First reported wiz.io
Lead dispatch
First reported · updated · 3 reports embracethered.com
AWS Kiro: Arbitrary Code Execution via Indirect Prompt Injection
Researchers found a vulnerability (CVE-2026-10591) in AWS Kiro, an agentic IDE, where hidden instructions planted in a web page or source file that Kiro processes can trigger indirect prompt injection to rewrite Kiro's own MCP server configuration (~/.kiro/settings/mcp.json) or allowlist arbitrary Bash commands in .vscode/settings.json, achieving arbitrary code execution on the developer's machine with no approval prompt. The human-in-the-loop approval boundary is bypassed because Kiro can write to these config files without user consent, and AWS has issued a fix and CVE.indirect-prompt-injection · prompt-injection · remote-code-execution · tool-abuse · config-poisoning
ai-agents · mcp · llm · agentic-ide
Severity
0.85
The wire · latest
First reported youtube.com
Dependency Confusion, Typosquatting, and Slopsquatting: The New Danger of Installing Libraries
A Spanish-language YouTube explainer video covers software supply-chain attacks — dependency confusion, typosquatting, and slopsquatting — with the AI angle that coding assistants can hallucinate nonexistent library names that attackers then register to exploit future model recommendations. The video also discusses lockfiles, hashes, SBOM, SLSA, and best practices for vetting dependencies, and notes it was itself produced with AI assistance for informational purposes. Details →First reported thehackernews.com
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
Trend Micro's TrendAI reported 14 trojanized npm packages posing as calendar and streak utilities that stealthily deliver RedC2 4.0, an AI-powered Linux implant. A single import anywhere in the dependency graph—even a transitive one—locates the bundled binary, marks it executable, and launches it as a detached background process, requiring no install hook. Details →First reported medium.com
Block AI from installing malicious npm packages
Prasanna Mestha describes a defensive tool built to sit between AI coding agents and the npm registry to block installation of malicious or hallucinated packages, framed around the slopsquatting threat. The write-up cites real cases including the phantom 'react-codeshift' package requested hundreds of times a day and an August campaign in which a single threat actor pushed over 700 AI-named malicious npm packages that deliver a cross-platform RAT via README instructions. Details →First reported theregister.com
ChainDrop worm crawls into npm supply chain, evades standard defenses
ChainDrop, a new variant of the Shai-Hulud npm worm dubbed by Microsoft and others, has poisoned 444 packages (collectively downloaded ~2 billion times a month, including keyv, flat-cache and cache-manager) and self-replicates by rebuilding package tarballs to embed its payload rather than committing to source repos. It harvests npm tokens, cloud keys and secrets from shell configs, environment variables and live memory, and plants startup hooks in repo config files so that simply opening an infected Git branch in VS Code or Claude Code triggers execution without any npm install. Details →First reported · updated · 2 reports thehackernews.com
Worm compromises hundreds of popular npm packages | Datadog Security Labs
Datadog Security Labs reports that on August 4, 2026 a threat actor compromised hundreds of npm packages — some with over 150 million weekly downloads, including keyv, cacheable, and ecto — to propagate a self-spreading backdoor similar to the Shai-Hulud worm. The injected payloads notably add Claude (.claude/settings.json) and Visual Studio Code execution hooks and payload blobs, weaponizing AI coding-agent configuration as an execution vector. Details →First reported · updated · 2 reports arxiv.org
The Range Shrinks, the Threat Remains: Re-evaluating LLM Package Hallucinations on the 2026 Frontier-Model Cohort
A replication study by Aleksandr Churilov re-evaluated package-name hallucination across five 2026 frontier code LLMs (Claude Sonnet 4.6, Claude Haiku 4.5, GPT-5.4-mini, Gemini 2.5 Pro, DeepSeek V3.2), measuring hallucination rates of 4.62%-6.10% across ~199,845 Python/JavaScript prompts. The authors identified 127 package names all five models invent identically and, after coordinated disclosure with PyPI Security and Socket, found 53 (41 PyPI, 12 npm) remain registrable by an attacker, forming a model-agnostic slopsquatting supply-chain attack surface. Details →First reported crowdstrike.com
Detecting SANDWORM_MODE and AI Toolchain Supply Chain Attacks
