Today’s digest is about trust that travels further than anyone accounts for — a maintainer’s GitHub session, a proxied AI prompt, a product-lifecycle server nobody patched fast enough. Each incident shows attackers taking something you’d assume stays local and turning it into leverage somewhere else entirely. Here’s what changed since yesterday’s digest.
Supply chain watch: a hijacked maintainer account turns the keyv npm family into a credential-stealing worm that plants Claude Code and VS Code hooks
Attackers compromised the GitHub account behind keyv, a key-value storage library with roughly 127 million weekly npm downloads, and used it to publish a malicious [email protected] release at 09:35 UTC on August 4. A hidden preinstall script deployed a 727,680-byte payload that harvests GitHub tokens, cloud credentials (AWS, GCP, Azure), private keys, and database connection strings from developer machines and CI runners, then used any publishing access it found to spread itself further. Because the same maintainer also owns cacheable, flat-cache, file-entry-cache, and several other widely used caching utilities, the worm swept up that entire family within roughly 30 minutes — SafeDep’s monitoring put the confirmed footprint at 353 poisoned versions across 79 package names, with Aikido separately reporting a wider footprint of at least 868 packages across 1,381 versions as tracking continued. Beyond credential theft, the payload plants .claude/settings.json and .vscode/tasks.json inside affected repositories — persistence hooks that only fire if a developer opens the workspace and trusts it in Claude Code or VS Code. The Hacker News · SafeDep · Aikido
Pin dependency versions and audit your lockfile diffs today if you touch keyv, cacheable, flat-cache, or file-entry-cache — a package.json bump alone won’t tell you whether you pulled a poisoned release before the maintainer’s account was recovered. The workspace-trust hooks are the detail worth flagging to your dev team specifically: a repo that looks clean in a diff review can still carry a dormant IDE-level implant that only activates once someone opens it locally and clicks “trust.”
AI security watch: a service called Poison Claude resells discounted model access while its operator reads every customer prompt
Researchers identified more than half a dozen underground services advertising illicit access to commercial AI models, the most notable being Poison Claude, which claims to offer Anthropic models — including Opus 4.8, Opus 4.7, Opus 4.6, and Sonnet 4.6 — at 5–15% of official per-token pricing. The economics run on free-tier abuse: the service farms bonus credits such as AWS Bedrock’s $100 sign-up credit across large numbers of fraudulently created accounts, then routes paying customers’ API calls through that pool of accounts, issuing buyers keys compatible with standard Anthropic tooling. Because every request has to transit Poison Claude’s own proxy infrastructure before reaching the upstream model, the operator sits in a position to collect, retain, or resell whatever customers send it — source code, credentials pasted for debugging, internal documents, anything a buyer’s own customers put in a prompt. Payments are accepted only in cryptocurrency. Researchers at Okta, who surfaced the campaign, notified Cloudflare, Anthropic, AWS, and Google Cloud of the infrastructure and abuse patterns identified. The Hacker News · Okta Threat Intelligence
If anyone on your team — or in a business unit you don’t have full visibility into — is routing production or customer data through a suspiciously cheap “AI API” reseller instead of a vendor’s own endpoint, that traffic is a full-content interception point, not a cost optimization. Treat unmanaged LLM proxies the same as any other unvetted data processor: block them at the network egress level and route AI usage through accounts you provision and monitor directly.
Ransomware watch: Clop extorts a new victim through hex-named JSP web shells on PTC Windchill and FlexPLM
Clop-affiliated actors posted a new victim to their leak site on August 5, referencing CVE-2026-12569 — a critical, unauthenticated deserialization RCE (CVSS 9.8) in PTC Windchill PDMlink and FlexPLM — and claiming exfiltration of database and project data. The group first weaponized the flaw as a likely zero-day in early June, chaining it with a separate pre-authentication information-disclosure bug in the FlexPLM WSDL endpoint (CVSS 7.5) to reach unauthenticated systems, then deploying hex-named JSP web shells under the /Windchill/login/ directory to hold access and stage exfiltration. PTC began shipping patches on June 17, and CISA added the vulnerability to its KEV catalog with a three-day federal remediation deadline shortly after. Two months later, Clop is still finding unpatched, internet-exposed instances to extort. BleepingComputer · The Hacker News
Windchill and FlexPLM aren’t typical perimeter software, which is exactly why they linger unpatched — PLM platforms tend to sit outside routine vulnerability-management cycles even though they hold design files and supply-chain data attackers know how to monetize. If you or a customer runs either product, confirm the June patch is actually applied rather than just scheduled, and check web server logs for hex-named JSP files under /Windchill/login/ regardless of patch status — Clop’s continued success two months out means initial compromise may already have happened before remediation closed the door.
Final thought
A compromised maintainer session, a prompt routed through someone else’s proxy, a patch that shipped but never got applied — none of these are exotic techniques, they’re just trust extended one hop further than anyone tracked. Dependency pinning, AI usage governance, and honest patch-compliance auditing are unglamorous, but they’re what closes each of these gaps. If you want help figuring out where trust is quietly extending past your visibility, see our how-to guides or book a discovery call.