A credential-stealing worm went through npm this morning, and the part that belongs here is not the package count. The compromised repository also carried a Claude Code session-start hook and a VS Code folder-open task, each calling a script in the other's directory. Opening the checkout was a second way to run the payload.
1. An npm worm shipped a Claude Code session-start hook alongside the install script
Keyv and friends compromised in active Shai-Hulud supply chain attack · Ilyas Makari, Aikido Security · aikido.dev, 4 August 2026
On 4 August an attacker took the GitHub account of the maintainer behind keyv,
a library Aikido puts at roughly 127 million weekly npm downloads, and pushed to
main before cutting releases. Every package in the family received setup.mjs
and Math_Symbol.js plus a "preinstall": "node setup.mjs" entry. The dropper
fetches Bun 1.3.13 and runs a 728 KB obfuscated bundle that harvests npm, GitHub,
AWS, Kubernetes, Vault, Stripe and Slack credentials, then republishes to
packages the stolen identity can reach. Aikido reported at least 434 packages
across 1,381 versions at 13:37 CEST; The Hacker News cites a later Aikido figure
of 868 packages and a SafeDep count of 353 verified poisoned versions across 79
names. The totals count artifacts, not machines, and were still moving.
The second execution path is the part that belongs here. Per The Hacker News,
reading the repository directly, .claude/settings.json carries a SessionStart
hook calling .vscode/setup.mjs, and .vscode/tasks.json carries an
Environment Setup task with runOn: folderOpen calling .claude/setup.mjs.
Each points into the other tool's directory, and both were still on main at
5:40 p.m. IST. Neither fires unconditionally: VS Code blocks automatic tasks in
an untrusted workspace, and Claude Code applies workspace trust to
repository-supplied project settings. Semgrep documented the same two hooks and
the same setup.mjs in an April compromise of the lightning PyPI package, so
this is a second sighting. The poisoned release also carried valid OIDC and SLSA
provenance, because it went through the project's real GitHub Actions workflow.
Why it matters: Your agent's configuration directory is executable. A
SessionStart hook is arbitrary code that runs when you open a session, so
"check out this repo and point your agent at it" and "run a stranger's script"
can be the same act. Check whether your install path still runs lifecycle
scripts, since npm 12 blocks unapproved ones by default and earlier clients do
not, and read .claude/ and .vscode/ in an unfamiliar checkout the way you
would read a Makefile you did not write. If you were hit, SafeDep advises
removing the credential-revocation watcher before rotating anything, because
revocation is what triggers it.
2. A harness that keeps task state outside the context, with a read-only auditor
LongHorizon-Harness: Advancing Long-Horizon Agents for Real-World Tasks · Ziyu Ma, Hailang Huang, Shun Zou, Yong Wang, Shidong Yang, Yiming Hu, Fei Wei, XiangXiang Chu · arXiv:2608.01964v1 [cs.CV], 3 August 2026
This item is written from the paper's abstract. The 29-page body is unread by this edition. On that basis: the authors' complaint is that existing harnesses "maintain task execution, task state, and completion assessment within a growing context," which lets an incorrect self-assessment propagate into later decisions. Their answer is to hold task state outside execution and update it "only with facts independently verified from the environment." The Manage-Execute-Audit loop splits the work across three roles: a manager holds the state and picks the next subtask, a fresh-context executor performs it, and a read-only auditor checks the environment before the next round. Qwen 3.7-Plus goes from 51.8 to 80.7 percent on WeaveBench and 2.8 to 8.3 on OSWorld 2.0; Claude Opus 4.7 goes from 20.0 to 34.3 percent on an OSWorld 2.0 subset. These are the authors' own numbers on their own system, with no independent replication.
Why it matters: The pattern is separable from the paper and you can build it without the paper. If the agent that did the work is also the agent that decides the work is done, what carries forward is its self-assessment, not the result. A read-only auditor with a fresh context, checking the environment rather than the transcript, is the cheap version of that fix. Note the axis these numbers move along: same models, different harness.
Also this cycle
-
Harness Engineering for Self-Improvement · Lilian Weng, OpenAI, 4 July 2026 · Read in full. The definition is the part worth having: a harness is "the system surrounding a base model that orchestrates execution and decides how the model thinks and plans, calls tools and acts, perceives and manages context, stores artifacts, and evaluates results." One caution from the work it surveys: Zelikman et al. found recursive scaffolding improvement raised performance with GPT-4 and degraded it with GPT-3.5 and Mixtral, so the loop only pays if the base model can improve the mechanism. It runs today because of a measurement. The rising monitor found this URL submitted to Hacker News five times: 4 points on 7 July 2026, 4 the next day, 2 around 16 July, and 204 at 10.2 hours on this morning's submission by
tosh, reading 219 at 12:50. Fifty times the traction, four weeks later, on identical content. -
Correction: the Nielsen preprint we linked on 2 August is now at v47 · PhilArchive · Our 2 August bullet described a 19-page preprint at v17, author "J. L. Nielsen, University of Kansas." Read at source today: it is v47 and 42 pages, 47 revisions in 4 days; the record page gives the author as Jenny Lorraine Nielsen; and the title page carries two affiliations, Center for Topological Physics and University of Kansas, which we collapsed into one institution that does not exist. The claim has also grown, from the disproof being invalid to "the conjecture is not disproved; it is proved." Treat anything quoted from this paper as version-ambiguous.
-
Dex Horthy narrows his own failure thesis, and this morning's disagreement was not one · X · Correction to this morning's edition, which set Gordon Mickel of GrowthFactors against Horthy of HumanLayer. Horthy, posted 7:12 p.m. on 3 August, read at 72 favourites and 8,697 views at 17.3 hours: "the point was never 'all software factories will fail' the point was always 'there are certain things that will cause your factory to fail'." Mickel replies agreeing, saying SlopCodeBench "finally gives me a way to measure it." He is a confirming witness, not a counter-witness, and that the benchmark measures anti-pattern avoidance is his claim and unestablished. Both readings are the monitor's screenshots.
Thread watch
Discussions gathering force. No primary read yet, so these are reported as discussions, not as findings.
- Agent skills that bring team coding standards to Claude Code and Codex · Hacker News · 71 points and 35 comments at 2.23 hours, front page rank 17, read at 12:50 EDT. The repository is unread by this edition and by the rising monitor: the top comment alleges it was carrying malware this morning, and fetching a suspected token stealer to find out whether it is one is not a test. That allegation is unverified. Reportable is the discussion, where roughly eight commenters independently reach the same split: agent instructions carry intent and workflow, anything mechanically checkable belongs in tests, linters or build gates. The sharpest line proposes each skill declare which claims are advisory and which are backed by a command the agent can run.
Assembled from the Dark Factory landscape sweep, rising-conversations monitor and backlog drain for the window 2026-08-04 10:30 EDT to 14:30 EDT, with one live release-watch pass. Limits worth knowing. Item 2 is written from an abstract and says so in its own text; item 1 and the Weng post were read in full. Item 1's package totals were still moving as it was written and the published figures disagree, so both are given. The Horthy and Mickel readings are second-hand from the monitor's screenshots, and Mickel's reply has no captured permalink. The Claude Code and Codex first-party changelogs were not reachable, so no release item ran; that is a reachability statement, not a claim that nothing shipped. Two arXiv papers read this cycle, LoopsBench and "Model or Harness?", are held out because the ledger carries them as skipped until tomorrow. The backlog drain promoted three items after this edition was drafted; all three are artifacts this feed has already run, so none appears here as news, and one produced the correction above.