Model and package supply chain

Security researcher Gal Weizman of Forever Security disclosed BragJack, an attack that uses one malicious browser extension to hijack AI assistants in five Chromium-based browsers or assistants: Gemini Live in Chrome, Perplexity Comet, Microsoft Edge, Opera Neon, and Claude in Chrome. The attack requires the extension to be installed already, and it can then run without user interaction to abuse the assistant's privileges, such as reading local files, taking screenshots, and sending instructions to agents. The research produced two CVEs, CVE-2026-0628 for Chrome and CVE-2026-55945 for Microsoft Edge, and more than $20,000 in bug bounties.

CrowdStrike assessed with high confidence that a financially motivated threat actor likely used a large language model to write PhantomRaven, a JavaScript information stealer distributed through more than 100 typosquatted and slopsquatted npm packages. The packages retrieve a remote dynamic dependency that harvests developer email addresses, CI/CD environment variables for GitHub Actions, GitLab CI, Jenkins and CircleCI, system fingerprints including the public IP address, and Git/npm configuration details, then sends them to an attacker-controlled server. The operator, active since November 2022, appears to use the stolen data to find bug bounty opportunities rather than selling it.

On March 24, 2026, a threat actor group known as TeamPCP compromised the PyPI distribution pipeline and pushed malicious LiteLLM versions 1.82.7 and 1.82.8, which carried a .pth file payload that ran code at every interpreter start. According to Zscaler ThreatLabz, the poisoned packages were available for approximately three hours before quarantine, and the payload targeted AWS, GCP and Azure tokens, SSH keys and cloud account credentials.

Cisco Talos research, released during Black Hat USA, documents how cybercriminals use AI to develop malicious code, build fraud infrastructure, and accelerate vulnerability research and exploitation. The study found AI guardrails often ineffective, as threat actors bypass them with basic social engineering claims such as "this is authorised testing." CrowdStrike research adds that adversaries increasingly target AI infrastructure through software supply chain attacks, including a North Korean group that injected a malicious npm package into at least 131 Mastra AI framework packages in June 2026.

Researchers at Tel Aviv University, Technion, and Intuit, led by Aya Spira in Ben Nassi's group, published a July 8, 2026 paper showing that LLM coding agents hallucinate predictable names for repositories and skill installs. The models in Cursor, Windsurf, GitHub Copilot, Cline, Gemini CLI, and OpenClaw repeated identical names up to 85% of the time for repository requests and 100% of the time for skill installs. Attackers can register those names in advance, letting an agent fetch malicious code without any user action, which the article terms HalluSquatting.

Manifold Security researcher Ax Sharma found that Anthropic's Claude for Chrome extension executes its predefined AI workflows on click events without checking Event.isTrusted. A malicious extension with permission to modify content on claude.ai can inject one of nine task identifiers and generate a synthetic click, abusing Claude's access to Gmail, Google Docs, Google Calendar and Salesforce. The attack is limited to those nine workflows and requires the user to install the malicious extension first.

Microsoft attributes a Mastra AI npm supply chain attack, which compromised more than 140 packages in the @mastra scope, to the North Korean state actor Sapphire Sleet, also known as BlueNoroff. The attackers hijacked the npm maintainer account "ehindero" and published malicious updates that injected a typosquat dependency, "easy-day-js", which ran a postinstall hook to deploy a cross-platform information stealer targeting credentials and crypto wallets.

Unit 42 researchers disclosed a vulnerability in the Google Cloud Vertex AI Python SDK (google-cloud-aiplatform) that allows remote code execution in a victim's Vertex AI serving infrastructure. The flaw stems from a predictable default staging bucket name, combined with a missing ownership check, enabling bucket squatting. The issue affected versions 1.139.0 and 1.140.0, and Google fixed it in v1.148.0, released April 15, 2026.

The Hades Campaign, discovered by StepSecurity researchers and described as the latest evolution of the Miasma threat actor, is a supply chain compromise targeting Python developer environments. It runs when infected packages are imported, using the Bun runtime to execute multi-layer payloads that harvest credentials, scrape Linux, macOS and Windows memory, and spread as a self-replicating worm. The malware also embeds a text block that tricks LLM-based scanners into classifying the malicious package as clean.

A malicious npm package named codexui-android, posing as a remote user interface for OpenAI Codex, exfiltrated developer authentication tokens, according to researchers at Aikido. The code that stole the tokens appeared only in the published npm version, not in the project's public GitHub repository, and the package had around 27,000 weekly downloads. A companion Android app automatically pulled and executed the npm package at runtime, and the stolen refresh tokens do not expire, giving attackers persistent access.

Researchers at Aikido Security disclosed a malicious campaign in which the npm package codexui-android, a remote web UI for OpenAI Codex with over 29,000 weekly downloads, was altered about a month after publication to read ~/.codex/auth.json and send its contents to sentry.anyclaw[.]store, a server masquerading as Sentry. The stolen access_token, refresh_token, id_token and account ID give persistent access, since the refresh_token does not expire. The same exfiltration chain appears in Android apps linked to the developer BrutalStrike, including one with over 50,000 downloads.

OX Security reported a malicious npm package named "mouse5212-super-formatter" that poses as an internal "archive deployment sync" utility. During the postinstall stage it authenticates to GitHub, using a token from the victim's environment or a hard-coded fallback, and recursively uploads every file from "/mnt/user-data", the directory Anthropic's Claude uses for uploads and outputs, to a threat actor-controlled GitHub account. The package is estimated to have been downloaded 676 times, though the number of actual installs is unclear.

Adversa AI describes SymJack, an attack that uses a malicious repository to turn AI coding agents into delivery mechanisms for supply chain attacks. A malicious symlink, renamed to look innocuous, is used with a cp command to plant a payload in the agent's configuration, registering a malicious MCP server whose startup command runs attacker code as the user on the next restart. Adversa reports the method worked in all five coding agents it tested, including Claude Code, Gemini CLI, Cursor Agent CLI, Grok Build CLI and GitHub's Copilot CLI.

OpenAI disclosed that two employee devices were affected by the Mini Shai-Hulud supply chain attack on TanStack. OpenAI says no user data, production systems, or intellectual property were compromised or modified without authorization, though limited credential material was transferred from internal source code repositories. Because those repositories held signing certificates for iOS, macOS, and Windows products, OpenAI revoked them and issued new ones, requiring macOS users of ChatGPT Desktop, Codex App, Codex CLI, and Atlas to update before the old certificate is revoked on June 12, 2026.

OpenAI disclosed that a TanStack supply chain attack by the TeamPCP group exfiltrated limited credential material from internal source code repositories after two employee devices were infected. OpenAI says no customer data or intellectual property was affected, and it has rotated credentials, revoked user sessions and temporarily restricted code-deployment workflows. The company is also revoking code-signing certificates for its iOS, macOS, Windows and Android products, and macOS users must update their apps by June 12, 2026.

OpenAI says two employees' devices were breached in the TanStack supply chain attack, which the company links to the Mini Shai-Hulud campaign by the TeamPCP extortion gang. Activity in a limited subset of internal source code repositories included credential-focused exfiltration, and OpenAI says no customer data, production systems or deployed software were affected. The company is rotating code-signing certificates as a precaution.