Industry shifts, security alerts, hardware, and AI/ML Compiled for immediate developer deployment.
calendar_todaysummarizeWeek 12-2026bolt2 CRITICAL
article
TeamPCP Deploys CanisterWorm on npm Following Trivy Compromise
TAG: SECURITY
On March 20, 2026, threat actor TeamPCP deployed a novel self-propagating worm called CanisterWorm across npm, compromising 28 packages in the @EmilGroup scope, 16 in the @opengov scope, and several individual packages including @teale.io/eslint-config and @airtm/uuid-base32. The attack used a three-stage architecture: a Node.js postinstall hook installs a Python backdoor as a systemd user service named pgmon with Restart=always, which then beacons every 50 minutes to an ICP (Internet Computer) canister acting as a censorship-resistant C2 dead-drop. A separate deploy.js worm script, run with stolen npm tokens, auto-discovers and re-publishes all packages under the token owner's scope within seconds. In an upgraded wave, the worm gained the ability to harvest npm tokens from .npmrc files and environment variables, turning every infected developer machine into a new propagation vector. Indicators of compromise include SHA256 hashes for four distinct waves and filesystem artifacts at ~/.local/share/pgmon/ and ~/.config/systemd/user/pgmon.service.
Glassworm Strikes Popular React Native Phone Number Packages in a New Supply Chain Attack
TAG: SECURITY
On March 16, 2026, two widely used React Native npm packages published by AstrOOnauta were backdoored in a coordinated supply chain attack: react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8, which together account for over 134,000 monthly downloads. Both malicious releases added an identical obfuscated preinstall hook (install.js, SHA-256: 59221aa9623d86c930357dba7e3f54138c7ccbd0daa9c483d766cd8ce1b6ad26) that queries a Solana RPC endpoint to retrieve an AES-256-CBC-encrypted second-stage payload. The chain skips machines with Russian locale or timezone settings, then persists on Windows via schtasks and the Run registry key. The recovered third stage is a Windows-focused credential and crypto-wallet stealer targeting MetaMask, Exodus, Trust Wallet, OKX Wallet, Braavos, and others, while also stealing npm and GitHub credentials. It further exfiltrates staged data to attacker infrastructure at 45.32.150.251 and 217.69.3.152, using a Google Calendar URL as an additional indirection layer.
Dependabot Now Detects Malware in npm Dependencies
TAG: SECURITY
GitHub has re-enabled malware alerting in Dependabot for npm repositories, years after pausing the feature in 2022 due to false-positive noise from private packages sharing names with public malicious ones. The redesigned system is opt-in and surfaces malware alerts as a distinct subcategory separate from CVE-based vulnerability alerts, making triage cleaner. Users can enable it via repository, organization, or enterprise security settings, and configurable Dependabot rules allow filtering by malware type, ecosystem, and package scope or name patterns. When activated, Dependabot backfills alerts for existing advisories in the GitHub Advisory Database immediately. Current coverage is limited to npm, but GitHub is actively expanding to additional ecosystems through integration with the OpenSSF Malware Streams project. Organizations using private registries are advised to configure alert rules to reduce false positives.
Mozilla has introduced Kit, a new visual mascot and companion character for Firefox designed to make the browser's privacy-first values tangible during an era of AI-driven web distrust. Kit was created by a human team in collaboration with creative agency JKR and illustrator Marco Palmieri, deliberately not generated by AI. The character appears inside Firefox at onboarding moments, feature discovery prompts, and small wins like completing a settings change, and will also appear on Mozilla's product site, blog, and social media. Kit is intentionally expressionless in the traditional sense — no mouth — relying instead on eyes, posture, and body language for expression, along with a signature tail that carries motion and emotion. Users can set Kit as a new tab wallpaper. Mozilla positions Kit as a signal that Firefox is actively working for users, not against them, as a counterpoint to ad-driven, billionaire-owned browsers.
Windsurf Introduces New Pricing Plans Including a $200/mo Max Tier
TAG: INDUSTRY
Windsurf has overhauled its pricing model, replacing the previous credit-based system with usage-quota plans that refresh daily and weekly. The updated lineup spans Free ($0/mo), Pro ($20/mo), Teams ($40/seat/mo), and a new Max plan at $200/month aimed at power users requiring significantly higher quotas and priority support. The old credit system charged identically for simple and complex requests, discouraging interactive workflows; the new model aims to align cost with actual task complexity. Existing Pro and Teams subscribers are grandfathered at their current price and will receive a free trial week starting March 19, 2026 before the new system takes effect. Users who exhaust their included quota can purchase additional usage at API pricing rates, while free models like SWE-1.5 remain available without extra charges. Add-on credits purchased previously will be converted to equivalent USD amounts for extra usage.
