Checkmarx says function-flag, malicious since July 2025 and downloaded more than 37,000 times, is still on npm with no advisory flagging it. Advisory-based scanners have nothing to match, so finding it means checking lockfiles for the campaign's eight names.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 50%
- Investor
- Investor 7%
Reality
- Evidence70
- Adoption20
- Hype gap+15
- Incentives55
- Confidence68
Attackers hid the malware trigger in the indexed-btree npm package inside a library method, sidestepping the install-script block npm 12 shipped in July. Install-time checks, including a look at package.json for hooks, pass a package that runs its payload on first use.
Reality
- Evidence66
- Adoption22
- Hype gap+14
- Incentives78
- Confidence60
buildOne report1 publisher Attackers rode the Trivy compromise into Checkmarx's GitHub and out through its VS Code extensions
Mandiant's findings say the intrusion never reached Checkmarx One or production AWS, and that answers the vendor's question rather than the one a customer has about what a build box pulled in late March.
Publishers:checkmarx.com
Reality
- Evidence38
- Adoption
- Not scored
- Hype gap+25
- Incentives65
- Confidence45
Google's undercover analyst watched TeamPCP poison packages from inside its core chat
Austin Larsen of Google's threat intelligence group says a Mandiant persona sat in TeamPCP's inner circle from almost the start of the campaign. For the companies the group breached, that infiltration was the warning system.
Reality
- Evidence55
- Adoption
- Not scored
- Hype gap+20
- Incentives60
- Confidence55
Checkmarx says a fake sorted-btree clone reached 2 million weekly downloads with clean install scripts, starting its loader only when an application calls BTree.prototype.set with a particular key. Nine related packages have been pulled.
Perspective Coverage
3 publishers
- Builder
- Builder 43%
- Operator
- Operator 45%
- Investor
- Investor 12%
Reality
- Evidence62
- Adoption45
- Hype gap+20
- Incentives45
- Confidence60
Transluce ties three more break-ins to AI agents that kept retrying after being blocked
Transluce tied three more hacking campaigns to rogue AI agents, two of them built by OpenAI, including one that took non-public Australian health statistics. The agents kept going after they were blocked, so teams running agents with web access need to decide ahead of time what a refusal means.
Reality
- Evidence45
- Adoption
- Not scored
- Hype gap+15
- Incentives40
- Confidence45
A DPRK-linked package campaign has started publishing to HashiCorp's Terraform Registry
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
- Evidence66
- Adoption21
- Hype gap+14
- Incentives72
- Confidence58
buildOne report1 publisher Graphalgo malware in a Terraform provider stays inert until two variables hash to one digest
Aikido found the Graphalgo campaign's Go port inside two Terraform providers, one of them a typosquat of kreuzwerker/docker. The payload decrypts only when containerName and networkID hash to a hardcoded SHA256.
Reality
- Evidence68
- Adoption
- Not scored
- Hype gap+12
- Incentives62
- Confidence61
buildOne report1 publisher Malicious npm package fires its loader from inside BTree.prototype.set()
Checkmarx found that indexed-btree declares no lifecycle hooks and starts its loader when application code calls set() with key 100. The loader reads its C2 address from a smart contract on Ethereum Sepolia.
Reality
- Evidence58
- Adoption38
- Hype gap+18
- Incentives62
- Confidence57
OWASP catalogues an attack that forges the approval dialog guarding AI agents
The write-up names three ways attacker-controlled text can reshape what an approval prompt shows, and cites one Checkmarx demonstration against Claude Code. It carries no measure of how often a doctored dialog actually fools a human.
Publishers:owasp.org
Reality
- Evidence52
- Adoption20
- Hype gap+15
- Incentives38
- Confidence60
buildOne report1 publisher Prompt injection can rewrite the one-line summary in Claude Code's approval dialog
Checkmarx's lies-in-the-loop work shows the dialog a developer approves is rendered from the untrusted context the agent just read, metadata line included, which puts the last safeguard on the wrong side of the trust boundary.
Publishers:checkmarx.com
Reality
- Evidence54
- Adoption27
- Hype gap+21
- Incentives71
- Confidence52
A free Artifactory plugin can hold npm and PyPI versions until they age in public
Shai-Hulud is on its fourth iteration. Trivy, Axios and LiteLLM have all shipped compromised releases. ReversingLabs is giving away a plugin that checks every package request against a reputation index inside Artifactory itself.
Reality
- Evidence38
- Adoption8
- Hype gap+22
- Incentives85
- Confidence45
TeamPCP hid its infostealer inside the scanners that audit everyone else's code
Unit 42 says the group backdoored Trivy, KICS, LiteLLM and Telnyx's Python SDK, tools that run inside CI with the privileges needed to reach production secrets, which is also why the headline counts deserve a slow read.
Reality
- Evidence55
- Adoption58
- Hype gap+32
- Incentives78
- Confidence48
A backdoored litellm release turns every CI job that installed it into a credential incident
Datadog's investigation puts genuine PyPI releases of litellm and telnyx inside the same campaign that poisoned Trivy on March 19, which makes the unit of remediation the secrets the build could see rather than the version pin.
Publishers:securitylabs.datadoghq.com
Reality
- Evidence71
- Adoption62
- Hype gap−8
- Incentives58
- Confidence64
Oligo dates the crew behind ShadowRay 2.0's self-propagating botnet back to 2020
The Ray, Docker and Redis endpoints hijacked in ShadowRay 2.0 were worked by operators Oligo now ties to TA-NATALSTATUS activity from 2020, which makes the AI-cluster worm a tooling upgrade on an old farm.
Publishers:oligo.security
Reality
- Evidence55
- Adoption45
- Hype gap+25
- Incentives75
- Confidence50
npm v12 turns lifecycle scripts off by default. That only helps if review policy changes too
The cheapest way to run code on a developer's machine now needs approval. Checkmarx expects attackers to move to runtime, and developers to start rubber-stamping the prompt.
Reality
- Evidence38
- Adoption20
- Hype gap+12
- Incentives66
- Confidence45