The Information Machine

AI as Attack Tool and Attack Target: May 2026 Cybersecurity Moment · history

Version 8

2026-05-25 03:19 UTC · 229 items

What

The origin of the Mini Shai-Hulud supply chain campaign has been partially traced: Socket.dev reports that TeamPCP gained initial npm ecosystem access through a phishing attack against npm package author 'Qix,' whose stolen credentials seeded the broader worm propagation [13]. TanStack has published an official postmortem on its role in the compromise [14], and Snyk reveals the SAP CAP segment deployed a 'Bun-based stealer' — a distinct malware component not previously named in public reporting [15]. The campaign continues to be characterized as one of the most broadly distributed supply chain compromises on record, with Mandiant quantifying more than 1,000 compromised SaaS environments [10], Lapsus$ reported to have joined the extortion wave [20], and Anthropic's Claude Mythos Preview attracting deepening institutional analysis from the Turing Institute's CETAS and AuthMind over what the model's withholding from deployment signals for AI security governance [28][31].

Why it matters

The Qix phishing revelation [13] transforms the campaign's origin from an opaque worm emergence into a traceable credential compromise — shifting the defensive priority from package registry monitoring toward maintainer authentication hardening across the entire open-source ecosystem. The 'withheld model' framing [31] opens a distinct policy question: if AI labs routinely retain their most capable models from public access, voluntary pre-deployment frameworks like CAISI may evaluate a curated rather than frontier subset of offensive capability, leaving regulators systematically under-informed.

Open questions

  • Has the Qix npm account been fully secured, and what other packages does Qix maintain that may have been affected or remain at risk following the phishing compromise? [13]

  • Does TanStack's official postmortem [14] identify compromise vectors or downstream exposure beyond what was previously publicly reported, and does it address the certificate theft that affected OpenAI?

  • What is the full behavioral profile of the 'Bun-based stealer' identified by Snyk in the SAP CAP packages — does it share code or infrastructure with other Mini Shai-Hulud components, and are detection signatures available? [15]

  • AuthMind frames Anthropic's decision to withhold Mythos as a significant policy signal [31] — will Anthropic issue formal guidance on its deployment criteria for frontier models with demonstrated offensive cyber capability, and does CAISI require evaluation of withheld models?

Narrative

The Mini Shai-Hulud supply chain campaign, launched by the threat actor TeamPCP on May 11, 2026, began as a self-spreading worm across npm and PyPI that compromised more than 170 packages — including TanStack, LiteLLM, Guardrails AI, and Telnyx — reaching two OpenAI employee devices and exfiltrating code-signing certificates that triggered a mandatory rotation deadline of June 12, 2026 for OpenAI's iOS, macOS, and Windows applications [1][2][3]. GitHub confirmed that approximately 3,800–4,000 of its internal repositories were stolen via a poisoned VS Code extension (Nx Console version 18.95.0), with Forbes reporting a $50,000 ransom demand from TeamPCP [4][5][6]. CVE-2026-33634 (CVSS 9.4) was formally assigned and added to CISA's Known Exploited Vulnerabilities catalog [7][8], and Broadcom confirmed downstream exposure in Tanzu Application Platform and Spring Enterprise through the Trivy container-security scanner compromise [9]. Mandiant quantified total campaign impact at more than 1,000 compromised SaaS environments [10], and CERT-EU confirmed the European Commission's cloud infrastructure was breached via the same Trivy supply chain vector, exposing data across 30 EU institutions [11][12].

The campaign's origin has been partially traced by Socket.dev, which reports that TeamPCP gained its initial npm ecosystem foothold through a phishing attack targeting npm package author 'Qix,' whose compromised credentials provided the entry point for the broader worm propagation [13]. This finding reframes the campaign from a purely technical worm-propagation event to one with a social engineering origin — a distinction that changes the defensive priority from package registry monitoring to maintainer authentication hardening. TanStack has subsequently published an official postmortem providing a first-party account of how its packages were compromised [14], while Snyk has identified a 'Bun-based stealer' as the specific malware component used in the SAP Cloud Application Programming (CAP) ecosystem segment [15], with Pathlock and SecurityBridge adding further SAP-specific workflow analyses [16][17]. The Cloud Security Alliance characterized the campaign as a two-wave operation named 'Shai-Hulud/Megalodon,' distinguishing the initial AI developer toolchain wave from a subsequent AntV data visualization ecosystem attack involving 600+ malicious npm packages that used a novel technique to fake Sigstore security verification badges [18][19]. CSO Online reports that Lapsus$ — previously responsible for high-profile breaches at Microsoft, Nvidia, Samsung, and others — has joined the extortion wave targeting campaign victims [20], while VECERTRadar characterizes the Sportradar breach as a 'Systemic Compromise and Asset Sale,' indicating active monetization of stolen access [21].

The AI coding agent attack surface remains the campaign's most analytically contested dimension. RedRays framed the SAP npm hijacking as a deliberate mechanism to weaponize AI coding agents by injecting malicious packages into the dependency trees those tools automatically install [22], while Mend.io claimed the attack ran 'via Claude Code' — a specific tool attribution not corroborated by independent analysis or any Anthropic response [23]. Snyk's Bun-based stealer identification and Socket.dev's detailed SAP CAP analysis [24][25] add technical depth without resolving the Claude Code attribution. The AntV wave's fake Sigstore badge evasion technique has not produced a public response from the Sigstore project or npm registry, leaving the provenance attestation trust signal in a contested state for organizations relying on it as a supply chain defense [19].

