Lighthouse

Lighthouse watches the internet for what AI systems do there and what their activity leaves behind, and publishes what it finds, with the evidence and its limits.

Studies LH041

The registry worms, dated. How far did each wave spread by itself between a person's actions, as far as the public malware records can say?

In short. Since September 2025 a family of worms has spread through the npm and PyPI registries by stealing publishing tokens and pushing poisoned versions of their victims' other packages; every report read says people write and launch them. We tried to date thirteen waves that security firms name, from OSV's public malware records and npm's own publish times: nine have registry times, one of them (Miasma) only under a reading chosen after the counts were seen and one (July's AsyncAPI wave) only from a record that doesn't identify the wave. In the two biggest, malicious versions went up within hours under many groups of packages sharing a current maintainer (Shai-Hulud 2.0: 88 groups in under 15 hours on 24 November 2025; ChainDrop: 13 in under 4 hours on 4 August 2026; both timings rest on one of two choices made after the counts, leaving out versions outside each wave's window). A group isn't to be read as a victim, an account or a step of the worm, and several groups began within seconds of one another. The records can't show whether a person acted in between, so each count is at most how many of the groups in OSV's records were reached without a person's new act, and OSV's records are incomplete, so a wave's whole reach may be larger; the record has had an evidence review and a reader-and-inference review, isn't released yet, and a second read follows in December.

Write-up studies/LH041/LH041.md

From studies/LH041/ in the repository, last changed 9 November 2026.