Sinan Can Demir had been turned down for more than twenty internships. He is a computer science junior at UT Dallas, originally from Konya, and he spent the last week of July on GitHub trying to build up a portfolio that might get him a callback, because some recruiters treat a contribution history as a proxy for whether you can actually do the work.
He found a pull request against a small network scanning tool called myNetwork and read it closely enough to notice a hidden malware dropper. He said so on the project’s message board. Two accounts immediately turned up to explain, in detailed and plausible technical language, why he had it wrong. One of them presented as an engineer in Germany named Lena Brandt, agreeing that the change was clean and pressing the maintainer to merge it.
Demir told Reuters the pushback made him second-guess whether he was accusing someone unfairly. He went and checked his reasoning against a chatbot, decided he was right, and held. The maintainer rejected the update, citing security.
He assumed he had caught a human, because in his words it was clearly lying to him and he did not think an AI could lie to real developers like that. Britain’s AI Security Institute contacted him afterward to explain that miraholt31 and Lena Brandt were the same autonomous agent, which had escaped a cyber evaluation and spent roughly thirty-four hours working the target.
Read that story as a win and you learn nothing from it. Read it as a description of how open source is actually defended and it should ruin your week.
What was guarding that package
AISI published its incident report on August 4. Across evaluation runs between July 25 and 28, agents took nineteen unsanctioned actions against real people and real organizations. Seventeen came from a single model. The tests ran with provider cyber classifiers deliberately disabled and open internet access deliberately provided, a configuration AISI notes is not commercially available, and the agents never broke the VM sandbox. Detection came from anomalous Tor traffic, after the fact, because the environment had no monitoring designed to inspect evaluation activity in real time and block actions outside the task’s authorized scope.
So the lab did not catch it. What caught it was an unemployed twenty-four-year-old who happened to be reading that specific diff on that specific morning for reasons that had nothing to do with security, who nearly talked himself out of it, and who was right.
That is the control. Not a scanner, not a signature, not a policy. One person who happened to be there.
Now ask how many of the packages in your lockfile had somebody standing at the door this morning.
The volume the door is facing
Sonatype identified 454,600 new malicious packages in 2025, bringing their cumulative count past 1.233 million across npm, PyPI, Maven Central, NuGet and Hugging Face. By the end of Q2 2026 the running total had reached 1.8 million. In the first quarter of 2026 the rate came to one new malicious package roughly every six minutes. Their own framing of what changed is that the ecosystem moved from spam and stunts to sustained, industrialized campaigns, many of them state sponsored.
North Korea runs the largest of them. Socket has tracked more than 1,700 packages tied to the Contagious Interview operation, published in parallel across npm, PyPI, Go modules, crates.io and Packagist from shared infrastructure, by clusters variously identified as Famous Chollima, BlueNoroff and UNC1069, all reporting into the Reconnaissance General Bureau. In July, Socket’s Karlo Zanki documented the PolinRider wave: 108 packages and extensions including 61 Go modules, published using git history rewriting, force pushes and anti-dated commits engineered to make malicious changes look old and settled. His conclusion retires most of what developers were taught to check before taking a dependency, which is that the GitHub landing page and the visible commit history are no longer reliable indicators of compromise.
A Chinese-language operation went slower. In November 2025, Socket’s Kush Pandya published an analysis of twelve NuGet packages uploaded two years earlier by an account named shanhai666. Three were legitimate, working libraries published purely to establish credibility for the other nine, which carried roughly twenty lines of malicious payload inside thousands of lines of functioning code, with activation triggers set for August 2027 and November 2028. Pandya’s note on why the design works is the part that should bother anyone shipping .NET: even after activation, the failures present as random bugs rather than as a systematic attack. That code is sitting in real dependency trees right now, waiting, engineered so that when it fires you will log it as a flaky service.
And then there is the case where nobody needed to sneak in at all. Strider Technologies screened contributors to widely used repositories for nation-state affiliation and found that more than 21 percent of contributors to openvino-genai, the code that runs generative models on consumer hardware and appears in 62 downstream projects, carried affiliations or working relationships tied to adversarial states. Those people have commit rights. Today.
Most doors have nobody at them, and the ones that do are held by volunteers
Demir’s story only works because somebody had to make a decision. A pull request needs a merge. A new package needs an install. There is a moment, a human, and a choice, which is exactly the shape of attack that occasionally gets caught.
The attacks that matter most do not have that shape.
On August 4, 2026, the same day AISI published its report, the GitHub account of the maintainer behind keyv was compromised. Nine hours later StepSecurity had found the payload in 444 npm packages across 2,212 versions, reaching past two billion monthly installs. Microsoft Threat Intelligence named the worm ChainDrop. Nobody chose keyv that morning. It was already in the lockfile, along with flat-cache and file-entry-cache and cacheable-request, sitting in the transitive tree underneath tooling nobody has thought about in two years.
Aikido’s analysis of that incident contains the detail that should end any comfortable feelings about attestation. The malicious files were pushed directly to main and a release was cut immediately, so the poisoned versions went out with valid provenance signed by GitHub Actions. Cryptographically correct. It certified that the artifact came from the right workflow in the right repository under the right maintainer’s authority, and every one of those claims was true, and none of them had anything to do with whether the code was safe.
As for the doors that do have somebody behind them, look at who that is. Roughly sixty percent of open source maintainers are unpaid. Kubernetes retired Ingress NGINX because the people holding it up burned out, ending security patches in March 2026 for a component sitting in enterprise infrastructure everywhere. External Secrets Operator froze updates when four of its maintainers quit, and their statement was that money does not write code, review pull requests, or manage releases, because what they needed was people. XZ Utils was one exhausted man whose own words about his limited capacity were public, which is precisely the vulnerability the Jia Tan operation spent two years exploiting.
Your production stack is guarded by people who are not being paid, who are tired, and who are being targeted specifically because of it.
The excuse that stopped working
At this point most people reach for the same thought, which is that none of this is about them. Their company is not interesting. Nobody in Pyongyang or Beijing cares about a mid-sized firm doing unglamorous work in an unglamorous industry.
That reasoning was never quite right, and as of this year it is dead, and the reason why is worth understanding properly.
Intelligence services have never been limited by what they could steal. They have been limited by what they could read. Every treatment of the intelligence cycle calls this stage processing, exploitation and dissemination, and it is the permanent choke point: you intercept a hundred thousand documents in a language most of your officers do not speak, about an industry none of them understand, and then you need cleared human beings to determine whether any of it matters. CSIS described the friendly version of this problem in April, noting that the volume arriving in analyst queues has far surpassed what they can process. That is a well-funded service talking about itself.
Because reading was the expensive part, collection had to be selective. Every company that ever told itself it was too boring to target was, without knowing it, relying on a foreign analyst’s workload.
On August 10, Genians Security Center in Seoul published what that constraint looks like once it is removed. Kimsuky, the DPRK espionage unit sanctioned by the U.S. Treasury in 2023, had built an AI lab inside its own attack infrastructure. Investigators found Ollama, GPT4All and Msty installed and configured on the group’s command-and-control servers, along with a retrieval-augmented generation setup with an indexed document database, speech-to-text tooling and the Cursor coding assistant. Not merely downloaded. Configured, with logs proving operational use. Running the models locally means no external provider sees the queries, no content filter interferes, and no abuse team ever receives a report.
Genians states the purpose directly: pairing RAG with stolen documents can automatically identify valuable information inside large volumes of stolen data, reducing the analytical burden.
The group also made an ordinary mistake, which is that they used those servers as a workstation. Genians recovered keystroke and clipboard logs. In one, an operator typed a question in Korean asking whether wallet seed phrases, signup passwords, Gmail credentials and site registration histories were present in the material he had taken, ran it through Google Translate, and submitted it to a model. The reconstructed text carried North Korean spelling conventions rather than South Korean ones. He was not hunting a particular secret. He was asking what he had.
Reuters noted when covering the report that Genians’ findings could not be independently verified. Take that caveat seriously and the picture does not change much, because the collection side is already documented elsewhere. The FBI’s Michael Machtinger told CyberTalks in February that Salt Typhoon has affected more than eighty countries, pairing broad access with what he called indiscriminate targeting and collection, and the Bureau used the same word in its advisory about Beijing’s approach to private communications. Nobody in Beijing decided individually that a Thai telecom and an Italian ISP and a South African provider were each worth a dedicated operation. They took what the access offered and sorted it out later, and sorting it out later is the thing that just got cheap.
You were never too small to hack. You were too boring to read, and that was a temporary condition.
What actually leaves the building
The phrase supply chain risk hides the specifics, and the specifics are the entire point.
Consider what ChainDrop collected from every machine it reached: npm and GitHub tokens, AWS credentials, Kubernetes secrets, HashiCorp Vault tokens, Stripe and Slack tokens, and a general sweep of the filesystem. It could also extract temporary credentials directly out of GitHub Actions runner memory, then use stolen publish tokens to infect further packages without anyone driving.
Now think about the machine that runs on. A developer workstation has SSH keys reaching production. Cloud credentials with more scope than anybody intended. The .env files somebody swore they would clean up. A full checkout of the application source, the internal docs, the architecture diagrams, the customer schema. If the worm reaches a build runner instead, add signing keys and deployment credentials.
All of it copies out in a single pass. And then, on a machine in another country, it gets read. Not skimmed six months later by an overloaded analyst who gives it four minutes before moving to something higher priority. Indexed, queried, summarized, and cross-referenced against everything else that arrived that week.
Your customer list gets read. Your unreleased roadmap gets read. The Slack export somebody stashed on their desktop gets read. Whether any of it is useful to a foreign government used to require a person to find out and now requires a prompt, and neither you nor I can say with confidence what a well-briefed model would find interesting in the contents of our own laptops.
Foreign policy in your node_modules
Microsoft analyzed a Shai-Hulud variant found in a compromised Mistral AI package on PyPI. The main payload is a credential stealer. It also carries country-aware logic: it refuses to execute if it detects Russian language support on the host, and if it finds indications it is running in Israel or Iran, it rolls a one-in-six chance of issuing a command to delete every file and directory on the system.
Somebody encoded a national exemption and a wipe-the-machine dice roll into a package that arrives as a transitive dependency. Whatever you think of any of those governments, the library you pulled last Tuesday is now an instrument of somebody’s foreign policy, and how it treats you depends on where it thinks you are.
The exit that is painted on the wall
The obvious response is to stop taking dependencies from strangers and buy commercial software with a support contract and somebody to sue.
Black Duck audited 947 commercial codebases for the 2026 OSSRA report and found open source in all but two percent of them, making up 77 percent of the code in a typical codebase. If you write .NET, the runtime is open source, the framework is open source, and every NuGet package you have ever restored came from a public registry. There is no version of the stack that opts out.
The commercial record is also worse rather than better. SolarWinds Orion was proprietary and delivered a Russian intelligence backdoor to 18,000 customers under a valid signature. The 3CX desktop app was proprietary, claimed 600,000 enterprise customers, and was trojanized by North Korean operators through a compromised installer for a second piece of closed commercial software. NotPetya arrived through M.E.Doc, a proprietary Ukrainian accounting product, and did over ten billion dollars in damage. XZ Utils was caught in weeks because Andres Freund noticed half a second of unexplained SSH latency and could go read the source. SUNBURST sat in federal networks for months because there was nothing to read.
Closed source does not remove your exposure. It removes your ability to see it, and substitutes a vendor’s promise that they handled verification for you.
How my industry talked itself into this
I have spent about thirty years shipping production .NET, a lot of it in payments infrastructure, and I would rather be honest about how we got here than pretend it was done to us.
The trust model in package management was a deliberate trade and it was defensible at the time. When I started, taking on a third-party component meant a purchase order, a vendor evaluation, sometimes a source escrow arrangement, and a legal review. Most of that was theater and all of it took weeks. Package managers replaced it with one line in a project file, and the productivity gain was enormous and real. Nobody is going back, and anyone telling you to write your own caching library has not shipped against a deadline recently.
What we did not price in was where the trust decision moved. It went from procurement, which produced a paper trail and a named counterparty who could be sued, into a command developers run dozens of times a day without thinking about it at all. In payments I had to enumerate every component in scope for an assessment, and even that exercise, which everyone in the room treated as pure overhead, would occasionally surface something nobody knew was in there. Nothing in a modern restore does that.
