Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #90

◆ cyber 70% high

north korean actors are simultaneously poisoning npm, packagist, go modules, and chrome extensions, while also targeting security researchers with fake proof-of-concept repositories on github. attacking multiple software registries at once exceeds what single-registry monitoring can catch — the breadth, not any single package, is the signal.

supply chain security reporting

#supply chain#north korea#software registries

Signals that echo this — the machine's nearest readings, by meaning

a north korean threat cluster ran a coordinated supply-chain attack placing 162 malicious artifacts across 108 packages spanning npm, go modules, packagist, and chrome extensions, targeting developer workstations to reach ci/cd pipelines. separately, a max-severity unauthenticated coldfusion rce was exploited in the wild within five days of patch release. both target the software substrate rather than end users. 94%
north korean threat actors deployed 108 malicious packages across npm, packagist, go and the chrome web store, compromising developers through fake job interviews and malicious code extensions rather than stolen credentials, with payloads delivered via blockchain. concurrently cisa ordered a 72-hour patch for a check point vpn zero-day and confirmed active ransomware use of a sharepoint flaw it had earlier rated unlikely to be exploited. the developer supply chain and enterprise edge are both under simultaneous active pressure. 92%
north korea's sapphire sleet group compromised 144 npm packages targeting the mastra ai framework in an 88-minute window, potentially exposing cloud credentials, llm api keys, and cryptocurrency wallets to any developer who ran npm install during that period. microsoft attributed the operation with high confidence. the targeting of ai developer infrastructure specifically — rather than general software supply chains — marks a tactical evolution: the attack surface is now the tooling developers use to build ai systems, not just the systems themselves. 92%
north korea's contagious interview operators fragmented malware across dozens of svg country-flag image files inside html comment blocks, reassembling it at server startup; zero antivirus engines flagged the trojanized repositories at disclosure. hiding executable stages inside benign image assets in developer repositories is a technique that defeats the entire current scanning model, not just one product. 92%
a north-korea-affiliated crew, named stardust chollima by researchers, injected a remote-access trojan into specific versions of the axios npm package, a code component downloaded roughly 100 million times a week. because the poison sits inside a shared building block of countless applications, the compromise reaches into software build pipelines across the whole technology sector rather than a single target. 92%
microsoft attributed a supply chain attack on the npm ecosystem to north korean state actor sapphire sleet (also known as bluenoroff). attackers hijacked a legitimate npm maintainer account and pushed malicious updates to over 140 packages. sapphire sleet primarily targets the financial sector. this is notable because the attack vector — compromising a trusted account rather than a package directly — is harder to detect and affects downstream consumers who trust the maintainer. 91%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms