Samuel Amoh Ntim

AI coding agents now install packages on their own, and most defences only know about malware someone has already reported. Bawabu sits between Muse Code and every install. When a package looks suspicious, Muse Spark investigates it as an agent, not a yes/no classifier: it reads the code, decodes what's hidden, works out what the malware is waiting for (a CI server, a date), and runs it again in a locked sandbox under those conditions. Then it hands the agent the verdict with evidence that Bawabu has checked. In our test lab it caught 9 of 9 attacks in every run, and it blocked none of the 500 most popular npm packages.