Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Notes

Scout 3, Software supply chain, run 2026-11-10T1415Z

Started 2026-11-10T14:19Z. Ended about 14:40Z (container clock; WebFetch read times are given to the nearest few minutes and fell inside that window).

Every claim below is reported by the page named, never an observation by Lighthouse. Before fetching I ran scripts/robots_gate.py for each URL (provider anthropic). Searches are leads; results I did not open are named under "Not opened or refused".

Searches

  1. "npm supply chain attack worm compromised packages November 2026": no November 2026 item. Returned the August ChainDrop write-ups (Microsoft, TechRadar, cyberexperts), SecurityWeek on SANDWORM_MODE and Mini Shai-Hulud waves, eSecurityPlanet. The search tool itself said the November hits were 2025.
  2. "PyPI malicious packages quarantined compromised maintainer November 2026": no November item. Returned the June Hades/Miasma wave, March LiteLLM, May durabletask.
  3. "@ethersphere/bee-js 13.3.0 compromised npm SleepyDuck Swarm Desktop": found nothing (the index had not caught it). I then got the primary from StepSecurity's blog listing (source 16).
  4. "LiteLLM secret-stealing workflows ran 11 days before supply chain attack Socket": Socket's timeline post, THN, Help Net Security, CSO, BleepingComputer, eSecurityPlanet ("2,500 organizations", not opened), BankInfoSecurity.
  5. "GitHub package firewall public preview npm PyPI cooldown malware": GitHub changelog 20 October, Visual Studio Magazine, DevOps.com, THN, Help Net Security, Endor Labs, others.
  6. "Socket malicious bee-js npm release Swarm Desktop SleepyDuck backdoor": nothing on bee-js; older SANDWORM_MODE, node-ipc, JFrog and Unit 42 pieces.
  7. "Shai-Hulud descendant Ruby gem steals credentials poisons AI tools Socket": Socket's strutil-core post plus gemstuffer, SANDWORM_MODE and 60-malicious-gems posts, Tensorlake.
  8. "Hugging Face malicious models agent skills registry malware report November 2026": no November report; CSA notes (May, October), Acronis and Koi counts of malicious OpenClaw skills, Snyk ToxicSkills.
  9. "arrayref crates.io supply chain attack Rust blog August 2026": Rust blog, StepSecurity, Wiz (DPRK overlap), THN, linuxiac, Gridinsoft.
  10. "StepSecurity ethersphere bee-js compromised Swarm Desktop wallet npm": no bee-js hit; node-ipc, jscrambler and Joyfill (July) compromises.
  11. "AI coding agent installed malicious package hallucinated dependency slopsquatting real-world incident": CSA (19 April), Endor, Xygeni, BleepingComputer on "HalluSquatting"; search summary mentions react-codeshift (January, 237 repositories). None opened.
  12. "npm trusted publishing provenance abused ... 2026": Help Net Security (Bloom flaw, 13 October), BoostSecurity (Red Hat), Infosecurity (GHAPPIER), StepSecurity 7nohe, Socket 7nohe, TanStack post-mortems.
  13. "PyPI malware reports OSV MAL advisories count October 2026 statistics": safeguard.sh three-day count, OpenSSF tag page, GitHub blog "malware advisories beyond npm", Security Boulevard (2025 totals).
  14. "Hugging Face Pluto Security malicious repositories takedown agent search ranked first README-only": BleepingComputer, Daily Security Review, aicybr, hackernoon, runtimewire; nothing on the README-only or search-ranking claim.
  15. "Open VSX OR VS Code marketplace malicious extensions AI agent configuration worm November 2026": GlassWorm (Oct 2025 to March 2026), Aqua Trivy extension (February); nothing from November.

Sources read

All by WebFetch on 2026-11-10 (status "fetched" unless noted). Read times are UTC, nearest few minutes.

