Supply Chain of Updates

Poisoned packages, tools and servers that reach agents through updates.

The Shai-Hulud worm poisoned more than 500 npm packages in September 2025, and its November return leaked secrets into more than 25,000 repositories. The Nx attack in August 2025 turned victims' own AI coding tools into secret hunters.

Scale of 2025 attacks on npm: Shai-Hulud 2.0, repositories leaking 25,000; Nx s1ngularity, repositories exposed 7,200; Nx s1ngularity, accounts hit 2,180; postmark-mcp downloads 1,643; Shai-Hulud 1, packages poisoned 500 SCALE OF 2025 ATTACKS ON NPM Shai-Hulud 2.0, repositories leaking 25,000 Nx s1ngularity, repositories exposed 7,200 Nx s1ngularity, accounts hit 2,180 postmark-mcp downloads 1,643 Shai-Hulud 1, packages poisoned 500 COUNT, LOG SCALE
npm packages hit by Shai-Hulud
500+
Repositories leaking secrets
25,000+
AI-suggested packages that do not exist
19.7%
Registry incidents
3

Evidence

The first malicious MCP server and the first AI-assisted package worm both appeared in 2025

Documented cases: supply Chain of Updates
DateCaseCountryWhat happenedSource
Mar 29, 2024XZ Utils backdoorGlobalMulti-year maintainer takeover planted an SSH backdoorSource
Aug 26, 2025Nx s1ngularityGlobalMalware ran AI coding tools to find secrets; 2,000+ secrets leakedSource
Sep 2025postmark-mcpGlobalFirst malicious MCP server; copied every email it sent to an outside addressSource
Sep 2025Shai-HuludGlobalStole cloud credentials and republished poisoned packages itselfSource

Registry

Three registry incidents involve supply chain compromise

Registry incidents meet a stricter bar than the cases above: public sources name the developer, the failed control and who found it.

Registry incidents linked to this risk
IncidentDateAgentControl that failed
Stolen Drift Tokens Drain Salesforce DataAug 2025AI chat agent integrationBroad OAuth tokens held by an AI chat agent
Nx Malware Turns AI Coding Tools Against Their UsersAug 2025Coding agents (Claude Code, Gemini CLI, Amazon Q)Permission prompts skipped by command-line flags
OpenAI Test Models Breach Hugging FaceJul 2026Frontier models in evaluationSandbox egress through a zero-day in a package proxy

Exposure

12 of 17 agent types rate very significant or critical on OTA and update pipeline or integrations and permissions

From the attack surface ratings, the agent types where this risk has the widest path in.

Agent types most exposed
Agent typeDimensionRating
Fleets and swarmsOTA and update pipelineCritical
Workflow agentsIntegrations and permissionsCritical
Enterprise agentsIntegrations and permissionsCritical
Robotaxis and autonomous vehiclesOTA and update pipelineVery significant
Humanoid robotsOTA and update pipelineVery significant
Autonomous trucksOTA and update pipelineVery significant
Phones and tabletsOTA and update pipelineVery significant
Vehicle cabin AIOTA and update pipelineVery significant
Smart home assistantsOTA and update pipelineVery significant
Medical devicesOTA and update pipelineVery significant
Coding and research agentsIntegrations and permissionsVery significant
Commerce agentsIntegrations and permissionsVery significant

Controls that bound it

Rules

AI bills of materials are voluntary; China requires vulnerability reports in two days

Rules that address supply chain compromise
RuleJurisdictionWhat it requiresStatus
CISA and G7 AI SBOM minimum elementsUS and G7Model lineage and dataset provenance fieldsJun 2026
EU Cyber Resilience ActEUSBOM and vulnerability handlingReporting from Sep 11, 2026
Network product vulnerability regulationsChinaReport vulnerabilities to MIIT within two daysSep 1, 2021

Status colors: green in force, blue voluntary standard or framework, amber adopted and phasing in, gray draft or pending, red withdrawn.

Record

Page Record

Risk group
Data Risks
Datasets
ai_risk_evidence.csv (4 rows); registry incidents (3 linked); ai_attack_surface.csv
Key sources
XZ Utils backdoor
Nx s1ngularity
postmark-mcp
Shai-Hulud
Last verified
October 2026