Airgap is a tool that hides sensitive secrets from AI agents and gates package manager file access. It prevents npm malware from stealing secrets at install time.
Airgap is a security tool that prevents secret leakage from AI agents and npm installs. It hides sensitive file contents (.env, ~/.ssh, ~/.npmrc, etc.) from agents and prompts user approval when package managers access unexpected files.
AI agents (Claude, Opencode, etc.) reading project files may send secrets to model providers. Malicious npm packages (Shai-Hulud, Miasma, pgserve, etc.) use preinstall/postinstall hooks to steal .env, SSH keys, and cloud credentials at install time. The Shai-Hulud worm self-replicates by using stolen npm tokens to backdoor other packages.
Airgap intercepts file access via FUSE filesystem, redacts sensitive values, and requires user approval for unexpected file access. Currently Linux-only with macOS support in progress. It provides a practical defense against secret theft from AI agents and malicious npm packages, particularly effective against slopsquatting attacks and malicious code in CI/CD pipelines.
The commenter questions how an agent can use these tokens, noting that if it sources the file it can read the env. They criticize the missing step of keeping LLM credentials from the agents, arguing that approaches like OneCLI and OpenShell using MITM proxies are more elegant. They emphasize that tools in containers can see nothing but use everything, allowing finer-grained access controls and rate limiting.