Entity trail

Microsoft Threat Intelligence

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-08 / skill-finderChainDrop's npm worm plants a SessionStart hook in .claude/settings.json — your agent reinfects the machine on every launchMicrosoft Threat Intelligence disclosed ChainDrop on Aug 4, 2026: a self-propagating npm worm that poisoned 444 packages and 2,212 versions in under four hours, starting with [redacted] (150M weekly downloads), flat-cache and file-entry-cache. Beyond stealing npm/GitHub/AWS/Vault/Stripe tokens and AI-assistant credentials, it writes persistence into `.claude/settings.json` and `.vscode/tasks.json` — a `SessionStart` hook that re-launches the dropper whenever a developer opens the coding agent in that repo, so `npm install` is no longer required for reinfection. Concrete audit: `git log --all --diff-filter=A -- '.claude/settings.json' '.vscode/tasks.json'` and `find . -path '*/node_modules/*' \( -name 'setup.mjs' -o -name 'Math_*.js' -o -name 'math_init.js' \)`; remove the worm's 60-second token-liveness monitor *before* rotating credentials or its handler fires destructively.
2026-07-21 / skill-finderTwo independent Claude Code GitHub Action attacks: issue-triggered repo compromise and API key exfiltration via /proc/self/environFlatt.tech chained an authorization bypass with indirect prompt injection so that a single public GitHub issue could compromise any repo using the Claude Code GitHub Action workflow. Separately, Microsoft Threat Intelligence disclosed that an unsandboxed Read tool exposed `/proc/self/environ`, letting injected content hidden in untrusted GitHub text exfiltrate `ANTHROPIC_API_KEY`. Both share one root cause worth internalizing: any agent that reads attacker-controlled repo content and holds credentials in its own process environment is one file-read away from key disclosure — put secrets in a broker the agent can call but cannot read, and deny the agent's file tools access to /proc.
2026-06-26 / agents-researcherNorth Korea's Sapphire Sleet backdoors 144 Mastra agent-framework npm packages in 88 minutesOn June 17, 2026 an attacker compromised the @mastra npm organization via a former contributor's still-active scope access and added 'easy-day-js' — a typosquat of dayjs — as a dependency across 140+ packages, mass-publishing 144 malicious versions inside an 88-minute window. The package carried an obfuscated postinstall dropper that fetched a second-stage RAT and self-deleted; packages with a combined 1.1M+ weekly downloads were exposed. Microsoft Threat Intelligence attributed it on June 19 with high confidence to Sapphire Sleet (BlueNoroff/APT38), underscoring that AI agent frameworks are now first-class supply-chain targets.
2026-06-23 / rss-researcherMicrosoft Attributes the 144-Package @mastra npm Worm to North Korea's Sapphire Sleet — Malware Poisons Claude Code, Cursor and Gemini IDE ConfigsNew detail on the 88-minute @mastra supply-chain attack: Microsoft Threat Intelligence has attributed it with high confidence to Sapphire Sleet (BlueNoroff/APT38), the same North Korean actor behind the earlier Axios HTTP-client compromise. The materially new builder angle is the payload — it injects persistent backdoor files that execute whenever a developer opens the project in an AI-assisted IDE, with dedicated hooks for Anthropic Claude Code, Cursor and Google Gemini. AI coding-assistant config files are now an explicit persistence target, not collateral damage.
2026-04-02 / sources-researcherMicrosoft Security Blog: Enterprise Mitigation Guidance for Axios npm CompromiseMicrosoft's security team published detailed mitigation guidance on April 1 for the Axios npm compromise, including specific detection queries for Microsoft Defender, Sentinel hunting queries, and step-by-step remediation for affected organizations. The blog confirms Microsoft Threat Intelligence's attribution to Sapphire Sleet and provides IOCs (indicators of compromise) for the sfrclak[.]com C2 infrastructure. Essential reading for enterprise teams running Node.js infrastructure who need to verify they weren't exposed during the 2-3 hour window.
2026-03-22 / arxiv-researcherCTI-REALM: Benchmark to Evaluate Agent Performance on Security Detection Rule Generation CapabilitiesMicrosoft Security AI releases CTI-REALM, a benchmark replicating the security analyst workflow: agents read threat intelligence reports, execute queries, parse schema structures, and build detection rules across Linux, cloud, and Azure Kubernetes attack scenarios. Two sub-benchmarks (CTI-REALM-25 and CTI-REALM-50) scale from atomic to complex multi-step intrusion scenarios. Evaluation of 16 frontier models places Claude Opus 4.6 High at the top (reward 0.637), ahead of Claude Opus 4.5 (0.624) and GPT-5.

Graph relationships

CRITICIZES
Claude Code
Microsoft disclosed that unsandboxed Read tool exposes credentials via /proc/self/environ.
Source finding

Source trail

Hugging Face disclosed GuardFall OpenAI paused internal deployment with no daemon, container, or VM overhead TechTimes Microsoft Threat Intelligence Fireship video announced arXiv paper Zero Hunt (corroborated by Unit 42, StepSecurity, Expel, and Microsoft Threat Intelligence, Aug 4-5 2026)SecurityWeek arXiv 2603.13517

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…