First reported nx.dev
Lead dispatch
First reported island.io
AgentBaiting: How Fake AI Skills Deliver Malware at Scale
Island security researchers uncovered the FakeGit campaign, which used roughly 7,600 malicious GitHub repositories—over 800 posing as AI Skills or MCP servers—to deliver SmartLoader malware that installs the StealC information stealer. The campaign introduces a technique called AgentBaiting, in which AI agents such as Claude Code, Gemini, and ChatGPT autonomously discover the attacker repositories, treat the malicious README as legitimate documentation, and pass installation instructions to users; the operation recorded over 14 million downloads.supply-chain · tool-abuse · malware-delivery · agentbaiting
mcp · ai-agents · ai-skills · llm · copilot
Severity
0.75
The wire · latest
First reported · updated · 2 reports stepsecurity.io
Miasma Supply Chain Attack: Azure Hit, 73 Repos Down, 37 PyPI Wheels
The Miasma supply-chain worm campaign expanded to poison Microsoft's Azure/durabletask GitHub repository with config files that execute a credential-harvesting payload the moment a developer opens the repo in AI coding tools like Claude Code, Gemini CLI, Cursor, or VS Code, triggering GitHub to disable 73 Microsoft repositories including Azure/functions-action. Two days later the Hades variant dropped 37 malicious PyPI wheels across 19 packages using Python .pth startup hooks to run a Bun-powered credential stealer on every interpreter launch, with Socket tracking 448 affected artifacts across npm and PyPI. Details →First reported phoenix.security
Supply Chain Attacks 2026: npm, PyPI, VS Code, AI Agents — 0 CVEs
Phoenix Security's Malware Package Intelligence report analyzes 59 supply chain attack campaigns and 657 malicious package-versions from June 2024 to June 2026, documenting an acceleration across npm, PyPI, and the VS Code Marketplace. It highlights a May 2026 self-propagating worm that turned one compromised maintainer token into 226 poisoned packages, and finds AI agent tooling — MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, and AI coding assistant SessionStart hooks — used as a confirmed delivery mechanism in at least 14 of the 59 campaigns. Details →First reported powerdmarc.com
Malicious MCP Servers & Email Security: The New Supply Chain Threat
The article analyzes the postmark-mcp incident, where a malicious actor published an exact-name lookalike npm package impersonating Postmark's official Model Context Protocol (MCP) server. Across 15 clean releases it built trust before adding a hidden BCC rule that silently forwarded 3,000-15,000 corporate emails per day to an attacker-controlled domain, leaking passwords, invoices, customer data, and auth tokens; because mail flowed through legitimate infrastructure, SPF and DKIM passed automatically. Details →First reported jscrambler.com
Unauthorized Publication of a Malicious npm Package affecting CI
Jscrambler disclosed that a threat actor used compromised npm publishing credentials to publish a malicious version of its 'jscrambler' npm package (versions 8.14, 8.16, 8.17, 8.20), which ran an infostealer during the preinstall hook and was downloaded around 1,479 times in a two-hour window. Per Socket's analysis, the malware harvested developer credentials, cloud secrets, crypto wallets, browser data, and notably AI coding tool and MCP configurations (Claude, Cursor, Windsurf, VS Code, Zed), using ChaCha20-Poly1305 obfuscation to resist analysis. Jscrambler revoked credentials and released a safe version 8.22. Details →First reported sauleau.com
Sven Sauleau: Systems Engineer - airgap - Security for the modern AI age
airgap is a Linux-only Rust tool (installable via `cargo install airgap`) that runs AI agents like claude/opencode and package managers like npm inside mount/user namespaces with a FUSE filesystem, redacting secrets in files (.env, SSH/PGP keys, .npmrc) and gating unexpected file access. It is positioned to prevent secret exfiltration by AI agents and malicious npm packages such as the Shai-Hulud worm. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector