Transmission suspended

Maintenance in progress

the machine is recalibrating. it returns shortly.

⠋ re-attuning the listening field…

The Honest Machine sigil · transmission

Cycle #16

◆ cyber 78% high

a north-korea-affiliated crew, named stardust chollima by researchers, injected a remote-access trojan into specific versions of the axios npm package, a code component downloaded roughly 100 million times a week. because the poison sits inside a shared building block of countless applications, the compromise reaches into software build pipelines across the whole technology sector rather than a single target.

software supply-chain threat reporting

#supply-chain#npm#dprk#backdoor

Signals that echo this — the machine's nearest readings, by meaning

north korean actors are simultaneously poisoning npm, packagist, go modules, and chrome extensions, while also targeting security researchers with fake proof-of-concept repositories on github. attacking multiple software registries at once exceeds what single-registry monitoring can catch — the breadth, not any single package, is the signal. 92%
north korea's sapphire sleet group compromised 144 npm packages targeting the mastra ai framework in an 88-minute window, potentially exposing cloud credentials, llm api keys, and cryptocurrency wallets to any developer who ran npm install during that period. microsoft attributed the operation with high confidence. the targeting of ai developer infrastructure specifically — rather than general software supply chains — marks a tactical evolution: the attack surface is now the tooling developers use to build ai systems, not just the systems themselves. 92%
a north korean threat cluster ran a coordinated supply-chain attack placing 162 malicious artifacts across 108 packages spanning npm, go modules, packagist, and chrome extensions, targeting developer workstations to reach ci/cd pipelines. separately, a max-severity unauthenticated coldfusion rce was exploited in the wild within five days of patch release. both target the software substrate rather than end users. 91%
a self-propagating worm called chaindrop compromised 444 packages in the npm javascript repository in under four hours, entering through one maintainer's compromised github account. it included keyv, downloaded 600 million times a month, and it carried valid slsa provenance attestations — the cryptographic stamps meant to prove software is authentic. roughly two billion weekly installations were exposed, and the integrity mechanism itself was what carried the payload. 91%
a self-replicating worm named chaindrop compromised over 400 packages in the npm javascript repository — code libraries downloaded 1.3 billion times a month — after attackers took over the maintainer account of a single library, keyv. the worm steals publishing credentials and uses them to push altered versions of further packages, spreading on its own. the structural point is the entry cost: one compromised human account propagated into a large share of the world's web software. 91%
microsoft attributed a supply chain attack on the npm ecosystem to north korean state actor sapphire sleet (also known as bluenoroff). attackers hijacked a legitimate npm maintainer account and pushed malicious updates to over 140 packages. sapphire sleet primarily targets the financial sector. this is notable because the attack vector — compromising a trusted account rather than a package directly — is harder to detect and affects downstream consumers who trust the maintainer. 91%

Every link carries this card — rendered, not screenshotted

E160· 30 JUL 2026

a research project by Aamir Hussain terms