The AI governance backdrop centers on AISI's official evaluation of Claude Mythos Preview, which autonomously completed both UK offensive cyber ranges including a 32-step scenario — the first AI system to do so [26][27]. The Turing Institute's CETAS has published a dedicated assessment of what this capability threshold means for the future of cybersecurity [28], and a LessWrong community analysis has added practitioner-level scrutiny of Anthropic's public announcement [29]. AuthMind specifically examines the implications of Anthropic withholding Mythos from public deployment, arguing that a lab's choice to retain its most capable model in reserve is itself a significant policy signal about what those capabilities can do — and raises questions about whether voluntary pre-deployment frameworks like CAISI, which the Foundation for American Innovation has defended as a pragmatic first step [30], evaluate a curated rather than frontier subset of AI capability [31]. NIST's CAISI formalization as the US pre-deployment compliance gate was confirmed through expanded safety-testing agreements with Google, Microsoft, and xAI [32].

Timeline

  • 2026-05-05: US Department of Commerce finalizes expanded AI safety-testing agreements with Google, Microsoft, and xAI through NIST's CAISI; Politico reports on federal pre-deployment AI vetting formalization [32][58]
  • 2026-05-11: TeamPCP launches Mini Shai-Hulud campaign via self-spreading worm; 160+ npm and PyPI packages compromised including TanStack; two OpenAI employee devices hit, code-signing certificates exfiltrated [1][2][3]
  • 2026-05-11: Security researchers confirm tool poisoning attacks work silently against Claude, ChatGPT, Cursor, and other major AI assistants [112]
  • 2026-05-13: OpenAI publishes incident response disclosure; mandates app certificate rotation by June 12, 2026; Zvi Mowshowitz and AISI publish analyses characterizing Claude Mythos Preview's autonomous clearance of UK offensive cyber ranges as a genuine AI capability threshold [1][56][27]
  • 2026-05-16: Broad security community coverage amplifies OpenAI/TanStack disclosure; BleepingComputer and The Cyber Express reach mainstream security audiences; users urged to update macOS apps before June 12 certificate revocation deadline [40][113][114][115][116][44][43]
  • 2026-05-18: Reports emerge that TeamPCP targeted Mistral AI and is selling access to Mistral AI's internal source code repositories [117][118][119][120]
  • 2026-05-19: LiteLLM, Telnyx, and Guardrails AI identified as additional compromised packages; campaign scope confirmed at 160+ packages across npm and PyPI; CVE-2026-33634 formally assigned with CVSS 9.4 critical severity rating [121][7][78][122][123]
  • 2026-05-20: GitHub confirms TeamPCP breach of approximately 3,800–4,000 internal repositories via Nx Console version 18.95.0; Forbes reports TeamPCP demanded $50,000 ransom from GitHub; multiple security vendors publish independent analyses [4][33][5][34][63][64][35][36][37][71][6][77][78][79][80]
  • 2026-05-21: CVE-2026-33634 scope expanded to include Trivy container-security scanner; LiteLLM publishes official security update; GitLab Advisory Database and Aqua Security publish formal Trivy advisory; LegitSecurity publishes incident response playbooks [124][125][126][127][128][129][130][131][65]
  • 2026-05-22: Mini Shai-Hulud confirmed targeting SAP npm packages; Unit 42 and Datadog Security Labs publish 'Shai-Hulud 2.0' analysis; CISA adds CVE-2026-33634 to Known Exploited Vulnerabilities catalog; Broadcom issues impact assessment for Tanzu Application Platform and Spring Enterprise [72][73][74][75][76][132][8][9]
  • 2026-05-23: AntV ecosystem attack confirmed with 600+ malicious npm packages faking Sigstore badges; Semgrep identifies worm revival via compromised maintainer; IBM X-Force, Orca Security, ThreatLocker, StepSecurity, Microsoft Security Blog, and Chainguard publish independent AntV analyses; Mend.io and RedRays publish analyses framing SAP attack as weaponizing AI coding agents; CSA characterizes campaign as two-wave 'Shai-Hulud/Megalodon' [19][82][83][84][85][86][87][88][23][22][18][92][90]
  • 2026-05-24: CERT-EU officially confirms European Commission cloud breach via Trivy supply chain exposed data across 30 EU institutions; Mandiant quantifies total campaign at 1,000+ compromised SaaS environments; Sportradar named as additional victim; CSO Online reports Lapsus$ has joined extortion wave; VECERTRadar characterizes Sportradar incident as 'Systemic Compromise and Asset Sale'; Socket.dev and SecurityBridge publish detailed SAP CAP npm package analyses; Cyber Unit and DevOps.com publish VS Code extension attack analyses [10][45][11][12][6][20][21][46][25][17][61][38][39][97]
  • 2026-05-25: Socket.dev identifies phishing attack on npm author 'Qix' as initial access vector for Mini Shai-Hulud campaign; TanStack publishes official supply chain compromise postmortem; Snyk identifies 'Bun-based stealer' malware component in SAP CAP packages; Pathlock publishes SAP CAP/MTA workflow impact analysis; Turing Institute CETAS and AuthMind publish institutional analyses of Claude Mythos governance implications; Foundation for American Innovation publishes analysis of CAISI voluntary vetting framework; CSA Lab Space publishes research note on campaign escalation [13][14][15][16][28][31][30][62][24][98]

Perspectives

TanStack

Published an official postmortem on the npm supply chain compromise, providing a first-party account of how TanStack packages were compromised and what remediation steps were taken

Evolution: New voice in this synthesis; TanStack's postmortem moves the project from passive victim-naming to active incident disclosure with a first-party timeline

[14]

GitHub

Confirmed the breach via Nx Console version 18.95.0, maintained that customer data was unaffected, and framed the incident as limited in customer impact while acknowledging the theft of approximately 3,800–4,000 internal repositories

Evolution: Forbes' reporting of a $50,000 extortion demand adds context that the attackers placed significant monetary value on the stolen access — in tension with GitHub's 'limited impact' characterization; Cyber Unit and DevOps.com analyses have further documented the SMB-relevant implications of the VS Code extension vector

[4][33][5][34][35][36][37][6][38][39]

OpenAI

Transparency and swift containment: limited blast radius, no customer data or production systems compromised, framing the incident as an industry-wide supply chain threat rather than an OpenAI-specific failure; certificate rotation deadline of June 12 is the actionable user requirement

Evolution: Consistent; BleepingComputer and The Cyber Express amplification of the TanStack/OpenAI breach has extended mainstream awareness; CERT-EU's 30 EU institutions figure, Mandiant's 1,000+ SaaS environments figure, and Lapsus$'s reported entry continue to challenge the 'limited blast radius' characterization for the campaign as a whole

[1][40][41][42][43][44]

Socket.dev

The Mini Shai-Hulud campaign's initial access vector was a phishing attack targeting npm author 'Qix,' whose compromised credentials seeded the broader supply chain worm; detailed technical analyses of TanStack and SAP CAP packages document the propagation mechanism

Evolution: The Qix phishing revelation represents the most material advance on prior analysis — Socket.dev moves from documenting the worm's behavior to tracing its origin; this is the first concrete attribution of how the campaign was initially seeded

[13][24][25]

Snyk

The SAP CAP npm packages were compromised using a 'Bun-based stealer' — a specific malware component utilizing the Bun JavaScript runtime for credential and secret exfiltration — providing the most technically specific public description of the malware toolchain in the SAP segment

Evolution: New named stance in this synthesis; Snyk's Bun-based stealer characterization adds technical specificity not present in any prior public reporting on the SAP segment

[15]

CERT-EU

Official confirmation that the European Commission's cloud infrastructure was breached through the Trivy supply chain compromise, with data exposed across 30 EU institutions — establishing that supply chain DevSecOps vulnerabilities translate directly into government IT compromise

Evolution: Consistent; remains the authoritative government-level acknowledgment of the campaign's public sector reach

[11][12][10][45]

Mandiant

The total TeamPCP campaign has compromised more than 1,000 SaaS environments — a scale figure that reframes Mini Shai-Hulud from a targeted AI-ecosystem incident to one of the most broadly distributed enterprise supply chain compromises on record

Evolution: Consistent; remains the most comprehensive campaign-scale quantification published to date

[10]

Lapsus$

CSO Online reports Lapsus$ has joined the extortion wave targeting the campaign's supply chain victims — introducing a second well-resourced threat actor with a history of aggressive public data leaks and extortion against major enterprises

Evolution: Consistent with prior pass; specific relationship to TeamPCP remains unestablished

[20]

VECERTRadar / threat intelligence community on Sportradar

The Sportradar breach constitutes a 'Systemic Compromise and Asset Sale,' with stolen assets being actively marketed — suggesting monetization is in progress, not merely threatened

Evolution: Consistent with prior pass

[21][46]

RedRays

The SAP npm hijacking was specifically designed to weaponize AI coding agents by injecting malicious packages into the dependency trees that those tools automatically install and execute, redirecting agent behavior toward cloud credential theft and worm propagation

Evolution: Consistent; Snyk's Bun-based stealer detail and Pathlock's SAP workflow analysis add complementary technical corroboration without resolving the AI agent weaponization framing

[22][15][16]

Mend.io

The SAP CAP segment of the supply chain attack ran 'via Claude Code,' implicating Anthropic's AI coding assistant as a vector or surface in the attack

Evolution: Consistent; no Anthropic response has emerged; the Bun-based stealer detail and additional SAP analyses add technical context without resolving the specific Claude Code attribution

[23][47]

AISI (UK AI Safety Institute)

Claude Mythos Preview represents a genuine capability threshold — the first AI system to autonomously complete both AISI end-to-end offensive cyber ranges including a 32-step scenario — and the rate at which autonomous AI cyber capability is advancing warrants serious institutional attention

Evolution: The Turing Institute's CETAS publication and LessWrong community analysis represent continued growth in institutional and community engagement with the AISI evaluation's implications

[26][27][48][49][50][51][52][53][28][29]

AuthMind

Anthropic's decision to withhold Claude Mythos from public deployment is itself a significant policy signal — a lab that retains its most capable model in reserve implicitly acknowledges that those capabilities exceed what it is willing to release, which has direct implications for how voluntary pre-deployment frameworks evaluate frontier AI offensive risk

Evolution: New voice in this synthesis; the 'withheld model' framing is a distinct governance dimension not previously represented in the thread, adding a third axis to the CAISI debate alongside AISI's capability threshold claims and Mowshowitz's political capture critique

[31]

Turing Institute CETAS

The Claude Mythos capability threshold requires serious institutional analysis of what AI systems that can autonomously complete offensive cyber tasks mean for the future of cybersecurity — framing the Mythos development as a structural shift in the threat landscape rather than an incremental capability improvement

Evolution: New voice in this synthesis; CETAS adds major academic/policy institutional weight to the Mythos capability debate alongside AISI's official evaluation

[28]

Foundation for American Innovation

CAISI's voluntary pre-deployment vetting framework represents a pragmatic and achievable first step toward structured federal oversight of frontier AI capabilities — framing voluntary industry participation positively against more prescriptive alternatives

Evolution: New voice in this synthesis; provides an explicit policy-supportive counterpoint to Zvi Mowshowitz's critique of the CAISI framework as politically captured and insufficient

[30]

Skeptics of Mythos evaluation (cybersecurity commentators)

The AISI evaluation methodology is inconsistent or overstated; the Mythos system card is methodologically problematic; the 'autonomous offensive threshold' framing may not accurately represent the difficulty or controlled conditions of the evaluated tasks

Evolution: Consistent with prior pass

[54][55]

Zvi Mowshowitz

Genuinely alarmed by Mythos as a capability threshold requiring a rethink of deployment security cadences; critical of both Commerce-dominated (CAISI) and intelligence-dominated governance proposals as politically captured and insufficiently generalized beyond cybersecurity

Evolution: Consistent; the Foundation for American Innovation's CAISI defense provides a new explicit counterpoint, and AuthMind's withheld-model framing independently reinforces the concern that CAISI may not evaluate the most capable systems

[56]

CAISI / US Department of Commerce

Voluntary but structured pre-deployment safety testing with major AI labs through NIST's CAISI is the appropriate US governance posture for frontier AI capabilities

Evolution: Consistent with prior pass

[32][57][58][59][60]

SAP security community (SecurityBridge, Socket.dev, StepSecurity, Pathlock, Snyk)

The Mini Shai-Hulud campaign's penetration of the SAP npm ecosystem is credible and technically documented; the attack mechanism involves specific SAP CAP and Cloud MT packages consistent with the broader campaign's worm-propagation architecture; the Bun-based stealer represents a specific and novel malware technique within that architecture

Evolution: Pathlock and Snyk have expanded the cohort with additional SAP-specific analyses this pass, and Feross of Socket.dev has amplified the findings publicly via LinkedIn

[17][61][25][16][15][62]

Institutional security research community (CSA, Unit 42, Datadog, Akamai, ReversingLabs, GitGuardian, WIRED, Snyk, Onapsis, Wiz, Endor Labs, StepSecurity, Varonis, BleepingComputer, LegitSecurity, Semgrep, IBM X-Force, Orca Security, ThreatLocker, Chainguard, Phoenix Security, Software Improvement Group, Runtime.news, OX Security, Cyber Unit, DevOps.com)

TeamPCP is the defining supply chain security event of 2026; the Qix phishing origin story reframes the campaign's initial access model; the Bun-based stealer adds a documented malware component; the fake Sigstore badge technique compromises a key trust signal; the AI coding agent weaponization mechanism requires a materially different defensive response than traditional package poisoning

Evolution: BleepingComputer and The Cyber Express have extended mainstream security awareness of the TanStack/OpenAI breach; CSA Lab Space has published a dedicated research note on campaign escalation; the SAP cohort has expanded with Pathlock and Snyk

[33][5][34][63][64][9][8][65][66][67][68][69][70][71][72][73][74][75][76][77][78][79][80][81][19][82][83][84][85][86][87][88][89][90][91][92][93][94][95][96][38][39][97][43][44][98]

Broad security community (social media and press amplifiers)

The GitHub breach is confirmed and TeamPCP is actively marketing stolen access; the $50K ransom demand signals TeamPCP's assessment of the access value; Sportradar's data is being actively sold; Lapsus$'s entry into the extortion wave signals further escalation; the Qix phishing origin story and TanStack postmortem are circulating widely

Evolution: The Qix phishing revelation and TanStack postmortem have generated renewed community discussion; SAP coverage has expanded with additional LinkedIn amplification

[99][100][101][102][103][104][105][106][107][108][109][110][21][20][62][111]

Tensions

  • GitHub's official 'customer data unaffected' and 'limited impact' framing sits in tension with both the scope of 3,800–4,000 internal repositories stolen and TeamPCP's subsequent $50,000 extortion demand — the ransom demand implies TeamPCP placed significant monetary value on the access, which is inconsistent with GitHub's characterization of the incident as limited [35][36][37][71][33][6]
  • AISI's official evaluation frames Claude Mythos Preview as reaching an 'autonomous offensive threshold' warranting serious institutional attention; the Turing Institute's CETAS adds academic weight to this framing; while independent cybersecurity commentators have questioned the evaluation methodology and system card consistency — a debate about whether the milestone is accurately characterized or inflated by the evaluators' framing [26][27][81][54][55][28][29]
  • RedRays frames the SAP attack as deliberately weaponizing AI coding agents through a dependency injection mechanism, while Mend.io's 'via Claude Code' framing implies Anthropic's specific tool was implicated — the two analyses are consistent at the mechanism level but diverge on specificity; Snyk's Bun-based stealer detail and Socket.dev's SAP CAP analysis add technical depth without resolving the Claude Code attribution, and Anthropic has issued no response [22][23][47][90][25][17][15]
  • The CAISI voluntary pre-deployment framework (defended by the Foundation for American Innovation as a pragmatic first step) sits in tension with Zvi Mowshowitz's critique that governance anchored in cybersecurity is politically captured and fails to treat Mythos as a general capability threshold — and AuthMind's 'withheld model' framing adds a third dimension: if labs withhold their most capable systems, voluntary frameworks may evaluate a curated rather than frontier subset of AI capability, leaving the most dangerous systems outside public audit [32][59][56][30][31]
  • Standard supply chain remediation guidance focuses on package registries (npm, PyPI, Docker Hub), but the VS Code extension attack vector, the AI coding agent weaponization mechanism, and the Qix phishing origin story collectively demonstrate that the attack surface extends to individual maintainer credential security and developer machine environments — surfaces for which no standardized remediation guidance has yet emerged [4][5][34][22][90][79][80][38][39][13]
  • OpenAI frames the TanStack incident as an industry-wide supply chain shift with limited blast radius, but CERT-EU's confirmation of 30 EU institutions' exposure, Mandiant's 1,000+ SaaS environments figure, Lapsus$'s reported entry into the extortion wave, and TeamPCP's continued propagation into AntV and SAP enterprise infrastructure suggest downstream exposure substantially wider than OpenAI's framing implied [1][11][12][10][70][35][20]
  • The AntV attack's use of fake Sigstore security verification badges means that npm provenance attestation — one of the primary trust signals supply chain security guidance recommends — cannot be relied upon to detect this campaign, creating a gap between the remediation advice being given and the actual evasion capabilities demonstrated by the attacker; neither the Sigstore project nor the npm registry has issued a public response [19][82][83]
  • CSO Online reports Lapsus$ has joined the extortion wave, but the relationship between Lapsus$ and TeamPCP — whether collaboration, independent exploitation of the same victim pool, or coincidental targeting — has not been established, creating uncertainty about whether victims face one organized campaign or two distinct threat actors with different motivations and negotiating postures [20][21][46]

Sources

  1. [1] Our response to the TanStack npm supply chain attack — OpenAI Blog (2026-05-13)
  2. [2] Mini Shai-Hulud: TeamPCP compromette 160+ pacchetti npm e PyPI in un supply chain attack che ha colpito TanStack, Mistra... — reactive:ai-security-nexus (2026-05-19)
  3. [3] A Self-Spreading Supply Chain Attack Compromises TanStack npm ... — reactive:ai-security-nexus
  4. [4] Nx Console 18.95.0 Incident: How TeamPCP Breached GitHub — reactive:ai-security-nexus
  5. [5] Nx Console VS Code Extension Compromised - StepSecurity — reactive:ai-security-nexus
  6. [6] GitHub Says 3,800 Repositories Breached—TeamPCP Hackers ... — reactive:ai-security-nexus
  7. [7] GitHub - ugurrates/teampcp-supply-chain-attack: CVE-2026-33634 (CVSS 9.4) — The most impactful CI/CD supply chain attack of 2026 so far. · GitHub — reactive:ai-security-nexus
  8. [8] CISA Adds Trivy CVE-2026-33634 to KEV: Patch Supply Chain Risk ... — reactive:ai-security-nexus
  9. [9] Impact Assessment: Aqua Security Trivy Supply Chain Compromise (CVE-2026-33634) on Tanzu Application Platform and Spring Enterprise — reactive:ai-security-nexus
  10. [10] TeamPCP Supply Chain Campaign: Update 006 - CERT-EU Confirms European Commission Cloud Breach, Sportradar Details Emerge, and Mandiant Quantifies Campaign at 1,000+ SaaS Environments — reactive:ai-security-nexus
  11. [11] European Commission cloud breach: a supply-chain compromise — reactive:ai-security-nexus
  12. [12] European Commission breach exposed data of 30 EU entities ... — reactive:ai-security-nexus
  13. [13] npm Author Qix Compromised via Phishing Email in Major Suppl... — reactive:ai-security-nexus
  14. [14] Postmortem: TanStack npm supply-chain compromise — reactive:ai-security-nexus
  15. [15] Bun-Based Stealer Hits SAP CAP npm Packages | Snyk — reactive:ai-security-nexus
  16. [16] SAP npm Supply Chain Incident | CAP & MTA Build Workflows — reactive:ai-security-nexus
  17. [17] Mini Shai-Hulud: npm Supply Chain reaches into SAP security! — reactive:ai-security-nexus
  18. [18] Shai-Hulud/Megalodon: A Two-Wave AI Developer Supply Chain ... — reactive:ai-offensive-cybersecurity
  19. [19] Mini Shai-Hulud Returns: 600+Malicious npm Packages Fake Sigstore Badges in AntV Ecosystem Attack — reactive:ai-security-nexus
  20. [20] Trivy supply chain breach compromises over 1,000 SaaS environments, Lapsus$ joins the extortion wave | CSO Online — reactive:ai-security-nexus
  21. [21] CRITICAL ALERT: Sportradar Systemic Compromise and Asset Sale ... — reactive:ai-security-nexus
  22. [22] SAP npm Packages Hijacked to Steal Cloud Credentials and Weaponize AI Coding Agents — reactive:ai-security-nexus
  23. [23] Shai Hulud: SAP CAP Supply Chain Attack Via Claude Code — reactive:ai-security-nexus
  24. [24] TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud... — reactive:ai-security-nexus
  25. [25] TeamPCP-Linked Supply Chain Attack Hits SAP CAP and Cloud MT... — reactive:ai-security-nexus
  26. [26] Our evaluation of Claude Mythos Preview's cyber capabilities — reactive:frontier-ai-cyber-capabilities
  27. [27] How fast is autonomous AI cyber capability advancing? — reactive:ai-offensive-cyber (2026-05-13)
  28. [28] Claude Mythos: What Does Anthropic's New Model Mean for the ... — reactive:ai-security-nexus
  29. [29] Claude Mythos Preview: Analysis of Anthropic's Public Announcement — LessWrong — reactive:ai-deployment-misalignment-risk
  30. [30] Kicking the Tires: A Voluntary Path to Pre-Deployment AI Vetting | The Foundation for American Innovation — reactive:ai-security-nexus
  31. [31] When a Lab Withholds Its Best Model: What the Claude Mythos System Card Signals for Cybersecurity — reactive:ai-security-nexus
  32. [32] US government expands vetting of frontier AI models for security risks — reactive:ai-security-nexus
  33. [33] GitHub Breach via Malicious VS Code Extension: What You Need to ... — reactive:ai-security-nexus
  34. [34] GitHub confirms breach of 3,800 repos via malicious VSCode ... — reactive:ai-security-nexus
  35. [35] GitHub confirms being hacked by TeamPCP, says customer data ... — reactive:ai-security-nexus
  36. [36] GitHub admits major source code leak after 3800 internal ... - InfoWorld — reactive:ai-security-nexus
  37. [37] GitHub Confirms Breach, 4K Internal Repos Stolen - Dark Reading — reactive:ai-security-nexus
  38. [38] GitHub Breach, May 2026: What the TeamPCP VS Code Extension Attack Means for Canadian and US SMBs | Cyber Unit — reactive:ai-security-nexus
  39. [39] GitHub Breach Tied to Malicious VS Code Extension Exposes Thousands of Internal Repositories — reactive:ai-security-nexus
  40. [40] OpenAI caught NPM supply chain chaos after employeedevices compromised — reactive:ai-security-nexus (2026-05-16)
  41. [41] OpenAI asks macOS users to update after TanStack npm ... — reactive:ai-security-nexus
  42. [42] TanStack Supply Chain Attack Hits Two OpenAI Employee Devices ... — reactive:ai-security-nexus
  43. [43] OpenAI confirms security breach in TanStack supply chain attack — reactive:ai-security-nexus
  44. [44] TanStack npm Supply Chain Attack Prompts OpenAI Updates — reactive:ai-security-nexus
