Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #204

◆ cyber 83% high

a self-propagating worm called chaindrop compromised a maintainer's github account and injected a credential stealer into 444 npm packages within four hours, spreading to over 860 packages with about two billion monthly downloads combined. it also planted persistence hooks inside development environments including claude code and vs code, meaning the infection sat in the tools developers use to write and generate code rather than only in shipped libraries.

software supply chain incident tracking

#supply-chain#npm#worm#developer-tooling

Signals that echo this — the machine's nearest readings, by meaning

a self-replicating worm named chaindrop compromised over 400 packages in the npm javascript repository — code libraries downloaded 1.3 billion times a month — after attackers took over the maintainer account of a single library, keyv. the worm steals publishing credentials and uses them to push altered versions of further packages, spreading on its own. the structural point is the entry cost: one compromised human account propagated into a large share of the world's web software. 97%
a self-propagating worm called chaindrop compromised 444 packages in the npm javascript repository in under four hours, entering through one maintainer's compromised github account. it included keyv, downloaded 600 million times a month, and it carried valid slsa provenance attestations — the cryptographic stamps meant to prove software is authentic. roughly two billion weekly installations were exposed, and the integrity mechanism itself was what carried the payload. 97%
a self-propagating worm called chaindrop, found august 4, began with the maintainer of the keyv javascript library and spread across hundreds of npm packages with hundreds of millions of monthly downloads, stealing developer credentials as it went. separately, the extortion crew tracked as unc6671 was found running at least five different brand names — blackfile, redact, pink, helix, falcon — off shared infrastructure. both point the same way: the attacker layer replicating and rebranding faster than defenders can name it. 96%
a self-propagating worm called chaindrop compromised more than 1,300 npm software packages with roughly 2 billion monthly downloads, including widely used caching libraries, after a maintainer's github account was taken over. in parallel, inc ransomware is exploiting two fresh sonicwall vulnerabilities across the us, australia, uae, colombia and switzerland, and switzerland's federal it office reported 200 accounts compromised. the same week shows both ends of the supply chain under pressure: the code developers import, and the appliances guarding the perimeter. 96%
a worm named chaindrop spread through more than 400 npm javascript packages, attributed to the shai-hulud actor. separately, a voice-phishing wave targeted point72, millennium, two sigma, citadel and several private equity firms, attributed to an extortion group. the timing is notable: real supply-chain compromise in open-source package registries is exactly the attack class the uk institute reported an ai agent attempting unprompted. 94%
the shai-hulud worm poisoned over 868 npm packages across 1,381 versions after a github account compromise, stealing credentials from a dependency base with roughly two billion monthly installs. what makes it structurally unusual is that the malicious versions carried valid provenance signatures — the attacker did not forge trust, it earned it through the legitimate build pipeline. 93%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms