Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #18

◆ cyber 90% high

more than 1,500 packages in the arch user repository — a community software source for the arch linux operating system — were hijacked and injected with credential-stealing code and optional rootkits, delivered in obfuscated follow-on waves before maintainers purged them. a coordinated poisoning at that scale of a trusted package repository is a supply-chain attack reaching every machine that pulls the affected software, not a single-target breach.

open-source security disclosure

#supply-chain#arch-linux#credential-stealer#open-source

Signals that echo this — the machine's nearest readings, by meaning

three supply-chain compromises surfaced the same day: roughly 1,900 arch linux user-repository packages (~9% of the repo) were hijacked via orphaned-package adoption to inject a rootkit and credential stealer; the awesome motive cdn was backdoored, injecting malicious javascript into widely used wordpress plugins from the source; and north-korea-attributed actors minted and drained tokens worth about $36m from a blockchain identity service. the cluster shows the trusted distribution layer — repos and cdns — being attacked rather than individual sites. 94%
a self-propagating worm called chaindrop compromised 444 packages in the npm javascript repository in under four hours, entering through one maintainer's compromised github account. it included keyv, downloaded 600 million times a month, and it carried valid slsa provenance attestations — the cryptographic stamps meant to prove software is authentic. roughly two billion weekly installations were exposed, and the integrity mechanism itself was what carried the payload. 91%
a self-propagating worm called chaindrop compromised a maintainer's github account and injected a credential stealer into 444 npm packages within four hours, spreading to over 860 packages with about two billion monthly downloads combined. it also planted persistence hooks inside development environments including claude code and vs code, meaning the infection sat in the tools developers use to write and generate code rather than only in shipped libraries. 91%
a self-replicating worm named chaindrop compromised over 400 packages in the npm javascript repository — code libraries downloaded 1.3 billion times a month — after attackers took over the maintainer account of a single library, keyv. the worm steals publishing credentials and uses them to push altered versions of further packages, spreading on its own. the structural point is the entry cost: one compromised human account propagated into a large share of the world's web software. 91%
a self-propagating worm called chaindrop compromised more than 1,300 npm software packages with roughly 2 billion monthly downloads, including widely used caching libraries, after a maintainer's github account was taken over. in parallel, inc ransomware is exploiting two fresh sonicwall vulnerabilities across the us, australia, uae, colombia and switzerland, and switzerland's federal it office reported 200 accounts compromised. the same week shows both ends of the supply chain under pressure: the code developers import, and the appliances guarding the perimeter. 90%
the shai-hulud worm poisoned over 868 npm packages across 1,381 versions after a github account compromise, stealing credentials from a dependency base with roughly two billion monthly installs. what makes it structurally unusual is that the malicious versions carried valid provenance signatures — the attacker did not forge trust, it earned it through the legitimate build pipeline. 90%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms