine built entirely with Claude Opus 5.5 satirizes viral randomness — CurieuxExplorer · 2026-09-27
- WebMCP could become the HTML/API layer of the agentic web — Thionne_WTZ · 2026-09-27
- Stanford/Together AI paper: agent teams hit 66.7% vs 48.8% for single agents — mark_k · 2026-09-27