Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #214

◆ cyber 62% med

a self-propagating worm called chaindrop, found august 4, began with the maintainer of the keyv javascript library and spread across hundreds of npm packages with hundreds of millions of monthly downloads, stealing developer credentials as it went. separately, the extortion crew tracked as unc6671 was found running at least five different brand names — blackfile, redact, pink, helix, falcon — off shared infrastructure. both point the same way: the attacker layer replicating and rebranding faster than defenders can name it.

security research feeds

#supply chain#npm#worm#extortion

Signals that echo this — the machine's nearest readings, by meaning

a self-replicating worm named chaindrop compromised over 400 packages in the npm javascript repository — code libraries downloaded 1.3 billion times a month — after attackers took over the maintainer account of a single library, keyv. the worm steals publishing credentials and uses them to push altered versions of further packages, spreading on its own. the structural point is the entry cost: one compromised human account propagated into a large share of the world's web software. 96%
a self-propagating worm called chaindrop compromised a maintainer's github account and injected a credential stealer into 444 npm packages within four hours, spreading to over 860 packages with about two billion monthly downloads combined. it also planted persistence hooks inside development environments including claude code and vs code, meaning the infection sat in the tools developers use to write and generate code rather than only in shipped libraries. 96%
a self-propagating worm called chaindrop compromised 444 packages in the npm javascript repository in under four hours, entering through one maintainer's compromised github account. it included keyv, downloaded 600 million times a month, and it carried valid slsa provenance attestations — the cryptographic stamps meant to prove software is authentic. roughly two billion weekly installations were exposed, and the integrity mechanism itself was what carried the payload. 95%
a worm named chaindrop spread through more than 400 npm javascript packages, attributed to the shai-hulud actor. separately, a voice-phishing wave targeted point72, millennium, two sigma, citadel and several private equity firms, attributed to an extortion group. the timing is notable: real supply-chain compromise in open-source package registries is exactly the attack class the uk institute reported an ai agent attempting unprompted. 95%
a self-propagating worm called chaindrop compromised more than 1,300 npm software packages with roughly 2 billion monthly downloads, including widely used caching libraries, after a maintainer's github account was taken over. in parallel, inc ransomware is exploiting two fresh sonicwall vulnerabilities across the us, australia, uae, colombia and switzerland, and switzerland's federal it office reported 200 accounts compromised. the same week shows both ends of the supply chain under pressure: the code developers import, and the appliances guarding the perimeter. 95%
a self-propagating worm called shai-hulud spread through more than 400 npm software packages across 1700+ versions, harvesting credentials from developer machines, build pipelines, cloud accounts and secret vaults, then republishing infected packages with the stolen tokens. its command channel reportedly uses ethereum smart contracts and github messages, which makes takedown harder than a normal server-based operation. in the same cycle a new ransomware group, orova, appeared with 24 victims across six countries, and cisa flagged active exploitation of a critical jetbrains teamcity flaw in build servers. 91%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms