1d:I[70616,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"Breadcrumb"] 1e:I[90762,["/_next/static/chunks/0kcf5dt6yxdox.js","/_next/static/chunks/1su5n1uv1ti4s.js","/_next/static/chunks/0gvke1wv6udfg.js","/_next/static/chunks/1dfrle3jgmlzh.js","/_next/static/chunks/162lgvduyr-fa.js","/_next/static/chunks/2gcnnopam8e9w.js","/_next/static/chunks/2g60iab5a1pkg.js"],"ArticleGrid"] 1f:T11f3,

A stealth-stage security startup in Israel spent part of this month scanning 6,214 live domains. It was hunting through a file type that almost no security team audits. What it surfaced is a supply chain exposure that sits entirely outside the reach of conventional endpoint tooling.

The target was a pair of emerging conventions: llms.txt and llms-full.txt. Think of them as the AI-era counterpart to robots.txt. Sites publish them so machines can read a clean summary of the content and structure. Coding agents treat them as setup documentation.

The scan surfaced 8,265 of these files across the domain set. Of those, 120 files, each on a separate site, referenced package names or domains that had never been registered. Between them, those files carried 227 install commands pointing at things nobody owned. Any attacker could have claimed them.

The proof of concept phoned home in under an hour

The team registered a handful of the unclaimed names to see what would happen. They hosted harmless packages that called back to a server on execution. The first beacon landed within the hour. It came from a Fortune 500 company.

Several dozen more arrived over the following period. Some came from startups. Others came from additional Fortune 500 firms, and the original domain set had included defense contractors and Big Tech properties.

The beacon logged the parent process chain behind every install. That detail is what turns the finding from theory into evidence. It named the software doing the work: Anthropic's Claude, OpenAI's Codex, and Nous Research's Hermes. Ars Technica, which first reported the research, said none of the three companies replied to a request for comment before publication.

One of the cases was already weaponized

Not every finding was a controlled test. On the legitimate domain clerk.com, the researchers found an LLM file containing the command npx clerk-next-fix-auth-protection.

The choice of npx matters here. Unlike a standard install, npx can pull a package into the npm cache and run its exposed binary without ever writing it into the project manifest. There is no dependency record left behind to review later.

Someone had already claimed the empty slot and filled it with live malware. Clerk has since fixed the file. The company noted that agents which had already installed a binary from its official eslint plugin package were not exposed. Whether any machines were actually infected remains unclear.

Why the security stack never fired

The most uncomfortable part of the research is not the malware. It is that every trust signal pointed the right way.

An agent encountering one of these files sees HTTPS, an official corporate domain, a standardized format built for AI consumption, and a publisher the organization already works with. Nothing in that chain looks wrong. The file is meant to be authoritative, so the agent does not stop to verify whether the referenced package actually exists in the registry.

Detection tooling fares no better. To an EDR agent or a corporate proxy, the activity resembles a developer pulling a package from a registry the company already allows, with a sanctioned coding assistant as the parent process. There is no anomaly to flag because the failure happens upstream of anything the endpoint can see.

Alon Hertz, one of the researchers, argued in an interview that the underlying trust model is broken, because agents accept vendor documentation as ground truth and their human supervisors rarely question it either.

He also drew a distinction worth holding onto. A prompt injection requires someone to plant a hostile instruction deliberately. Here the instruction can be entirely benign when written, published in good faith by a real company. The danger appears later, once the package or domain it references is abandoned and a stranger picks up the name.

The origin of the faulty entries is still murky. Some predate the current wave of AI tooling and appear to have been typed by humans into older documentation. Others may have been generated by models that hallucinated a package name, or that copied bad instructions without being able to tell good from bad.

For engineering leaders, the practical takeaway is narrow but urgent. Any document an agent is permitted to read, and any command it is permitted to run, now belongs in the threat model. Vendor documentation has quietly become an execution surface, and it carries none of the integrity guarantees that real code does.

20:T14fa,

A self-propagating worm that researchers have named ChainDrop tore through the npm registry on August 4, poisoning 444 packages and 2,212 individual versions in under four hours, and the reason it slipped past standard defenses is the uncomfortable part: many of the malicious releases arrived cryptographically signed, with valid provenance attestations, published by the victims' own release workflows.

The blast radius is enormous because the earliest carriers were caching libraries that almost nothing in JavaScript avoids — poisoned builds of keyv, flat-cache, and file-entry-cache each draw roughly 150 million weekly downloads and sit deep inside toolchains from ESLint to anything built on cache-manager, so one compromised patch release lands in lockfiles no developer consciously chose. Transitive dependency depth, not carelessness, is what makes this class of attack so efficient.

How the payload works

Every infected release follows the same recipe, which Microsoft Threat Intelligence classifies as a Mini Shai-Hulud variant: a preinstall lifecycle hook fires before installation finishes, fetches the legitimate Bun JavaScript runtime, and executes a roughly 710KB obfuscated second stage on workstations and build runners ahead of test suites or conventional scanning. Timing is the whole trick — a scanner that inspects a dependency after install has already lost.

The malware then branches on where it landed, detaching into the background on a developer machine while deliberately staying attached inside CI so it can reach workflow secrets, runner credentials, and OpenID Connect publishing permissions. It sweeps environment variables, shell histories, SSH keys, and cloud configuration before authenticating to npm, GitHub, AWS, Kubernetes, and HashiCorp Vault to call those APIs directly and harvest whatever else the stolen identity is allowed to see. That last step is what distinguishes it from ordinary token scrapers, which stop at pattern-matching files on disk.

Exfiltration is layered: the haul is compressed, encrypted, and pushed to an attacker-controlled HTTPS endpoint with GitHub repositories as fallback, while command and control runs through the Ethereum blockchain in a dead-drop pattern known as EtherHiding that leaves defenders nothing to seize or sinkhole. Propagation then closes the loop, as a stolen publishing token lets the worm enumerate reachable packages, inject itself into the newest tarball, bump the patch version, and republish — turning a single compromised maintainer into hundreds of malicious releases within hours.

Why provenance did not save anyone

Supply chain defenders spent the past two years telling teams to demand signed provenance, and the March 2026 axios compromise reinforced that advice because the missing attestation was the giveaway. ChainDrop inverts the lesson: the attacker took over a maintainer's GitHub account, pushed poisoned release commits and tags, and let the project's own trusted-publishing workflow build and sign the malware, because an attestation proves which commit produced a build and says nothing about whether that commit was authorized.

Investigators also found malicious versions with no matching commit, pull request, or tag, meaning the attackers republished modified tarballs directly instead of touching the public source repository at all. Until registries can bind releases to reviewed changes, that mismatch between published artifact and repository history remains one of the few reliable detection signals teams can automate.

The economics here favor the attacker in a way that policy has not caught up with. A registry optimized for instant publication and automatic patch upgrades rewards speed at every layer, and the same defaults that let a maintainer ship a bug fix within minutes let a worm ship itself within minutes. Npm's move toward trusted publishing was meant to shrink the credential attack surface, and it did — but it also concentrated trust in a maintainer's identity provider account, which is exactly where this campaign struck. Account takeover, not token theft, is now the highest-leverage move available against open source distribution.

AI tooling as a persistence layer

The detail that should worry teams running AI coding assistants is where the worm hides: with stolen GitHub credentials it writes Claude Code, Visual Studio Code, and Copilot workflow configuration into repository branches, converting agent config into both persistence and a developer-to-developer infection path. Editor and agent settings are rarely code-reviewed, which is precisely why they make effective hiding places, and cleaning the dependency tree without auditing them leaves the door open.

Guidance from Microsoft and the researchers tracking the campaign is blunt: treat any workstation or runner that installed an affected version with lifecycle scripts enabled as compromised outright, rotate credentials from a known-clean environment, and rebuild downstream artifacts from trusted sources rather than patching in place. Hardening for the next wave is unglamorous — disable install scripts by default with the ignore-scripts flag, pin exact versions, scope publishing tokens narrowly, and review any dependency update that introduces a preinstall hook.

a:["$","div",null,{"className":"mx-auto max-w-7xl px-4 py-8 sm:px-6","children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"BreadcrumbList\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https://ainewsway.com\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"#npm\",\"item\":\"https://ainewsway.com/tag/npm\"}]}"}}],["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"{\"@context\":\"https://schema.org\",\"@type\":\"ItemList\",\"@id\":\"https://ainewsway.com/tag/npm#itemlist\",\"name\":\"#npm Articles\",\"numberOfItems\":2,\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"url\":\"https://ainewsway.com/articles/researchers-found-227-install-commands-pointing-at-code-nobody-owns-mtcq6tfl\",\"name\":\"Researchers Found 227 Install Commands Pointing at Code Nobody Owns\"},{\"@type\":\"ListItem\",\"position\":2,\"url\":\"https://ainewsway.com/articles/chaindrop-worm-poisoned-444-npm-packages-with-valid-signatures-msvchpnz\",\"name\":\"ChainDrop Worm Poisoned 444 npm Packages — With Valid Signatures\"}]}"}}],["$","$L1d",null,{"items":[{"label":"# npm"}]}],["$","h1",null,{"className":"mb-8 text-3xl font-bold text-zinc-900 dark:text-zinc-100","children":["#","npm"]}],[["$","$L1e",null,{"articles":[{"id":"007cdda5-aded-4c93-92c5-c12a0d1ebe44","slug":"researchers-found-227-install-commands-pointing-at-code-nobody-owns-mtcq6tfl","title":"Researchers Found 227 Install Commands Pointing at Code Nobody Owns","subtitle":"A scan of 6,214 corporate domains found AI documentation files quietly steering coding agents toward unregistered packages","content":"$1f","excerpt":"A scan of 6,214 domains found 120 llms.txt files pointing coding agents at unregistered packages, and one slot already held live malware.","coverImage":"https://cdn.ainewsway.com/processed/v1/ae2e9905-4ff3-4e3a-8d3e-c57407d4859b/original.webp","coverImageCaption":"Source code on a developer display, the layer where AI coding agents execute install commands they read from vendor documentation","authorId":"6773f67d-d7fa-4b19-8f38-384f10ac761b","status":"PUBLISHED","publishedAt":"2026-08-28T09:07:30.764Z","viewCount":12,"likeCount":0,"readingTime":4,"isFeatured":false,"isBreakingNews":false,"metaTitle":"llms.txt Risk: 227 Install Commands Point to Unclaimed Code","metaDescription":"A scan of 6,214 domains found 120 llms.txt files steering coding agents to 227 unregistered packages; one slot on clerk.com already carried live malware.","metaKeywords":["llms.txt","supply chain security","coding agents","npx malware","Clerk","unregistered packages","AI agent security","developer tools"],"ogImage":null,"aiSummary":"An Israeli security startup scanned 6,214 corporate domains and found 8,265 llms.txt and llms-full.txt files, of which 120 referenced package names or domains nobody had registered, totaling 227 install commands attackers could claim. Registering a few names produced callbacks within an hour from a Fortune 500 company, with logs naming Claude, Codex and Hermes as the installing agents. One command on clerk.com already pointed at live malware, and conventional security tooling never flagged any of it.","aiTags":[],"sentiment":null,"articleType":"NEWS","videoEmbed":null,"videoType":null,"seoScore":85,"isAutoGenerated":true,"isBackfill":false,"pipelineStage":null,"copyrightScore":null,"similarityScore":null,"matchedSourceId":null,"createdAt":"2026-08-28T09:04:40.066Z","updatedAt":"2026-09-10T01:36:54.679Z","contentUpdatedAt":"2026-08-28T09:07:30.764Z","deletedAt":null,"author":{"id":"6773f67d-d7fa-4b19-8f38-384f10ac761b","name":"Seung Jung","username":"Seung Jung","avatar":null},"categories":[{"id":"32f2303b-b593-473f-bf9c-6a99acbe6ce1","name":"Developer Tools","slug":"developer-tools"}],"tags":[{"id":"c3ea531c-0bd4-483a-8d99-b10d931913b2","name":"Supply Chain Security","slug":"supply-chain-security"},{"id":"18cdd61e-c75a-4aff-843e-db288dddc418","name":"Coding Agents","slug":"coding-agents"},{"id":"b33b2800-95a4-4cc2-9cea-4a3b5111dca3","name":"Cybersecurity","slug":"cybersecurity"},{"id":"971d527f-0508-47c9-aac1-39914a5f883c","name":"AI Agents","slug":"ai-agents"},{"id":"f27438f6-ceb9-40af-9d4d-85fdd7e1a0fc","name":"npm","slug":"npm"}],"translations":[],"celebrities":[{"id":"0632936d-a299-490f-b5e5-dfa87ba3eaa0","nameKo":"Anthropic","nameEn":"Anthropic","slug":"anthropic","profileImage":"https://ui-avatars.com/api/?name=Anthropic&size=400&background=84CC16&color=fff&bold=true"},{"id":"b086135e-3126-46cd-b591-67f073dff1bb","nameKo":"OpenAI","nameEn":"OpenAI","slug":"openai","profileImage":"https://ui-avatars.com/api/?name=OpenAI&size=400&background=F97316&color=fff&bold=true"}]},{"id":"a937420b-135b-4dd1-b9e0-eccd126a5bc5","slug":"chaindrop-worm-poisoned-444-npm-packages-with-valid-signatures-msvchpnz","title":"ChainDrop Worm Poisoned 444 npm Packages — With Valid Signatures","subtitle":"The self-propagating supply chain attack shipped through legitimate release workflows, defeating provenance checks","content":"$20","excerpt":"A self-propagating npm worm hit 444 packages in four hours, published through trusted workflows with valid provenance attestations.","coverImage":"https://cdn.ainewsway.com/processed/v1/d056b44a-65b0-4725-8114-00b622e84b41/original.webp","coverImageCaption":"A developer at work — ChainDrop executed on workstations and CI runners through npm preinstall hooks before any scan ran.","authorId":"6773f67d-d7fa-4b19-8f38-384f10ac761b","status":"PUBLISHED","publishedAt":"2026-08-16T05:09:25.768Z","viewCount":41,"likeCount":0,"readingTime":4,"isFeatured":false,"isBreakingNews":false,"metaTitle":"ChainDrop npm Worm Hits 444 Packages With Valid Provenance","metaDescription":"ChainDrop poisoned 444 npm packages and 2,212 versions in under four hours on August 4, shipping signed releases through victims' own CI workflows.","metaKeywords":["ChainDrop","npm worm","supply chain attack","npm provenance","keyv","Shai-Hulud","CI/CD security","developer tools"],"ogImage":null,"aiSummary":"A self-propagating worm named ChainDrop poisoned 444 npm packages and 2,212 versions in under four hours on August 4, with many releases carrying valid provenance attestations published by victims' own release workflows. Early carriers keyv, flat-cache and file-entry-cache each see roughly 150 million weekly downloads, and a preinstall hook runs a 710KB payload that harvests CI secrets and cloud credentials. Expect scrutiny of provenance checks that trust compromised pipelines.","aiTags":[],"sentiment":null,"articleType":"NEWS","videoEmbed":null,"videoType":null,"seoScore":85,"isAutoGenerated":true,"isBackfill":false,"pipelineStage":null,"copyrightScore":null,"similarityScore":null,"matchedSourceId":null,"createdAt":"2026-08-16T05:09:08.784Z","updatedAt":"2026-09-10T01:38:00.849Z","contentUpdatedAt":"2026-08-16T05:09:25.768Z","deletedAt":null,"author":{"id":"6773f67d-d7fa-4b19-8f38-384f10ac761b","name":"Seung Jung","username":"Seung Jung","avatar":null},"categories":[{"id":"32f2303b-b593-473f-bf9c-6a99acbe6ce1","name":"Developer Tools","slug":"developer-tools"}],"tags":[{"id":"f27438f6-ceb9-40af-9d4d-85fdd7e1a0fc","name":"npm","slug":"npm"},{"id":"c3ea531c-0bd4-483a-8d99-b10d931913b2","name":"Supply Chain Security","slug":"supply-chain-security"},{"id":"b33b2800-95a4-4cc2-9cea-4a3b5111dca3","name":"Cybersecurity","slug":"cybersecurity"},{"id":"ecf1f0ca-5d56-4c07-9056-06a992884e79","name":"CI/CD","slug":"ci-cd"},{"id":"dbb28dbd-4512-4daa-9191-85e040c30141","name":"Open Source","slug":"open-source"},{"id":"18cdd61e-c75a-4aff-843e-db288dddc418","name":"Coding Agents","slug":"coding-agents"}],"translations":[],"celebrities":[{"id":"b4b2327a-471f-4dbc-a85f-a9c29f3ddd82","nameKo":"마이크로소프트","nameEn":"Microsoft","slug":"microsoft","profileImage":null}]}]}],"$L21"]]}]

#npm

Researchers Found 227 Install Commands Pointing at Code Nobody Owns

ChainDrop Worm Poisoned 444 npm Packages — With Valid Signatures

Subscribe to Newsletter

#npm

Researchers Found 227 Install Commands Pointing at Code Nobody Owns

ChainDrop Worm Poisoned 444 npm Packages — With Valid Signatures