Did Cursor Really Steal Kimi? The Composer 2 Controversy Explained
Theo breaks down the controversy surrounding Cursor's Composer 2 model release, which was marketed as a proprietary coding model but found via API URL inspection to be built on top of Kimi K2.5 by Moonshot AI, without prominent disclosure. Composer 2 achieves frontier-level coding benchmark scores at roughly 10x lower inference cost than Claude Opus 4.6 ($0.50/$2.50 per million tokens vs. $5/$25), enabled by applying approximately 3x more compute in post-training and reinforcement learning on top of the Kimi K2.5 open-weight base. The controversy centers on Kimi K2.5's modified MIT license, which requires displaying attribution for commercial products exceeding 100 million monthly users or $2M monthly revenue. Cursor used Fireworks AI as an inference partner to satisfy license terms indirectly, which Moonshot AI ultimately endorsed. Theo argues Cursor should have been transparent about the base model from the start and warns that incidents like this may discourage open-weight model releases from smaller labs in the future.
TeamPCP Deploys CanisterWorm on npm Following Trivy Compromise
On March 20, 2026, threat actor TeamPCP deployed a novel self-propagating worm called CanisterWorm across npm, compromising 28 packages in the @EmilGroup scope, 16 in the @opengov scope, and several individual packages including @teale.io/eslint-config and @airtm/uuid-base32. The attack used a three-stage architecture: a Node.js postinstall hook installs a Python backdoor as a systemd user service named pgmon with Restart=always, which then beacons every 50 minutes to an ICP (Internet Computer) canister acting as a censorship-resistant C2 dead-drop. A separate deploy.js worm script, run with stolen npm tokens, auto-discovers and re-publishes all packages under the token owner's scope within seconds. In an upgraded wave, the worm gained the ability to harvest npm tokens from .npmrc files and environment variables, turning every infected developer machine into a new propagation vector. Indicators of compromise include SHA256 hashes for four distinct waves and filesystem artifacts at ~/.local/share/pgmon/ and ~/.config/systemd/user/pgmon.service.
Did Cursor Really Steal Kimi? The Composer 2 Controversy Explained
Theo breaks down the controversy surrounding Cursor's Composer 2 model release, which was marketed as a proprietary coding model but found via API URL inspection to be built on top of Kimi K2.5 by Moonshot AI, without prominent disclosure. Composer 2 achieves frontier-level coding benchmark scores at roughly 10x lower inference cost than Claude Opus 4.6 ($0.50/$2.50 per million tokens vs. $5/$25), enabled by applying approximately 3x more compute in post-training and reinforcement learning on top of the Kimi K2.5 open-weight base. The controversy centers on Kimi K2.5's modified MIT license, which requires displaying attribution for commercial products exceeding 100 million monthly users or $2M monthly revenue. Cursor used Fireworks AI as an inference partner to satisfy license terms indirectly, which Moonshot AI ultimately endorsed. Theo argues Cursor should have been transparent about the base model from the start and warns that incidents like this may discourage open-weight model releases from smaller labs in the future.
Glassworm Strikes Popular React Native Phone Number Packages in a New Supply Chain Attack
On March 16, 2026, two widely used React Native npm packages published by AstrOOnauta were backdoored in a coordinated supply chain attack: react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8, which together account for over 134,000 monthly downloads. Both malicious releases added an identical obfuscated preinstall hook (install.js, SHA-256: 59221aa9623d86c930357dba7e3f54138c7ccbd0daa9c483d766cd8ce1b6ad26) that queries a Solana RPC endpoint to retrieve an AES-256-CBC-encrypted second-stage payload. The chain skips machines with Russian locale or timezone settings, then persists on Windows via schtasks and the Run registry key. The recovered third stage is a Windows-focused credential and crypto-wallet stealer targeting MetaMask, Exodus, Trust Wallet, OKX Wallet, Braavos, and others, while also stealing npm and GitHub credentials. It further exfiltrates staged data to attacker infrastructure at 45.32.150.251 and 217.69.3.152, using a Google Calendar URL as an additional indirection layer.
Dependabot Now Detects Malware in npm Dependencies
GitHub has re-enabled malware alerting in Dependabot for npm repositories, years after pausing the feature in 2022 due to false-positive noise from private packages sharing names with public malicious ones. The redesigned system is opt-in and surfaces malware alerts as a distinct subcategory separate from CVE-based vulnerability alerts, making triage cleaner. Users can enable it via repository, organization, or enterprise security settings, and configurable Dependabot rules allow filtering by malware type, ecosystem, and package scope or name patterns. When activated, Dependabot backfills alerts for existing advisories in the GitHub Advisory Database immediately. Current coverage is limited to npm, but GitHub is actively expanding to additional ecosystems through integration with the OpenSSF Malware Streams project. Organizations using private registries are advised to configure alert rules to reduce false positives.
Mozilla has introduced Kit, a new visual mascot and companion character for Firefox designed to make the browser's privacy-first values tangible during an era of AI-driven web distrust. Kit was created by a human team in collaboration with creative agency JKR and illustrator Marco Palmieri, deliberately not generated by AI. The character appears inside Firefox at onboarding moments, feature discovery prompts, and small wins like completing a settings change, and will also appear on Mozilla's product site, blog, and social media. Kit is intentionally expressionless in the traditional sense — no mouth — relying instead on eyes, posture, and body language for expression, along with a signature tail that carries motion and emotion. Users can set Kit as a new tab wallpaper. Mozilla positions Kit as a signal that Firefox is actively working for users, not against them, as a counterpoint to ad-driven, billionaire-owned browsers.
Windsurf Introduces New Pricing Plans Including a $200/mo Max Tier
Windsurf has overhauled its pricing model, replacing the previous credit-based system with usage-quota plans that refresh daily and weekly. The updated lineup spans Free ($0/mo), Pro ($20/mo), Teams ($40/seat/mo), and a new Max plan at $200/month aimed at power users requiring significantly higher quotas and priority support. The old credit system charged identically for simple and complex requests, discouraging interactive workflows; the new model aims to align cost with actual task complexity. Existing Pro and Teams subscribers are grandfathered at their current price and will receive a free trial week starting March 19, 2026 before the new system takes effect. Users who exhaust their included quota can purchase additional usage at API pricing rates, while free models like SWE-1.5 remain available without extra charges. Add-on credits purchased previously will be converted to equivalent USD amounts for extra usage.
Week 12 saw back-to-back critical npm supply chain incidents. On March 16, Glassworm backdoored react-native-country-select@0.3.91 and react-native-international-phone-number@0.11.8 (134,000+ combined monthly downloads) via an obfuscated preinstall hook that fetched an AES-256-CBC payload from a Solana RPC endpoint, skipping Russian locale machines and persisting via schtasks on Windows — a credential and crypto-wallet stealer targeting MetaMask, Exodus, Trust Wallet, OKX Wallet, and Braavos. Four days later, TeamPCP's CanisterWorm hit 44+ packages across the @EmilGroup and @opengov scopes, using a Python backdoor installed as a systemdpgmon service that beacons to an ICP (Internet Computer) canister as a censorship-resistant C2. The upgraded wave harvested npm tokens from .npmrc files, turning every infected developer machine into a propagation vector. GitHub responded by re-enabling Dependabot malware alerting for npm — paused since 2022 — as an opt-in, separate from CVE alerts, backed by OpenSSF Malware Streams integration.
On the industry side, Mozilla introduced Kit, a human-designed (not AI-generated) Firefox mascot by JKR and Marco Palmieri meant to make privacy-first values tangible. Windsurf overhauled pricing from credits to daily/weekly usage quotas, adding a $200/month Max tier. The Cursor/Kimi K2.5 controversy sparked debate about open-weight model attribution: Composer 2 was built on Moonshot AI's Kimi K2.5 without prominent disclosure, raising questions about the modified MIT license's 100M-user attribution threshold and whether opacity around base models discourages open-weight releases.
Key Takeaways
Two critical npm supply chain attacks landed in the same week: Glassworm (Solana-RPC-fetched payload, 134K monthly downloads) and CanisterWorm (ICP canister C2, 44+ packages, self-propagating via stolen npm tokens from .npmrc files).
GitHub re-enabled Dependabot malware alerting for npm (paused since 2022) as an opt-in subcategory separate from CVE alerts, backed by OpenSSF Malware Streams — currently npm-only but expanding.
Cursor's Composer 2 was found to be built on Moonshot AI's Kimi K2.5 without prominent disclosure, reigniting debate over open-weight model attribution requirements and the chilling effect opacity may have on future open-weight releases.