CrowdStrike details SANDWORM_MODE, a multi-stage npm supply chain worm first documented by Socket.dev in February 2026 that spanned 19 malicious packages and specifically exploited the runtime behaviors of AI coding assistants (Copilot, Cursor, Claude Code), CI automation, and LLM toolchains. The infection chain uses an obfuscated multi-layer loader (Base64/zlib/XOR, indirect eval) to bypass static analysis, then fingerprints the environment and performs reconnaissance and credential harvesting across the AI-driven CI/CD pipeline. Details →First reported nx.dev
S1ngularity - What Happened, How We Responded, What We Learned
Nx's postmortem details the S1ngularity incident of August 26, 2025, in which attackers exploited a GitHub Actions injection vulnerability to steal an NPM publishing token and push malicious versions of several Nx packages. The malware ran a post-install script that scanned systems for sensitive data, notably attempting to abuse locally installed AI CLI tools like Claude and Gemini, and exfiltrated results to public GitHub repositories via the GitHub CLI. Details →First reported · updated · 2 reports stepsecurity.io
Miasma Supply Chain Attack: Azure Hit, 73 Repos Down, 37 PyPI Wheels
The Miasma supply-chain worm campaign expanded to poison Microsoft's Azure/durabletask GitHub repository with config files that execute a credential-harvesting payload the moment a developer opens the repo in AI coding tools like Claude Code, Gemini CLI, Cursor, or VS Code, triggering GitHub to disable 73 Microsoft repositories including Azure/functions-action. Two days later the Hades variant dropped 37 malicious PyPI wheels across 19 packages using Python .pth startup hooks to run a Bun-powered credential stealer on every interpreter launch, with Socket tracking 448 affected artifacts across npm and PyPI. Details →First reported phoenix.security
Supply Chain Attacks 2026: npm, PyPI, VS Code, AI Agents — 0 CVEs
Phoenix Security's Malware Package Intelligence report analyzes 59 supply chain attack campaigns and 657 malicious package-versions from June 2024 to June 2026, documenting an acceleration across npm, PyPI, and the VS Code Marketplace. It highlights a May 2026 self-propagating worm that turned one compromised maintainer token into 226 poisoned packages, and finds AI agent tooling — MCP server injection, .cursorrules poisoning, CLAUDE.md hidden instructions, and AI coding assistant SessionStart hooks — used as a confirmed delivery mechanism in at least 14 of the 59 campaigns. Details →First reported powerdmarc.com
Malicious MCP Servers & Email Security: The New Supply Chain Threat
The article analyzes the postmark-mcp incident, where a malicious actor published an exact-name lookalike npm package impersonating Postmark's official Model Context Protocol (MCP) server. Across 15 clean releases it built trust before adding a hidden BCC rule that silently forwarded 3,000-15,000 corporate emails per day to an attacker-controlled domain, leaking passwords, invoices, customer data, and auth tokens; because mail flowed through legitimate infrastructure, SPF and DKIM passed automatically. Details →First reported jscrambler.com
Unauthorized Publication of a Malicious npm Package affecting CI
Jscrambler disclosed that a threat actor used compromised npm publishing credentials to publish a malicious version of its 'jscrambler' npm package (versions 8.14, 8.16, 8.17, 8.20), which ran an infostealer during the preinstall hook and was downloaded around 1,479 times in a two-hour window. Per Socket's analysis, the malware harvested developer credentials, cloud secrets, crypto wallets, browser data, and notably AI coding tool and MCP configurations (Claude, Cursor, Windsurf, VS Code, Zed), using ChaCha20-Poly1305 obfuscation to resist analysis. Jscrambler revoked credentials and released a safe version 8.22. Details →First reported sauleau.com
Sven Sauleau: Systems Engineer - airgap - Security for the modern AI age
airgap is a Linux-only Rust tool (installable via `cargo install airgap`) that runs AI agents like claude/opencode and package managers like npm inside mount/user namespaces with a FUSE filesystem, redacting secrets in files (.env, SSH/PGP keys, .npmrc) and gating unexpected file access. It is positioned to prevent secret exfiltration by AI agents and malicious npm packages such as the Shai-Hulud worm. Details →How the wire is made
Poll & cluster
Internet is crawled for AI security news and near-duplicate coverage is embedded and grouped into durable items.
Curate
AI Agent filters for agentic-AI relevance, classifies and tags each item, scores severity for threats, and writes the summary.
Every item here is one machine-curated intelligence object, not a headline.
Read the wire for free. There is a small charge to ask the index questions.
The wire, open
The complete curated feed, no key required.
- GET /feed.xml — RSS 2.0, every item
- GET /api/items — read-only
The vector desk
Query the index by meaning, not just keyword.
- GET /api/items?tags=&minSeverity=&itemType=
- GET /api/search?q= — keyword
- GET /api/semantic?q= — vector