Someone hid a self-replicating worm inside 37 npm packages.
Written in Rust.
Hidden behind an eBPF kernel rootkit.
Talking to its operator over Tor.
It steals 86 environment variables.
AWS keys. GCP keys. Vault secrets. Kubernetes tokens.
Your Anthropic API key. Your OpenAI key.
Your Exodus wallet seed phrase.
Then it uses your own npm credentials to republish itself into your packages.
So your code infects the next developer.
Who infects the next one.
The commits were backdated up to 13 years.
The commit author name was “claude.”
The malware named itself after the AI to hide in plain sight.
The attacker also left their own wallet recovery phrase in the debug data.
Nobody is having a good day.
Check your preinstall hooks.
Today, we remember a legend.
On this day in history, Harambe would have celebrated another birthday. An icon that became part of internet history, American culture, and an entire generation’s timeline.
Tomorrow marks 10 years since we lost him. Ten years since the moment the world stopped scrolling and collectively mourned something bigger than a meme.
He became a symbol of loyalty, strength, chaos, unity, and the strange beauty of the internet bringing millions of people together for one cause: never forgetting Harambe.
Everyone remembers where they were when they heard the news. And somehow, a decade later, his legacy still lives on.
Gone, but never forgotten.
Rest easy to a true patriot. 🕊️🇺🇸
May 27, 1999 — May 28, 2016
Forever in our hearts.
I have a funny idea.
Add fake internal DNS entries like:
- honeypot01
- canarydc
- edr-test-node
- malwarelab
to your AD environment.
Not for humans, but for future LLM-driven recon agents.
Basically:
We're entering an era where naming things might become a defensive control 🙂