SECURITYOver 140 Mastra npm Packages Hit by Supply Chain Attack
On June 17, 2026, attackers compromised 141 packages in the @mastra npm scope — including @mastra/core (918K weekly downloads), mastra, and create-mastra — by injecting a malicious dependency called easy-day-js, a trojanized clone of the popular dayjs library. Version 1.11.22 of easy-day-js ships a postinstall hook that fetches a second-stage payload from a Hostwinds C2 server at 23.254.164.92:8000, spawns it as a detached background process, and then self-deletes to erase forensic evidence. The running payload collects system information and targets over 160 browser-based crypto wallet extensions including MetaMask, Keplr, and Coinbase, phoning home to 23.254.164.123:443. The attack closely mirrors the March 2026 axios compromise — same postinstall hook abuse, same Hostwinds infrastructure, same clean decoy version followed by a malicious update. Developers using any affected @mastra package should immediately audit installations and rotate credentials.
Read Articlearrow_forward Article · SECURITYREAD TIME: 5m
Multiple JetBrains IDE Plugins Caught Stealing AI API Keys
Aikido Security identified a coordinated malware campaign on the JetBrains Marketplace in which at least 15 IDE plugins, published under seven vendor accounts, secretly exfiltrate AI provider API keys entered in their settings. The plugins — most posing as DeepSeek-powered coding assistants — had accumulated nearly 70,000 installs as of June 2026, with the earliest versions dating to October 2025. When a user enters an API key (from OpenAI, SiliconFlow, DeepSeek, or similar providers) and clicks Apply, a hardcoded save() handler immediately POSTs the key in plaintext to a C2 server at 39.107.60.51 over plain HTTP using a static auth token. The campaign also runs a paid tier in which victims pay a small fee and receive back an API key — likely stolen from other users — turning the operation into a credential resale service. The largest single plugin, CodeGPT AI Assistant, logged 25,571 downloads and DeepSeek AI Assist logged 27,727. JetBrains was notified; developers should audit installed plugins and rotate any API keys entered into these tools.
READ_FULL_LOGarrow_forwardArticle · INDUSTRYREAD TIME: 10m
GitHub Copilot's Pricing Gamble
On June 1, 2026, GitHub abandoned its flat-fee request-based model in favor of usage-based AI credits, effectively passing raw token costs directly to users — functioning more like OpenRouter than a conventional SaaS subscription. Nicholas Zakas, a GitHub Star who had used Copilot Pro+ free for two years, found he burned 33% of his monthly credit allotment in the first week of June on a light schedule, extrapolating to 50%+ on a typical workweek. The shift was made urgent by Copilot's evolution from autocomplete to autonomous multi-agent workflows consuming 10-100x more tokens, compounded by GitHub pushing agentic features — Copilot Code Review, Copilot Cloud Agent, Agentic Workflows, and the new desktop app — all of which draw from the same credit pool asynchronously without clear cost signals. Zakas argues GitHub is making a calculated bet: it expects competitors like Claude and GPT to follow suit before it loses too many users, with both Anthropic and OpenAI likely holding pricing steady ahead of planned IPOs. The gamble may reshape the entire AI tooling market by end of 2026.
READ_FULL_LOGarrow_forwardArticle · AI SECURITYREAD TIME: 6m
AI Agents Are a Confused Deputy with the Keys to Your Kingdom
In early June 2026, attackers took over more than 20,000 Instagram accounts — including the dormant Obama-era White House account — by chatting with Meta's AI support assistant and redirecting recovery emails without any exploit code. Author Fabio Salvadori frames this through the classic "confused deputy" security problem: an AI agent holds real privileges and will act on any plausible natural-language instruction without verifying who is actually making the request. The root fix is not a smarter model — a more capable model behind the same workflow would have handed over the same accounts — but a principal check enforced outside the conversational layer, verifying session identity before any privileged action runs. Salvadori recommends scoped short-lived credentials per action, hard policy gates (not model-generated confirmations) for irreversible operations like payments and account recovery, and full provenance logging of every agent action. With Gartner projecting 40% of enterprise applications will include task-specific AI agents by end of 2026, the blast radius of this engineering gap is growing fast.
READ_FULL_LOGarrow_forwardArticle · SUPPLY CHAINREAD TIME: 6m
400+ AUR Packages Hijacked: What the Atomic Arch Campaign Means for Supply-Chain Security
On June 11, 2026, security researchers disclosed the "Atomic Arch" campaign in which attackers systematically adopted orphaned Arch User Repository (AUR) packages and injected a malicious npm dependency — atomic-lockfile — into their PKGBUILDs, ultimately compromising more than 400 community packages. The malicious package is a Rust-written credential stealer targeting browser cookies, SSH keys, GitHub tokens, npm tokens, cloud access keys, and Slack/Discord/Teams sessions; on systems with elevated privileges it can deploy eBPF-based rootkit capabilities to hide processes. Directly affected are Arch Linux, Arch-based distributions (EndeavourOS, Manjaro), and self-hosted CI runners or WSL2 environments running AUR packages. Any host where the payload executed as root should be fully rebuilt from clean media with all credentials rotated. StepSecurity notes the broader lesson: ownership-transfer hijacking beats typosquatting and the same attack pattern is visible in npm, PyPI, and GitHub Actions. Teams should monitor build hosts for unexpected network egress and anomalous package manager activity.
READ_FULL_LOGarrow_forwardArticle · AI POLICYREAD TIME: 4m
U.S. Orders Anthropic to Suspend Fable 5 and Mythos 5 Access for Foreign Nationals
The U.S. government ordered Anthropic on June 15, 2026 to immediately disable Claude Fable 5 and Mythos 5 for all foreign nationals, citing a potential jailbreak that may have been exploited by a group linked to China. Anthropic received the directive at 5:21 p.m. ET and complied, though it contested the basis, arguing the alleged bypass — described as asking the model to read a codebase and fix software flaws — represents capability already available from other public models including OpenAI's GPT-5.5. Mythos 5, which has relaxed safeguards for cybersecurity use cases, had been disclosed days earlier as capable of converting N-day vulnerabilities into working exploits in hours. Reports from The Information, Reuters, and The Wall Street Journal attributed the government action partly to research conducted by Amazon and concerns raised by CEO Andy Jassy with the White House. Anthropic maintains that no universal jailbreak against Fable 5 exists and is working to restore access.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 4m
AutoJack Attack Lets One Web Page Hijack AI Agent for Host Code Execution
Microsoft researchers detailed AutoJack, an exploit chain against AutoGen Studio's MCP WebSocket handler that achieves host-level remote code execution without credentials or user interaction beyond loading an attacker's URL. The attack chains three flaws: the WebSocket trusted any connection from localhost (meaning a browsing agent on the same machine inherits that trust), authentication middleware skipped MCP paths assuming the handler would verify tokens (it never did), and the endpoint executed commands taken directly from request parameters with no allowlist. AutoGen Studio's stable PyPI release 0.4.2.2 has no MCP route and is unaffected; however, pre-release builds 0.4.3.dev1 and 0.4.3.dev2 — neither yanked from PyPI — contain the vulnerable handler. The fix is in GitHub main at commit b047730 (PR #7362), where commands are stored server-side behind a one-time session ID. Until a patched PyPI release ships, users of the pre-release should pull from GitHub main; those running the stable build are not at risk. Microsoft noted the same architectural pattern — a privileged local service trusting localhost — exists in other agent frameworks, pointing to CVE-2026-26030 and CVE-2026-25592 in Semantic Kernel as related prior work.
READ_FULL_LOGarrow_forwardsummarizeDigest_Summary
Week 25 brought a wave of interconnected security crises across the supply chain, AI infrastructure, and developer tooling. The @mastra npm scope suffered a coordinated supply chain attack on June 17: 141 packages including @mastra/core (918K weekly downloads) were poisoned via easy-day-js, a trojanized dayjs clone, whose postinstall hook fetched a second-stage payload targeting over 160 browser crypto wallet extensions including MetaMask, Keplr, and Coinbase. The attack closely mirrors the March 2026 axios compromise — same Hostwinds infrastructure, same postinstall abuse pattern. On the same day, Aikido Security exposed at least 15 JetBrains Marketplace plugins under seven vendor accounts that exfiltrate AI provider API keys (OpenAI, SiliconFlow, DeepSeek) in plaintext to a C2 server at 39.107.60.51 via a hardcoded save() handler the moment a user clicks Apply — with nearly 70,000 cumulative installs led by DeepSeek AI Assist (27,727) and CodeGPT AI Assistant (25,571).
AI governance made headlines when the U.S. government ordered Anthropic on June 15 to immediately suspend access to Claude Fable 5 and Mythos 5 for all foreign nationals, citing a potential jailbreak possibly exploited by a China-linked group. Anthropic complied but contested the order, arguing that asking a model to read a codebase and fix software flaws represents capability already available in GPT-5.5. Mythos 5, which has relaxed safeguards for cybersecurity use cases, had been disclosed as capable of converting N-day vulnerabilities into working exploits in hours.
The Atomic Arch campaign (disclosed June 11) added another supply chain data point: attackers adopted orphaned AUR packages and injected atomic-lockfile — a Rust credential stealer targeting SSH keys, GitHub tokens, npm tokens, cloud access keys, and browser sessions — affecting 400+ community packages across Arch Linux, EndeavourOS, and Manjaro. StepSecurity noted that ownership-transfer hijacking outperforms typosquatting and the same pattern appears in npm and PyPI. GitHub Copilot's pivot from flat-fee to usage-based AI credits, effective June 1, also drew scrutiny: one GitHub Star burned 33% of monthly credits in a light first week, with agentic features like Copilot Code Review, Cloud Agent, and the new desktop app all drawing from the same pool.
Key Takeaways- The @mastra npm supply chain attack (141 packages, 918K weekly downloads for @mastra/core) used a trojanized dayjs clone via postinstall to target over 160 crypto wallet browser extensions — rotate credentials immediately if any affected package is installed.
- 15 JetBrains Marketplace plugins across 7 vendor accounts exfiltrate AI API keys in plaintext to a C2 server the moment users click Apply; audit installed plugins and rotate any keys entered into these tools.
- The U.S. government ordered Anthropic to suspend Fable 5 and Mythos 5 for foreign nationals citing a potential jailbreak; Anthropic is contesting the order and working to restore access.
