Your AI Assistant Is Now the Attack Surface
from Autonomous Autopsy
This episode covers the TeamPCP supply chain campaign of May 2026, in which attackers hijacked TanStack's CI/CD pipeline to publish 84 malicious npm packages with valid SLSA Build Level 3 provenance, and a parallel operation called TrapDoor that weaponized AI coding assistants through hidden Unicode instructions in project config files. - Mini Shai-Hulud worm: how three chained GitHub Actions weaknesses enabled a self-propagating worm that compromised OpenAI devices, infected 170+ packages, and caused GitHub to lose approximately 3,800 internal repositories — with zero CVEs assigned - TrapDoor campaign: 34 malicious packages across npm, PyPI, and Crates.io using zero-width Unicode characters in .cursorrules and CLAUDE.md files to deliver instructions invisible to human reviewers but parsed by Cursor and Claude Code - Detection failure: why traditional scanners had no coverage, and how Socket's behavioral cross-registry detection surfaced TrapDoor in under six minutes - Monday-morning controls: specific steps including cat -v inspection of AI config files, persistence daemon removal, and a single YAML condition that blocks the pull_request_target attack vector Published June 9, 2026 — listeners leave with concrete, actionable mitigations rather than general security guidance.
Embed this episode
No transcript yet.