# URL Read (UTC) Status Page date Claim reported New?
1 https://socket.dev/blog 14:24 fetched undated; newest items Socket's listing leads with "Malicious bee-js npm release and Swarm Desktop releases" delivering the "SleepyDuck Ethereum C2 backdoor", then the Ruby gem descendant, the pull_request_target block and Composer cooldowns. seen (page); new items
2 https://www.aikido.dev/blog 14:24 fetched to 2026-11-05 No post since 5 November; newest are "Even gem list can run someone else's code" and "Deleting a leaked key from your repo doesn't protect you" (both 5 Nov). seen
3 https://blog.pypi.org/ 14:24 fetched latest 2026-11-06 No PyPI incident post since 6 November; 26 October raised limits for organisation projects; 14 October moved developer docs; 8 September an August file-hosting incident report. seen (page), nothing new since
4 https://github.blog/changelog/label/supply-chain-security/ 14:24 fetched to 2026-11-03 New entries: 3 November Dependabot for Agent Package Manager and Python 3.15; 28 October reachability-based alert priority; 20 October "package firewall is available in public preview". seen (page); new items
5 https://www.stepsecurity.io/blog 14:25 fetched 2026-10-26 to 2026-11-08 Eight posts, incl. 8 Nov "Compromised @ethersphere/bee-js 13.3.0" and 3 Nov a "Malicious Files" tool for leftovers of attacks. seen (page); new items
6 https://www.socket.dev/blog/litellm-attack-timeline 14:28 fetched 2026-10-23 Socket found a secret-stealing workflow added at 22:11 UTC on 10 October on a branch deleted the same day, "11 days" before the 21 October release; LiteLLM traced entry to a master key "accidentally committed to a public repository in May and never revoked". new
7 https://thehackernews.com/2026/10/leaked-litellm-master-key-let-attackers.html 14:28 fetched 2026-10-24 PyPI quarantined 1.107.0 at 13:23 UTC on 21 October, 1 h 44 min after the 11:39 UTC upload; the two-engineer approval rule "had been relaxed shortly before the attack"; no count of affected installs given. new
8 https://github.blog/changelog/2026-10-20-github-package-firewall-in-public-preview 14:28 fetched 2026-10-20 (edited 21 Oct) A policy proxy for Enterprise Cloud with a configurable cooldown and advisory check: "Currently the package firewall only supports npm packages." new
9 https://www.helpnetsecurity.com/2026/10/28/github-package-firewall-npm 14:35 fetched 2026-10-28 The firewall blocks "known malware, critical vulnerabilities, and brand-new versions"; gives no cooldown default and no numbers on how long malicious packages stay up. new
10 https://socket.dev/blog/shai-hulud-descendant-malicious-ruby-gem 14:30 fetched 2026-11-06 (updated 9 Nov) Gem strutil-core 1.0.1 published 1 Nov 04:05 UTC, flagged "70 seconds after publication", removed about five hours later; the payload writes SessionStart hooks, MCP entries and AGENTS.md/CLAUDE.md files; "We have not confirmed any successful downstream publication from this gem." new
11 https://www.stepsecurity.io/blog/ethersphere-bee-js-13-3-0-compromise 14:34 fetched 2026-11-08 to 09 A postinstall script in bee-js 13.3.0 (npm, 00:09:50 UTC on 9 Nov) fetched code and took Swarm Desktop wallet keystore data; it was published through an existing trusted-publishing workflow so it "carries valid SLSA provenance"; no AI or self-propagation element described. new
12 https://www.stepsecurity.io/blog/claude-code-extension-trojanized 14:34 fetched 2026-10-30 Builds 2.1.312 and 2.1.313 reached Cursor's marketplace on 29 Oct, exposure 09:27 to 20:35 UTC, "at most 5,000 Cursor users"; persistence by SSH key and reverse tunnel. Cursor's marketplace was taken offline at 20:35 UTC. new URL (event seen via Socket on 7 Nov)
13 https://blog.rust-lang.org/ 14:31 fetched to 2026-11-03 Security posts since August: 20 Aug "Supply chain attack on arrayref", 17 Sep "Be alert: targeted attacks on prominent Rustaceans", 21 Sep "GitHub Actions leaking secrets when Miri output is cached". new
14 https://blog.rust-lang.org/2026/08/20/supply-chain-attack-on-arrayref/ 14:34 fetched 2026-08-20 Three crates' malicious versions were live 86, 90 and 107 minutes (deleted 08:41, 09:04, 09:25 UTC); the post gives no download count. new
15 https://blog.rust-lang.org/2026/09/21/github-actions-leaking-secrets-miri/ 14:34 HTTP 404 n/a Page not found at the URL guessed from the listing. Observation only. new
16 https://rubygems.org/blog 14:31 HTTP 404 n/a Blog path not found. Observation only. new
17 https://socket.dev/blog/ethersphere-bee-js 14:30 HTTP 404 n/a A guessed path; not found. Observation only. new
18 https://huggingface.co/blog 14:31 fetched to 2026-11-09 No post on malware or scanning; 3 Nov "CWE-bench v2" (tagged security, evaluation). new
19 https://openssf.org/blog/ 14:32 fetched to 2026-11-09 Nothing on malicious packages; 9 Nov "The AI Security Gap Hiding in Routine Maintenance" says AI tools are "adding dependencies faster than teams can review them" (summary). new
20 https://ossf.github.io/malicious-packages/stats 14:36 fetched "Last updated: 2026-11-10T00:34:19+00:00" Chart page with all.json and all.csv data links; the fetch returned no totals. seen (repository), page new
21 https://helpnetsecurity.com/2026/10/13/slugfest-npm-trusted-publishing-flaw 14:35 fetched 2026-10-13 Bloom Security: npm trusted publishing bound repositories by name not ID, "more than 1,500 npm packages" exposed; "not known whether anyone exploited" it. new
22 https://safeguard.sh/resources/blog/106-malicious-npm-and-pypi-packages-october-2026-what-they-did-and-how-to-block-the-next-batch 14:36 fetched 2026-10-30 GitHub's advisory database published 112 malware advisories for 106 packages (96 npm, 10 PyPI) on 26 to 28 October; one npm package's record says it writes .claude/settings.json hooks and CLAUDE.md; PyPI claudeopus* names borrow a model brand as a lure. Vendor blog; counts "a moving target". new
23 https://labs.boostsecurity.io/articles/trusted-publishing-untrusted-branch-red-hat-npm 14:36 fetched 2026-06-01 A compromised maintainer account pushed a counterfeit workflow to short-lived branches; npm trusted publishing "checks the workflow filename, not the branch", so malicious releases carried valid provenance. Background, five months old. new

Pages opened: 23 requests, 20 returned content, 3 returned HTTP 404.

Not opened or refused

  • Not fetched: robots.txt: https://www.bleepingcomputer.com/tag/supply-chain-attack/ (the gate named ClaudeBot, "Disallow: /"); https://www.bankinfosecurity.com/exposed-litellm-key-enabled-pypi-supply-chain-attack-a-33211 (disallowed). I used only their search snippets, as leads.
  • Search results seen, not opened: Microsoft's ChainDrop post (4 Aug), Wiz's arrayref piece, StepSecurity's arrayref piece, CSA slopsquatting note, BleepingComputer "HalluSquatting", Pluto Security's report and press coverage of the Hugging Face miner, Acronis and Koi counts of malicious OpenClaw skills, GlassWorm write-ups, Infosecurity on GHAPPIER, TanStack post-mortems, eSecurityPlanet "2,500 organizations" on LiteLLM, GitHub blog "malware advisories beyond npm", Socket's PHP/Chainguard embargo and Rails posts (scout 2's ground).
  • Not found: no source I opened or saw reports a November 2026 PyPI malware wave, a new Shai-Hulud wave since 1 November, or any crates.io incident since August. Absence here is one scout's reading on one day and means little.
  • PyPI's JSON API was not used (disallowed to Lighthouse).

Five best leads

  1. Dated clocks for the three October and November registry compromises (LiteLLM 21 Oct, the Claude Code extension 29 Oct, bee-js 9 Nov). Sources 6, 7, 11 and 12 give timestamps to the minute for upload, report and quarantine or takedown (LiteLLM: 11:39 upload, 12:06 report, 13:23 quarantine; the extension: 09:27 to 20:35 exposure). Why it matters: the charter's question needs how far automated installers, CI jobs and agents pull a bad release before a human stops it; these are three recent cases with published windows. Fits an active investigation: yes, the software-update work (release spread) and what AI activity costs the shared internet, since the LiteLLM and extension victims are AI tooling. Lost if nobody looks: bee-js hourly download counts and the registry's version history are best read within days to weeks (the window is roughly now to late November); LiteLLM's hourly counts from ClickPy or pypistats should still be available, but mirror and image-cache traces fade.
  2. Registry trust signals that cannot tell a malicious release from a real one. Sources 11, 21 and 23: bee-js 13.3.0 carried valid SLSA provenance through an existing trusted-publishing workflow; Bloom's name-reuse flaw exposed more than 1,500 packages; the Red Hat case used a throwaway branch. Why it matters: it shows how a stolen credential can publish through legitimate infrastructure, which is the path any self-propagating activity would use. Fits: yes, software updates (how fast do consumers adopt a release, and does provenance change that). Lost if nobody looks: low urgency for the flaw itself, but whether trusted-publishing configurations expire is a one-off change (GitHub's 2 October rule, 48 hours) with a before and after that is easiest to see now.
  3. Worm payloads that write into AI agent configuration, and the one report that says it never spread. Source 10 (strutil-core, 1 Nov, removed in about five hours, "not confirmed any successful downstream publication") and source 22 (an npm record writing .claude/settings.json hooks and CLAUDE.md). Why it matters: it is the cleanest example of residue that tells agents to run something, in repositories, with the report itself saying spread was not seen; it separates capability from observed propagation, which is the charter's distinction. Fits: partly, it extends the registry-worm timeline (LH041) with the November entries, and "AI activity" only as a target, not an actor. Lost if nobody looks: the dated records at ossf.github.io/malicious-packages (updated 10 Nov 00:34 UTC) persist, but committed config files in public repositories are deleted within hours or days (window: weeks).
  4. GitHub's package firewall (npm only, Enterprise Cloud, preview since 20 October) and PyPI's own controls as a change in how fast installs can be blocked. Sources 8, 9 and 3 (PyPI's 14-day upload rule from 22 July; no new control since). Why it matters: a cooldown between publish and install changes how much of the shared registry traffic a bad release can reach, and it names agents and CI hosts as its targets. Fits: yes, software updates, as a policy-change counterfactual. Lost if nobody looked: no, the preview is open-ended, but adoption cannot be seen from outside; worth watching for a general-availability date and for PyPI support.
  5. The malware-advisory flow as a daily instrument (GitHub advisory database, OSV and OpenSSF). Source 22 counted 112 malware advisories in three days (96 npm, 10 PyPI) and notes that "89 of the 112" carry only standard text; source 20 offers all.csv with an update timestamp. Why it matters: it is a public, dated record of how much automated or opportunistic malware reaches the registries, and it includes AI-brand lures and agent-config writers. Fits: yes, what AI activity costs the shared internet, as a baseline that could show whether agent-aimed lures rise. Lost if nobody looks: advisories are later edited, withdrawn or reworded ("a moving target"), so first-published dates and wording are best captured now and then daily (window: continuous).

From notes/horizon/2026-11-10T1415Z/scout-3-supply-chain.md in the repository, last changed 10 November 2026.