The article describes real supply-chain campaigns where attackers hid credential-stealing code inside trusted open-source packages and developer tools. When a developer or CI system installed the package, the malware ran immediately, stole cloud and pipeline credentials, and enabled unauthorized cloud activity using valid access. The key message is that removing the bad package is not enough, teams must rotate exposed credentials and investigate what those credentials could access in the cloud.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You run npm install, it fails, you shrug it off. But that failed install might’ve just logged into your cloud. In the Shai-Hulud campaign, a poisoned @ctrl/tinycolor package ran a preinstall hook that stole cloud and CI secrets, then pushed them to a public GitHub repo created under the victim’s own account. Another campaign used a GitHub account called BufferZoneCorp to ship fake Ruby and Go utilities. During install they grabbed env vars, rewrote GOPROXY, and even added an SSH key to ~/.ssh/authorized_keys on build hosts. If any untrusted package ever ran on your dev box or CI, don’t just uninstall it, immediately rotate those credentials and review your cloud audit logs for weird API calls.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Security researchers showed that simply opening a GitHub issue could trigger default CI workflows in popular coding-agent projects and lead to code execution or secret exposure. The weaknesses were not in the AI models themselves, but in the surrounding automation (“harness”) that allowed untrusted…
Researchers showed that a single public GitHub issue (from someone with no repo access) could steer popular AI coding agents into running dangerous commands, exposing tokens, and changing repositories. The risk comes from AI agents reading untrusted issue/PR text while also having access to…
Researchers found real GitHub repositories containing poisoned AI-agent instruction/config files (like CLAUDE.md and .cursorrules) that silently tell coding assistants to steal prompts, environment variables, and credentials. The malicious instructions can trigger hidden commands (for example, curl…
AI research non-profit METR disclosed two real security incidents. In one, attackers got access to an exposed system and used an AI agent to reveal an API key, then burned through about $600,000 in AI credits over weeks. In a separate incident, METR observed systematic probing of its public…
Researchers found nearly 800 malicious npm packages that trick developers into installing them through typo-squatted package names and believable documentation. Instead of auto-running on install, the packages rely on the developer following README instructions to load the module, which then…
