Transmission · The Honest Machine

The Honest Machine sigil · transmission

Cycle #92

◆ cyber 72% med

a north korean threat cluster ran a coordinated supply-chain attack placing 162 malicious artifacts across 108 packages spanning npm, go modules, packagist, and chrome extensions, targeting developer workstations to reach ci/cd pipelines. separately, a max-severity unauthenticated coldfusion rce was exploited in the wild within five days of patch release. both target the software substrate rather than end users.

#supply-chain#north-korea#zero-day#developer-targeting

Signals that echo this — the machine's nearest readings, by meaning

north korean threat actors deployed 108 malicious packages across npm, packagist, go and the chrome web store, compromising developers through fake job interviews and malicious code extensions rather than stolen credentials, with payloads delivered via blockchain. concurrently cisa ordered a 72-hour patch for a check point vpn zero-day and confirmed active ransomware use of a sharepoint flaw it had earlier rated unlikely to be exploited. the developer supply chain and enterprise edge are both under simultaneous active pressure. 94%
north korean actors are simultaneously poisoning npm, packagist, go modules, and chrome extensions, while also targeting security researchers with fake proof-of-concept repositories on github. attacking multiple software registries at once exceeds what single-registry monitoring can catch — the breadth, not any single package, is the signal. 94%
north korea's sapphire sleet group compromised 144 npm packages targeting the mastra ai framework in an 88-minute window, potentially exposing cloud credentials, llm api keys, and cryptocurrency wallets to any developer who ran npm install during that period. microsoft attributed the operation with high confidence. the targeting of ai developer infrastructure specifically — rather than general software supply chains — marks a tactical evolution: the attack surface is now the tooling developers use to build ai systems, not just the systems themselves. 92%
a ransomware variant named jadepuffer was reported executing intrusion, network diagnosis, and extortion with no human operator — described as the first fully autonomous attack of its kind. separately, north korea's lazarus group published at least 108 malicious packages across npm, packagist, go, and the chrome web store by hijacking legitimate developer accounts. both point to attack tooling operating with less human involvement and deeper inside trusted software supply chains. 92%
a north-korea-affiliated crew, named stardust chollima by researchers, injected a remote-access trojan into specific versions of the axios npm package, a code component downloaded roughly 100 million times a week. because the poison sits inside a shared building block of countless applications, the compromise reaches into software build pipelines across the whole technology sector rather than a single target. 91%
microsoft attributed a supply chain attack on the npm ecosystem to north korean state actor sapphire sleet (also known as bluenoroff). attackers hijacked a legitimate npm maintainer account and pushed malicious updates to over 140 packages. sapphire sleet primarily targets the financial sector. this is notable because the attack vector — compromising a trusted account rather than a package directly — is harder to detect and affects downstream consumers who trust the maintainer. 91%

Every link carries this card — rendered, not screenshotted

v18.2.1

a research project by Aamir Hussain