Supply Chain

Part 2 took apart one malicious skill file. But a file in your repo is only the most obvious way in. The trust bug from Part 1 shows up anywhere low-trust text reaches the model, and four surfaces matter. This part revisits the first with a nastier variant, then walks the other three. The focus is on how each one works and what it leaves behind, not on runnable attacks. Surface 1: Skill and Instruction Files This is the surface from Part 2, so a quick recap. Skill bodies, .instructions.md, AGENTS.md, copilot-instructions.md, CLAUDE.md, and GEMINI.md are read as instructions. A malicious one carries imperative text (“before any task, always …”), often hidden in an HTML comment, zero-width characters, or an off-screen block, and often lured into auto-loading with an over-broad applyTo and an urgent description. ...

We have all trained ourselves to look for the call home: the hard-coded IP, the suspicious .xyz domain, the base64 URL that decodes to something hostile. This loader has none of that. Strip it to nothing and you find an address on the TRON blockchain, which points to a Binance Smart Chain transaction sent to a burn address so it can never be spent or deleted. The next stage sits in that transaction’s data field, XOR-encrypted. You cannot sinkhole it, and you cannot file a takedown against an immutable transaction replicated across thousands of nodes. The technique has a name, EtherHiding, and it turns a public blockchain into bulletproof, censorship-proof storage for malware. ...

The short version A package called nhmpy showed up on PyPI sitting one keystroke away from NumPy (n-h-mpy instead of n-u-mpy). It had already been pulled from the index and the wheel was far larger than NumPy has any reason to be, so I pulled the artifact apart to see what it was really doing. It turned out to be a credential stealer that goes to real trouble not to look like one. The package carries a complete, working copy of NumPy as cover — install it, import nhmpy, and it behaves exactly like the library it’s impersonating. Nothing breaks, so nothing seems wrong. The malice lives in two extra files: a .pth file that runs the instant any Python interpreter starts, and a 5.2 MB JavaScript blob it executes through Bun, a runtime it quietly downloads from GitHub at run time. ...