LH041 sources
Read before the brief (8 November 2026), by curl with the User-Agent Lighthouse-research/1.0 (+https://lighthouse.harbour.cat). Each answered page is kept gzipped as served under data/prebrief/web/; the log is data/prebrief/web-log.psv. Every claim taken from these is the publisher's, or the sources it cites, not Lighthouse's. Page dates are as the pages state them.
| id | publisher and subject | URL | HTTP | read (UTC) |
|---|---|---|---|---|
| w01 | StepSecurity, Mini Shai-Hulud TanStack wave, page dated 11 May 2026 (scout 3). | https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem | 200 | 2026-11-08T19:01:11Z |
| w02 | SecurityWeek, Miasma and Hades, 9 June 2026 (scout 3). | https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/ | 200 | 2026-11-08T19:01:12Z |
| w03 | BleepingComputer, ChainDrop, 4 August 2026 (scout 3). | https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/ | 200 | 2026-11-08T19:01:12Z |
| w04 | The Hacker News, MemTensor, 23 September 2026 (scout 3). | https://thehackernews.com/2026/09/compromised-memtensor-packages-deliver.html | 200 | 2026-11-08T19:01:12Z |
| w05 | Techzine, Tensorlake, 9 October 2026 (scout 3). Refused (403); unread. | https://www.techzine.eu/news/security/144866/shai-hulud-worm-burrows-into-ai-platform-tensorlakes-npm-sdk/ | 403 | 2026-11-08T19:01:13Z |
| w06 | CISA alert on the September 2025 npm compromise. Refused (403); unread. | https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem | 403 | 2026-11-08T19:01:13Z |
| w07 | Unit 42, "The npm Threat Landscape" (updated 15 July 2026): April to July 2026 waves. | https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/ | 200 | 2026-11-08T19:02:32Z |
| w08 | Socket glossary, Shai-Hulud. Refused (403); unread. | https://socket.dev/glossary/shai-hulud | 403 | 2026-11-08T19:02:32Z |
| w09 | Cloud Security Alliance research note, Shai-Hulud/Megalodon (May 2026 waves). | https://labs.cloudsecurityalliance.org/research/csa-research-note-shai-hulud-megalodon-supply-chain-cascade/ | 200 | 2026-11-08T19:02:33Z |
| w10 | Snyk, Mini Shai-Hulud AntV wave (19 May 2026). | https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack/ | 200 | 2026-11-08T19:02:33Z |
| w11 | Flashpoint, Mini Shai-Hulud timeline (2026). | https://flashpoint.io/blog/mini-shai-hulud-worm-new-era-ci-cd-exploitation/ | 200 | 2026-11-08T19:02:34Z |
| w12 | Cloud Security Alliance research note, Mini Shai-Hulud, 16 May 2026. | https://labs.cloudsecurityalliance.org/research/csa-research-note-mini-shai-hulud-npm-supply-chain-20260516/ | 200 | 2026-11-08T19:02:35Z |
| w13 | Elastic Security Labs, ChainDrop (4 August 2026). | https://www.elastic.co/security-labs/shai-hulud-chaindrop-npm-supply-chain | 200 | 2026-11-08T19:03:35Z |
| w14 | Aikido, Tensorlake compromise (8 October 2026). | https://www.aikido.dev/blog/tensorlake-npm-package-compromised | 200 | 2026-11-08T19:03:36Z |
| w15 | The Hacker News, CanisterSprawl (April 2026, updated 24 April). | https://thehackernews.com/2026/04/self-propagating-supply-chain-worm.html | 200 | 2026-11-08T19:03:36Z |
| w16 | Unit 42, "Shai-Hulud" worm (September 2025, updated 26 November 2025 for Shai-Hulud 2.0). | https://unit42.paloaltonetworks.com/npm-supply-chain-attack/ | 200 | 2026-11-08T19:03:38Z |
| w17 | Cloud Security Alliance research note, CanisterSprawl (April 2026). | https://labs.cloudsecurityalliance.org/research/csa-research-note-npm-canistersprawl-supply-chain-worm-20260/ | 200 | 2026-11-08T19:03:38Z |
| w18 | Unit 42, ChainDrop analysis (August 2026). | https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ | 200 | 2026-11-08T19:03:40Z |
| w19 | StepSecurity, ChainDrop (last updated 4 August 2026, 18:10 UTC). | https://www.stepsecurity.io/blog/chaindrop-npm-worm | 200 | 2026-11-08T19:03:41Z |
Structure only, before the brief: OpenSSF malicious-packages README.md, CONTRIBUTING.md, docs/schema_additions.md and config/config.yaml from raw.githubusercontent.com (main branch, read 19:00 to 19:01 UTC), OSV record MAL-2023-1 from api.osv.dev (19:00 UTC), and registry.npmjs.org for that record's package (404, 19:04 UTC), all under data/prebrief/.
Search results seen and not opened (8 November 2026, about 19:02 to 19:04 UTC): Socket's Tensorlake post, Endor Labs, OX Security, lilting.ch, SOC Prime, Expel, Semgrep, Integrity360, HivePro, CSO Online, Infosecurity Magazine on ChainDrop, bastion.tech and pulse.bot on CanisterSprawl, codeant.ai, hol.org, and a Substack post. Facts taken from search summaries are labelled as such in the brief.
Sources read after the brief, for the outcome, are listed in the record (LH041.md).
From studies/LH041/sources.md in the repository, last changed 8 November 2026.