  45. [45] Security breach at European Commission impacts 30 EU institutions | DigitalShield — reactive:ai-security-nexus
  46. [46] Sportradar Data Breach in 2026 - Breachsense — reactive:ai-security-nexus
  47. [47] Mend.io's Post - LinkedIn — reactive:ai-security-nexus
  48. [48] AISI: Claude Mythos First AI to Solve 32-Step Cyber Attack Range — reactive:ai-security-nexus
  49. [49] New Claude Mythos becomes the first AI model to clear all cyberattack simulations from Britain's AI safety agency — reactive:ai-security-nexus
  50. [50] Here’s how cyber heavyweights in the US and UK are dealing with Claude Mythos | CyberScoop — reactive:ai-security-nexus
  51. [51] Claude Mythos Preview Completes Cyber Range End-to-End — reactive:ai-security-nexus
  52. [52] We conducted cyber evaluations of Claude Mythos Preview and ... — reactive:ai-security-nexus
  53. [53] Claude Mythos Preview becomes the first model to solve both of the ... — reactive:ai-security-nexus
  54. [54] Anthropic's Mythos Claims Questioned by Cybersecurity Insider — reactive:frontier-ai-cyber-capabilities
  55. [55] Why Claude Mythos system card is a mess - Part 3, about ... - Reddit — reactive:ai-security-nexus
  56. [56] Cyber Lack of Security and AI Governance — Zvi's AI Roundups (2026-05-13)
  57. [57] CAISI becomes US AI pre-deployment gate | Kenneth Foster posted ... — reactive:ai-security-nexus
  58. [58] Pre-Deployment AI Evaluation Moves From China's Model To ... — reactive:ai-deployment-misalignment-risk
  59. [59] Kicking the Tires: A Voluntary Path to Pre-deployment AI Vetting | Lawfare — reactive:claude-mythos-capability-regulation
  60. [60] Center for AI Standards and Innovation (CAISI) | NIST — reactive:ai-security-nexus
  61. [61] Compromised SAP Packages Flagged by StepSecurity - LinkedIn — reactive:ai-security-nexus
  62. [62] SAP CAP Ecosystem Hacked via npm Packages - LinkedIn — reactive:ai-security-nexus
  63. [63] GitHub breached via a malicious VS Code extension - Aikido Security — reactive:ai-security-nexus
  64. [64] The Wild West of VS Code extensions and how a poisoned ... — reactive:ai-security-nexus
  65. [65] The Trivy Supply Chain Compromise: What Happened and Playbooks to Respond — reactive:ai-security-nexus
  66. [66] Emerging Supply Chain Attack ("Mini Shai-Hulud") Targeting SAP Cloud Application Programming Ecosystem - Onapsis — reactive:ai-security-nexus
  67. [67] Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware | Wiz Blog — reactive:ai-security-nexus
  68. [68] SAP Cloud Build Tool Packaged A Mini Shai-Hulud Malicious Dependency That Uses Bun | Semgrep — reactive:ai-security-nexus
  69. [69] Mini Shai-Hulud: npm Worm Hits SAP Developer Packages | Blog | Endor Labs — reactive:ai-security-nexus
  70. [70] Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages ... - Snyk — reactive:ai-security-nexus
  71. [71] A Hacker Group Is Poisoning Open Source Code at an ... - WIRED — reactive:ai-security-nexus
  72. [72] Shai Halud: What is Shai-Hulud? Definition & Explanation of the Self-Replicating npm Worm | Kusari® — reactive:ai-security-nexus
  73. [73] Mini Shai-Hulud npm Worm: Dissecting a Multi-Vector Supply Chain Attack - Upwind — reactive:ai-security-nexus
  74. [74] Mini Shai-Hulud: Multi-Ecosystem Developer Supply Chain Attack – Lab Space — reactive:ai-security-nexus
  75. [75] "Shai-Hulud" Worm Compromises npm Ecosystem in Supply Chain ... — reactive:ai-security-nexus
  76. [76] The Shai-Hulud 2.0 npm worm: analysis, and what you need to know | Datadog Security Labs — reactive:ai-security-nexus
  77. [77] TeamPCP: Cascading Supply Chain Attack on AI/ML Tooling – Lab Space — reactive:ai-security-nexus
  78. [78] LiteLLM and Telnyx compromised on PyPI: Tracing the TeamPCP ... — reactive:ai-security-nexus
  79. [79] The Telnyx SDK on PyPI Compromise and the 2026 TeamPCP ... — reactive:ai-security-nexus
  80. [80] No Off Season: Three Supply Chain Campaigns Hit npm, PyPI, and ... — reactive:ai-security-nexus
  81. [81] Claude Mythos and the AI Autonomous Offensive Threshold — reactive:frontier-ai-cyber-capabilities
  82. [82] Mini Shai-Hulud npm Attack: AntV Ecosystem Compromise (May 2026) | Chainguard — reactive:ai-security-nexus
  83. [83] Mini Shai-Hulud Resurfaces; Compromised Maintainer of antv, timeago, and size-sensor Packages Revives Worm Activity | Semgrep — reactive:ai-security-nexus
  84. [84] IBM X-Force OSINT Advisory Mini Shai-Hulud Hits AntV: 300+ ... — reactive:ai-security-nexus
  85. [85] npm Supply Chain Attack Compromises AntV | Orca Security — reactive:ai-security-nexus
  86. [86] Reverse Shai-Hulud: Supply chain compromise impacts @antv packages — reactive:ai-security-nexus
  87. [87] Shai-Hulud: Here We Go Again. Mass npm Supply Chain Attack Hits the AntV Ecosystem - StepSecurity — reactive:ai-security-nexus
  88. [88] Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft | Microsoft Security Blog — reactive:ai-security-nexus
  89. [89] TeamPCP / Mini Shai-Hulud npm Campaign: 600 Packages, Confirmed Active Payload, Memory Scraping, and 2,500+ Compromised GitHub Repositories - Phoenix Security — reactive:ai-security-nexus
  90. [90] When supply-chain attacks meet coding agents, look out — reactive:ai-coding-cpu-demand-surge
