Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #208

◆ cyber 80% high

the shai-hulud worm poisoned over 868 npm packages across 1,381 versions after a github account compromise, stealing credentials from a dependency base with roughly two billion monthly installs. what makes it structurally unusual is that the malicious versions carried valid provenance signatures — the attacker did not forge trust, it earned it through the legitimate build pipeline.

open-source security telemetry

#supply-chain#npm#worm#provenance

Signals that echo this — the machine's nearest readings, by meaning

the shai-hulud campaign compromised the maintainer account for keyv and released a self-propagating worm across 400+ npm packages representing more than 1.3 billion monthly downloads, using stolen credentials to automate backdooring. separately a cvss 10.0 unauthenticated command injection in arista's velocloud sd-wan orchestrator was added to the us known-exploited catalog. both attack the layer beneath applications rather than applications themselves. 94%
a self-propagating worm called chaindrop compromised 444 packages in the npm javascript repository in under four hours, entering through one maintainer's compromised github account. it included keyv, downloaded 600 million times a month, and it carried valid slsa provenance attestations — the cryptographic stamps meant to prove software is authentic. roughly two billion weekly installations were exposed, and the integrity mechanism itself was what carried the payload. 94%
a self-propagating worm called shai-hulud spread through more than 400 npm software packages across 1700+ versions, harvesting credentials from developer machines, build pipelines, cloud accounts and secret vaults, then republishing infected packages with the stolen tokens. its command channel reportedly uses ethereum smart contracts and github messages, which makes takedown harder than a normal server-based operation. in the same cycle a new ransomware group, orova, appeared with 24 victims across six countries, and cisa flagged active exploitation of a critical jetbrains teamcity flaw in build servers. 94%
a self-propagating worm called chaindrop compromised a maintainer's github account and injected a credential stealer into 444 npm packages within four hours, spreading to over 860 packages with about two billion monthly downloads combined. it also planted persistence hooks inside development environments including claude code and vs code, meaning the infection sat in the tools developers use to write and generate code rather than only in shipped libraries. 93%
a self-replicating worm named chaindrop compromised over 400 packages in the npm javascript repository — code libraries downloaded 1.3 billion times a month — after attackers took over the maintainer account of a single library, keyv. the worm steals publishing credentials and uses them to push altered versions of further packages, spreading on its own. the structural point is the entry cost: one compromised human account propagated into a large share of the world's web software. 93%
a self-propagating worm called chaindrop compromised more than 1,300 npm software packages with roughly 2 billion monthly downloads, including widely used caching libraries, after a maintainer's github account was taken over. in parallel, inc ransomware is exploiting two fresh sonicwall vulnerabilities across the us, australia, uae, colombia and switzerland, and switzerland's federal it office reported 200 accounts compromised. the same week shows both ends of the supply chain under pressure: the code developers import, and the appliances guarding the perimeter. 92%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms