Model and package supply chain

Microsoft attributes a Mastra AI npm supply chain attack, which compromised more than 140 packages in the @mastra scope, to the North Korean state actor Sapphire Sleet, also known as BlueNoroff. The attackers hijacked the npm maintainer account "ehindero" and published malicious updates that injected a typosquat dependency, "easy-day-js", which ran a postinstall hook to deploy a cross-platform information stealer targeting credentials and crypto wallets.

Unit 42 researchers disclosed a vulnerability in the Google Cloud Vertex AI Python SDK (google-cloud-aiplatform) that allows remote code execution in a victim's Vertex AI serving infrastructure. The flaw stems from a predictable default staging bucket name, combined with a missing ownership check, enabling bucket squatting. The issue affected versions 1.139.0 and 1.140.0, and Google fixed it in v1.148.0, released April 15, 2026.

The Hades Campaign, discovered by StepSecurity researchers and described as the latest evolution of the Miasma threat actor, is a supply chain compromise targeting Python developer environments. It runs when infected packages are imported, using the Bun runtime to execute multi-layer payloads that harvest credentials, scrape Linux, macOS and Windows memory, and spread as a self-replicating worm. The malware also embeds a text block that tricks LLM-based scanners into classifying the malicious package as clean.

A malicious npm package named codexui-android, posing as a remote user interface for OpenAI Codex, exfiltrated developer authentication tokens, according to researchers at Aikido. The code that stole the tokens appeared only in the published npm version, not in the project's public GitHub repository, and the package had around 27,000 weekly downloads. A companion Android app automatically pulled and executed the npm package at runtime, and the stolen refresh tokens do not expire, giving attackers persistent access.

Researchers at Aikido Security disclosed a malicious campaign in which the npm package codexui-android, a remote web UI for OpenAI Codex with over 29,000 weekly downloads, was altered about a month after publication to read ~/.codex/auth.json and send its contents to sentry.anyclaw[.]store, a server masquerading as Sentry. The stolen access_token, refresh_token, id_token and account ID give persistent access, since the refresh_token does not expire. The same exfiltration chain appears in Android apps linked to the developer BrutalStrike, including one with over 50,000 downloads.

OX Security reported a malicious npm package named "mouse5212-super-formatter" that poses as an internal "archive deployment sync" utility. During the postinstall stage it authenticates to GitHub, using a token from the victim's environment or a hard-coded fallback, and recursively uploads every file from "/mnt/user-data", the directory Anthropic's Claude uses for uploads and outputs, to a threat actor-controlled GitHub account. The package is estimated to have been downloaded 676 times, though the number of actual installs is unclear.

Adversa AI describes SymJack, an attack that uses a malicious repository to turn AI coding agents into delivery mechanisms for supply chain attacks. A malicious symlink, renamed to look innocuous, is used with a cp command to plant a payload in the agent's configuration, registering a malicious MCP server whose startup command runs attacker code as the user on the next restart. Adversa reports the method worked in all five coding agents it tested, including Claude Code, Gemini CLI, Cursor Agent CLI, Grok Build CLI and GitHub's Copilot CLI.

OpenAI disclosed that two employee devices were affected by the Mini Shai-Hulud supply chain attack on TanStack. OpenAI says no user data, production systems, or intellectual property were compromised or modified without authorization, though limited credential material was transferred from internal source code repositories. Because those repositories held signing certificates for iOS, macOS, and Windows products, OpenAI revoked them and issued new ones, requiring macOS users of ChatGPT Desktop, Codex App, Codex CLI, and Atlas to update before the old certificate is revoked on June 12, 2026.

OpenAI disclosed that a TanStack supply chain attack by the TeamPCP group exfiltrated limited credential material from internal source code repositories after two employee devices were infected. OpenAI says no customer data or intellectual property was affected, and it has rotated credentials, revoked user sessions and temporarily restricted code-deployment workflows. The company is also revoking code-signing certificates for its iOS, macOS, Windows and Android products, and macOS users must update their apps by June 12, 2026.

OpenAI says two employees' devices were breached in the TanStack supply chain attack, which the company links to the Mini Shai-Hulud campaign by the TeamPCP extortion gang. Activity in a limited subset of internal source code repositories included credential-focused exfiltration, and OpenAI says no customer data, production systems or deployed software were affected. The company is rotating code-signing certificates as a precaution.