AI
The Scale of the Problem
Aikido ingests 50,000 packages a day across all registries. 80% of that is NPM. That is where the most damage has occurred. Event-stream, 2 million downloads a week, was compromised through a leaked token. SolarWinds, Codecov, and the XZ backdoor followed. The XZ attacker spent years building trust with a single maintainer, then put in a backdoor. A Microsoft engineer noticed a slow SSH login and caught it. Eriksen credited luck. “We’ve been lucky. But that’s not a strategy,” he said.
Singularity: LLMs and Exfiltration
The NX compromise started with a command injection in a GitHub Action. Attackers scanned all of GitHub, found the vulnerable workflow, and pulled the NPM token. Once inside, the malware checked for Claude, Gemini, or Q installed. It started a local LLM in unsafe mode with a prompt: “Go through this system and find all the secrets.” Exfiltration worked without C2 infrastructure. The malware created new public GitHub repositories in the victim’s account and uploaded stolen credentials. Anyone could pull the feed. No encryption. “These are like chaotically evil people in many ways,” Eriksen said.
Shai Hulud: The Self-Spreading Worm
180+ packages were compromised in a short window. The worm spread through NPM dependencies. Attackers debugged their code in production, publishing buggy versions with metadata that revealed Kali Linux as the source. They replaced LLM-based secret scanning with trufflehog. The malicious blob grew to 10 megabytes because it bundled AWS and Google Cloud SDKs to escalate cloud credentials. The worm also added a shutdown command to the shell profile. That shutdown triggered a panic and helped the community catch it quickly. “They missed. That’s again not a good strategy to have your attacker miss you,” Eriksen noted.
The Third Wave and Fog of War
A third wave hit close to 1,000 packages, including Zapier, AsyncAPI, and Postman. The same vector: CI/CD command injection. Attackers added a backdoor GitHub Action that installed a local runner, turning GitHub Actions into a reverse shell. For exfiltration, if the victim had no GitHub token, the malware searched GitHub public API for other leaked tokens and reused them. 33,000 validated secrets were exposed. A secondary chain exposed 300,000 more credentials. One firm, trigger.dev, reported that attackers used leaked tokens to download all repositories, then deleted them. The fog of war made attribution impossible.
Rethinking Trust in the Age of AI
Eriksen argued the ecosystem is optimized for speed, automation, and scale — the same traits that make a worm effective. He raised questions about identity: should you care who the maintainer is? If LLMs write most code soon, who is responsible? PNPM introduced a 24-hour delay on new packages. Aikido scans 50,000 packages per day and judges trust within 15 minutes. “Maybe it’s good if things slow down a little bit so the ecosystem has time to react,” Eriksen said. He concluded that trust is consistency over time. “Trust is really what survives when conditions change.”
Notable Quotes
We got lucky. But that’s not a strategy. Charlie Eriksen · ▶ Watch (4:19)
These are like chaotically evil people in many ways. Or good depending on how you look at it. Charlie Eriksen · ▶ Watch (18:00)
They were debugging their code in production. Get that. Debugging their worms live. Charlie Eriksen · ▶ Watch (30:11)
Sharing is caring is what it means. And I don’t like it. Charlie Eriksen · ▶ Watch (38:45)
Trust is really what survives when conditions change. Charlie Eriksen · ▶ Watch (59:59)
Key Takeaways
- Attackers exploited CI/CD command injections and leaked tokens to compromise NPM packages.
- Worms now use LLM agents and cloud SDKs to steal credentials without C2 infrastructure.
- The ecosystem must slow down and add verification before code reaches developers.
About the Speaker(s)
Charlie Eriksen is a Security Researcher at Aikido Security, specializing in software supply-chain security. He focuses on detecting malicious code in open-source packages and on improving the ecosystem’s resilience against emerging threats. Previously, he worked in consulting, offensive security, and bug bounties, co-founded a training company focused on the OWASP Top 10, and founded a company focused on JavaScript static analysis.