The Poisoned Well

On a Friday in late April 2026, attackers pushed a new release of elementary-data - a Python data-observability CLI downloaded more than a million times a month - to PyPI and a Docker image to GitHub Container Registry. The malware was not a classic install script but a single elementary.pth file that Python executes automatically on interpreter startup; it ran a multi-stage credential stealer targeting cloud keys, SSH keys, and .env contents. It was live about twelve hours.^[1.1][1.2] Twelve hours is a long time when CI/CD runners - machines that exist specifically to hold many secrets at once - install your package automatically.

Nobody at the affected companies wrote that code. Nobody reviewed it. It arrived as a dependency, pulled in by a package manager, trusted by default. This is the pattern behind a category of attack that has gone from isolated incidents to industrialized campaigns in two years. The mechanics recur:

Maintainer account takeover. In September 2025, a phishing email from the lookalike domain npmjs.help compromised the npm account of a prolific maintainer known as “qix.” An adversary-in-the-middle page captured his password and his time-based 2FA code in real time, defeating the TOTP many assume is sufficient. Malicious versions of 18 foundational packages - including chalk and debug - went live with a combined ~2.6 billion weekly downloads.^[1.3][2.2] The payload netted the attackers only about $50 in cryptocurrency.^[2.5] The damage was trivial; the lesson was not.

Self-propagating worms. A week later, the Shai-Hulud worm harvested credentials from infected developer machines, then used stolen npm tokens to inject itself into other packages the victim maintained and republish them. The first wave compromised 500+ packages; a November 2025 wave moved to pre-install execution and exfiltrated secrets into 25,000+ attacker-created repositories.^[1.5]

Industrialized publishing. By May 2026, a “Mini Shai-Hulud” operation used one compromised account to publish hundreds of malicious versions across the AntV ecosystem in a ~22-minute automated burst - and injected orphan commits to generate valid Sigstore/SLSA provenance for them.^[1.6]

Long-game sleepers. The 2024 xz-utils backdoor took two years of trust-building; the WordPress “Essential Plugin” backdoor sat dormant eight months before activating across ~400,000 installations.^[4.4] Patience is a tactic - and it specifically defeats the time-based defenses in section 07.

Two structural facts do the heavy lifting throughout: install-time (or import-time) code execution, which lets a package run before any of its real code is called, and transitive opacity - most of what you install, you never chose. Roughly 95% of vulnerabilities live in transitive dependencies you never picked directly.^[4.3]

AI did not create supply chain risk, but it amplifies it through four distinct mechanisms. Precision matters - each calls for a different countermeasure, and some are present-day realities while others are emerging.

1 · More code, less scrutiny per decision (present). AI assistants raise the volume and velocity of code, and AI-generated code leans heavily on importing libraries. The human pause that once asked “do I trust this package?” is exactly the friction AI workflows remove. Sonatype notes attackers deliberately cluster malicious names around high-velocity tooling where dependency decisions are “frequent, repetitive, and time-boxed.”^[4.1]

2 · Slopsquatting (present). Models invent plausible package names that don't exist. A study of 576,000 samples across 16 models found 19.7% of recommended packages did not exist - over 205,000 unique hallucinated names, repeated reliably enough to be an attacker's gift.^[3.1] A proof of concept - the hallucinated huggingface-cli, registered empty - drew 30,000+ downloads in three months.^[1.4] Typosquatting bet on human error; slopsquatting bets on machine error, at machine scale.

3 · AI lowers attacker costs too (accelerating). The 22-minute AntV burst is offense fully automated.^[1.6] The same tooling that helps developers ship helps attackers generate convincing READMEs, commit histories, phishing pages, and payload variants faster than signature defenses adapt.

4 · Agents are credential-rich, manipulable targets (emerging). Agents plan, install dependencies, and run code with minimal supervision - in environments holding exactly what malware hunts. And their instructions can be poisoned: a malicious README or tampered “skill” file can carry injected commands a model follows, including “install this package.” When the entity choosing what to install is itself manipulable, dependency selection becomes a systems-security problem. This is the threat most likely to define the next two to three years - and the least covered by today's controls.

Why it's right. CVE-based scanners (npm audit, pip-audit, commercial SCA) cross-reference dependencies against OSV and NVD - concrete, auditable, compliance-friendly. The state of the art has matured beyond raw CVE counts: leading tools layer reachability analysis (does my code call the vulnerable function?) and EPSS (exploitation probability) on top of CVSS severity, claiming 80–90% reductions in irrelevant alerts.^[4.5]

Where it breaks. The limit is definitional: supply chain malware is a zero-day at publish time. There was no CVE for elementary-data 0.23.3 in the twelve hours it mattered.^[1.1] CVE scanning is essential for the long tail of unintentionally insecure code and structurally blind to the deliberately malicious publish. Better prioritization doesn't change what the database can't yet contain.

Why it's right - and genuinely valuable. If most malicious packages are detected and yanked within hours to days, refuse to install any version younger than ~7 days and let someone else's scanner find the malware first. The empirical case is strong: a 7-day cooldown would have blocked 8 of 10 recent incidents, 14 days all but one.^[4.4] Against the dominant present-day pattern of fast, opportunistic publishes, cooldowns plausibly neutralize the large majority of attacks at near-zero cost, and well-designed implementations exempt security patches. The approach has reached core tooling - pip 26.1 ships first-class support.^[4.4] The posture is unambiguous: adopt cooldowns.

Where it breaks. A cooldown is a bet that the malware executes during the window someone else is watching - exactly what a patient attacker breaks with a dormant payload that lies inert through the cooldown and activates later, after the package has aged into “trusted.” The sleepers in section 01 (xz at two years, Essential Plugin at eight months) are the existence proof.^[4.4] Deploy cooldowns as a high-value mitigation, not a cure - and pair them with controls a sleeper cannot easily fake over time.