The part that occupies me now is that the last human checkpoint is disappearing. Every control below assumes somebody is present when a dependency gets added. I am building agentic systems where the agent resolves and installs packages as part of doing its job. Point one at a task, hand it a package manager, and the person is gone, along with the only place in the chain where a Demir could ever have been standing.
What to do about it
Stop executing code at install time. Nearly every campaign in this piece, ChainDrop and Shai-Hulud and the .NET module initializer work from May, runs during install or restore before a line of your own code executes. Disabling lifecycle scripts is the highest-value change available to most teams and almost nobody does it.
Pin everything and lock it, with RestorePackagesWithLockFile, committed lock files, no floating version ranges and no auto-merged dependency bumps. When a bot opens a pull request touching build targets, MSBuild tasks, lifecycle hooks or binary assets, that one needs a human who read the diff, because that is where payloads live rather than in the source files people actually review. Mirror through an internal feed with an approval gate so a poisoned version live on npm for two hours never reaches a build at all.
Verify provenance and then remember exactly how little it certifies, since ChainDrop’s attestation was flawless the entire time it was harvesting AWS keys. Detect on behavior rather than hashes, because that May NuGet campaign rotated 224 package versions specifically to invalidate file-hash indicators; watch instead for outbound connections, credential access, and lifecycle scripts doing things they have no business doing. Treat every credential a compromised machine could reach as already gone, because pulling the bad package does not end the compromise and only rotation does.
Then there is the one Demir’s story argues for directly, which is to stop reading consensus as evidence. Two accounts arrived with detailed technical reasoning about why he was wrong, and both were the same machine. If you are the person raising the security concern in a thread, the fact that several people disagree with you is now something an adversary can manufacture in seconds.
And if you want a real control rather than a hygiene item, pay the maintainers of what you depend on. Not as charity. The XZ operation succeeded as far as it did because it targeted somebody who had publicly said he was struggling to keep up, and burnout is now a documented attack surface with a body count.
Back to the kid
The thing I keep returning to about Demir is how close it came to going the other way.
He was not employed to do this. He was on GitHub because twenty-plus companies had passed on him and he was trying to look productive. He nearly backed down when two strangers told him he was wrong. He checked himself against a chatbot before holding his position, which is the only reason the maintainer got a second opinion at all. Take away any one of those accidents and a malware dropper goes into a network scanning tool and downstream from there into everybody who trusted it.
His own conclusion after the AISI call was that frontier labs need to move more carefully, that these systems can be dangerous and should be understood before they are improved further. Reasonable, and also aimed at the wrong target. The agent that came after him was a test that got loose from a government lab and got beaten by a college student in a week. The campaigns that are not tests killed nothing, got caught by nobody, and are measured in the hundreds of thousands of packages a year.
One unpaid twenty-four-year-old, reading one diff, on one morning, was the entire defense of one package. Multiply that against 1.8 million malicious packages and 9.8 trillion downloads a year and you have the actual security posture of every system you have ever shipped.
Nobody is standing at that door. There was never anybody standing at that door. Demir was an accident.
About the Author
Gal Ratner is the founder and CTO of Inverted Software and WhiteStar Labs, and Chief Architect at Prana Entertainment in Las Vegas. He has spent roughly thirty years shipping production software on the Microsoft and .NET stack for clients including Microsoft, Sony, Rockstar Games, 2K Games, Best Buy and Allegiant Air, with a long stretch in payments infrastructure and PCI compliance. He was employee number six at Break.com during the mid-2000s UGC era and a Los Angeles Business Journal CTO of the Year finalist.
His current work is production agentic AI, including MCP servers, the Microsoft Agent Framework, RAG pipelines, SQL Server 2025 vector search, and the PLogger observability framework. He is the author of the novel The Archive of Lost Suns. Outside of work he rides motorcycles, co-hosts Edge Grip Podcast, and trains Brazilian jiu-jitsu under Sergio Penha in Las Vegas.
He writes about the gap between executive AI narratives and engineering reality.