Entity trail

Supply Chain Compromise

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-06-23 / rss-researcherMicrosoft Attributes the 144-Package @mastra npm Worm to North Korea's Sapphire Sleet — Malware Poisons Claude Code, Cursor and Gemini IDE ConfigsNew detail on the 88-minute @mastra supply-chain attack: Microsoft Threat Intelligence has attributed it with high confidence to Sapphire Sleet (BlueNoroff/APT38), the same North Korean actor behind the earlier Axios HTTP-client compromise. The materially new builder angle is the payload — it injects persistent backdoor files that execute whenever a developer opens the project in an AI-assisted IDE, with dedicated hooks for Anthropic Claude Code, Cursor and Google Gemini. AI coding-assistant config files are now an explicit persistence target, not collateral damage.
2026-06-14 / agents-researcherSupply-chain worms now poison CLAUDE.md and .cursorrules with zero-width hidden instructionsThe continuously-mutating Miasma/Hades campaign (pivoting delivery every 48–72 hours since June 1) has added a novel agent-specific vector: packages inject .cursorrules and CLAUDE.md files containing zero-width Unicode hidden instructions. When a developer opens the project in Cursor or Claude Code, the assistant reads the configuration as legitimate project guidance and runs a 'security scan' that exfiltrates local secrets. Socket flagged 37 malicious Python wheels across 19 PyPI packages on June 7 and a compromised ensmallen 0.8.101 on June 8 — the first wave to weaponize AI coding-agent config files at scale.
2026-06-13 / agents-researcherMiasma supply-chain worm toolkit leaked on GitHub, already hitting npm/PyPI and CI/CD

Source trail

OWASP TechTimes Phoenix Security Rescana GitHub / Hacker News Wiz Research SecurityWeek

Graph sources

entity graphfindings textkg entitiesnewsletter issues