  91. [91] LiteLLM supply chain attack explained - Software Improvement Group — reactive:ai-security-nexus
  92. [92] A Practitioner’s Guide to Responding to the TeamPCP Supply Chain Attacks | Ebook/Report | Endor Labs — reactive:ai-security-nexus
  93. [93] "Shai-Hulud" Malware Hits 170+ npm & PyPi Packages - OX Security — reactive:ai-security-nexus
  94. [94] It's Bigger Than TeamPCP. Open Source Is Under Siege. - YouTube — reactive:ai-security-nexus
  95. [95] TeamPCP's Multi-Stage Supply Chain Attack on Security Infrastructure — reactive:ai-offensive-cyber
  96. [96] The npm Threat Landscape: Attack Surface and Mitigations ... — reactive:openai-advanced-account-security
  97. [97] A Technical Write Up on the Trivy Supply Chain Attack - Reddit — reactive:ai-security-nexus
  98. [98] Mini Shai-Hulud Escalates: AI Packages and GitHub Targeted – Lab Space — reactive:ai-security-nexus
  99. [99] GitHub Breach Linked To Malicious VS Code Extension ... - LinkedIn — reactive:ai-security-nexus
  100. [100] 170 npm packages compromised in one coordinated supply chain attack — OpenAI, Mistral AI, even the European Commission g... — reactive:ai-security-nexus (2026-05-23)
  101. [101] RT @IntCyberDigest: ‼️🚨 This is wild. OpenAI just confirmed it got hit in the TanStack npm supply chain attack, and the ... — reactive:ai-security-nexus (2026-05-23)
  102. [102] The TanStack npm supply chain attack (CVE-2026-45321) is wild. — reactive:ai-security-nexus (2026-05-22)
  103. [103] GitHub Confirms 3,800-Repo Breach Traced to TanStack npm Supply Chain Worm #cybersecurity #supplychain #GitHub #OpenAI #... — reactive:ai-security-nexus (2026-05-21)
  104. [104] RT @IntCyberDigest: ‼️🚨 This is wild. OpenAI just confirmed it got hit in the TanStack npm supply chain attack, and the ... — reactive:ai-security-nexus (2026-05-21)
  105. [105] OpenAI a publié son retour sur l'attaque supply chain TanStack npm. — reactive:ai-security-nexus (2026-05-20)
  106. [106] 1:10 TanStack/npm Supply Chain Worm Hits 170+ Packages, Reaches OpenAI @tan_stack @tannerlinsley @OpenAI @npm — reactive:ai-security-nexus (2026-05-20)
  107. [107] هجوم supply chain "‌Mini Shai-Hulud" من TeamPCP اخترق 170 حزمة npm وPyPI، بينها @tanstack/react-router بـ 12 مليون تحميل... — reactive:ai-security-nexus (2026-05-19)
  108. [108] Supply chain attacks on npm packages are not a new threat — but watching one hit OpenAI employees via TanStack is a remi... — reactive:ai-security-nexus (2026-05-19)
  109. [109] A threat actor identified with the TeamPCP alias is claiming to offer ... — reactive:ai-security-nexus
  110. [110] GitHub investigates internal repositories breach claimed by TeamPCP — reactive:ai-security-nexus
  111. [111] OpenAI Confirms TanStack npm Security Breach - LinkedIn — reactive:ai-security-nexus
  112. [112] 😺 Microsoft: your company is the AI bottleneck — The Neuron (2026-05-11)
  113. [113] OpenAI impose une mise à jour macOS après une attaque supply chain ayant touché TanStack, des paquets npm et plusieurs a... — reactive:ai-security-nexus (2026-05-16)
  114. [114] OpenAI Confirms Security Breach Via TanStack npm Supply Chain Attack via @knolinfos https://t.co/gORBgXYLpY — reactive:ai-security-nexus (2026-05-16)
  115. [115] 🚨 OPENAI EMPLOYEE DEVICES COMPROMISED — reactive:ai-security-nexus (2026-05-16)
  116. [116] OpenAI Confirms Security Breach Via TanStack npm Supply Chain Attack https://t.co/hyRTbyclv2 — reactive:ai-security-nexus (2026-05-16)
  117. [117] TeamPCP vende repo Mistral AI dopo attacco TanStack su OpenAI — reactive:ai-security-nexus (2026-05-18)
  118. [118] TeamPCP Claims Sale of Mistral AI Repositories Amid Mini Shai ... — reactive:ai-security-nexus
  119. [119] Hackers Put Mistral AI Source Code Up for Sale After Supply Chain Attack — reactive:ai-security-nexus
  120. [120] TeamPCP Claims Sale of Internal Mistral AI Repositories Amid Mini ... — reactive:ai-security-nexus
  121. [121] Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages — reactive:ai-security-nexus
  122. [122] TeamPCP Targets Telnyx Package in Latest Software Supply Chain Attack - Infosecurity Magazine — reactive:ai-security-nexus
  123. [123] Mistral AI among npm, PyPI packages hit by Mini Shai Hulud — reactive:ai-security-nexus
  124. [124] NVD - CVE-2026-33634 — reactive:ai-security-nexus
  125. [125] LiteLLM Supply Chain Attack: What Happened and How to Respond — reactive:ai-security-nexus
  126. [126] Trivy and LiteLLM Supply Chain Incident (CVE-2026-33634) Update — reactive:ai-security-nexus
  127. [127] Security Update: Suspected Supply Chain Incident | liteLLM — reactive:ai-security-nexus
  128. [128] CVE-2026-33634 - CVE Record — reactive:ai-security-nexus
  129. [129] Endor Patches | CVE-2026-33634, Trivy ecosystem supply chain was briefly compromised — reactive:ai-security-nexus
  130. [130] Trivy ecosystem supply chain was briefly compromised | GitLab Advisory Database (GLAD) — reactive:ai-security-nexus
  131. [131] Trivy ecosystem supply chain temporarily compromised · Advisory · aquasecurity/trivy · GitHub — reactive:ai-security-nexus
  132. [132] Mini Shai-Hulud Targets SAP npm Packages - Upwind Security — reactive:ai-security-nexus