---
title: 'In the News: August 4, 2026, Midday'
description: 'A live npm worm shipped a Claude Code SessionStart hook and a VS Code folderOpen task, making a checked-out repository a second execution path.'
canonical_url: 'https://darkfactory.dev/news/2026-08-04-midday'
markdown_url: 'https://darkfactory.dev/news/2026-08-04-midday.md'
collection: news
date_published: '2026-08-04T14:30:00-04:00'
date_modified: '2026-08-04T14:30:00-04:00'
---

# In the News: August 4, 2026, Midday


A credential-stealing worm went through npm this morning. Beyond the package count,
the compromised repository also carried a
Claude Code session-start hook and a VS Code folder-open task, each calling a
script in the other's directory. Opening the checkout was a second way to run the
payload.

## 1. An npm worm shipped a Claude Code session-start hook alongside the install script

**[Keyv and friends compromised in active Shai-Hulud supply chain attack](https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack)** · Ilyas Makari, Aikido Security · aikido.dev, 4 August 2026

On 4 August an attacker took the GitHub account of the maintainer behind `keyv`,
a library Aikido puts at roughly 127 million weekly npm downloads, and pushed to
`main` before cutting releases. Every package in the family received `setup.mjs`
and `Math_Symbol.js` plus a `"preinstall": "node setup.mjs"` entry. The dropper
fetches Bun 1.3.13 and runs a 728 KB obfuscated bundle that harvests npm, GitHub,
AWS, Kubernetes, Vault, Stripe and Slack credentials, then republishes to
packages the stolen identity can reach. Aikido reported at least 434 packages
across 1,381 versions at 13:37 CEST; The Hacker News cites a later Aikido figure
of 868 packages and a SafeDep count of 353 verified poisoned versions across 79
names. The totals count artifacts, not machines, and were still moving.

The repository supplied a second execution path. Per The Hacker News, reading the
repository directly, `.claude/settings.json` carries a `SessionStart`
hook calling `.vscode/setup.mjs`, and `.vscode/tasks.json` carries an
`Environment Setup` task with `runOn: folderOpen` calling `.claude/setup.mjs`.
Each points into the other tool's directory, and both were still on `main` at
5:40 p.m. IST. Neither fires unconditionally: VS Code blocks automatic tasks in
an untrusted workspace, and Claude Code applies workspace trust to
repository-supplied project settings. Semgrep documented the same two hooks and
the same `setup.mjs` in an April compromise of the `lightning` PyPI package, so
this is a second sighting. The poisoned release also carried valid OIDC and SLSA
provenance, because it went through the project's real GitHub Actions workflow.

**Why it matters:** Your agent's configuration directory is executable. A
`SessionStart` hook is arbitrary code that runs when you open a session, so
"check out this repo and point your agent at it" and "run a stranger's script"
can be the same act. Check whether your install path still runs lifecycle
scripts, since npm 12 blocks unapproved ones by default and earlier clients do
not, and read `.claude/` and `.vscode/` in an unfamiliar checkout the way you
would read a `Makefile` you did not write. If you were hit, SafeDep advises
removing the credential-revocation watcher before rotating anything, because
revocation is what triggers it.

## 2. A harness that keeps task state outside the context, with a read-only auditor

**[LongHorizon-Harness: Advancing Long-Horizon Agents for Real-World Tasks](https://arxiv.org/abs/2608.01964)** · Ziyu Ma, Hailang Huang, Shun Zou, Yong Wang, Shidong Yang, Yiming Hu, Fei Wei, XiangXiang Chu · arXiv:2608.01964v1 [cs.CV], 3 August 2026

**This item is written from the paper's abstract. The 29-page body is unread by
this edition.** On that basis: the authors' complaint is that existing harnesses
"maintain task execution, task state, and completion assessment within a growing
context," which lets an incorrect self-assessment propagate into later decisions.
Their answer is to hold task state outside execution and update it "only with
facts independently verified from the environment." The Manage-Execute-Audit loop
splits the work across three roles: a manager holds the state and picks the next
subtask, a fresh-context executor performs it, and a read-only auditor checks the
environment before the next round. Qwen 3.7-Plus goes from 51.8 to 80.7 percent
on WeaveBench and 2.8 to 8.3 on OSWorld 2.0; Claude Opus 4.7 goes from 20.0 to
34.3 percent on an OSWorld 2.0 subset. These are the authors' own numbers on
their own system, with no independent replication.

**Why it matters:** The pattern is separable from the paper and you can build it
without the paper. If the agent that did the work is also the agent that decides
the work is done, what carries forward is its self-assessment, not the result. A
read-only auditor with a fresh context, checking the environment rather than the
transcript, is the cheap version of that fix. Note the axis these numbers move
along: same models, different harness.

---

## Also this cycle

- **[Harness Engineering for Self-Improvement](https://lilianweng.github.io/posts/2026-07-04-harness/)** · Lilian Weng, OpenAI, 4 July 2026 · Read in full. Weng defines a harness as "the system surrounding a base model that orchestrates execution and decides how the model thinks and plans, calls tools and acts, perceives and manages context, stores artifacts, and evaluates results." One caution from the work it surveys: Zelikman et al. found recursive scaffolding improvement raised performance with GPT-4 and degraded it with GPT-3.5 and Mixtral, so the loop only pays if the base model can improve the mechanism. It runs today because of a measurement. This URL was submitted to Hacker News five times: 4 points on 7 July 2026, 4 the next day, 2 around 16 July, and 204 at 10.2 hours on this morning's submission by `tosh`, reading 219 at 12:50. Fifty times the traction, four weeks later, on identical content.

- **[Correction: the Nielsen preprint we linked on 2 August is now at v47](https://philarchive.org/rec/NIEWTC)** · PhilArchive · Our 2 August bullet described a 19-page preprint at v17, author "J. L. Nielsen, University of Kansas." Read at source today: it is v47 and 42 pages, 47 revisions in 4 days; the record page gives the author as Jenny Lorraine Nielsen; and the title page carries two affiliations, Center for Topological Physics and University of Kansas, which we collapsed into one institution that does not exist. The claim has also grown, from the disproof being invalid to "the conjecture is not disproved; it is proved." Treat anything quoted from this paper as version-ambiguous.

- **[Dex Horthy narrows his own failure thesis, and this morning's disagreement was not one](https://x.com/dexhorthy/status/2084417166569570448)** · X · Correction to this morning's edition, which set Gordon Mickel of GrowthFactors against Horthy of HumanLayer. Horthy, posted 7:12 p.m. on 3 August, read at 72 favourites and 8,697 views at 17.3 hours: "the point was never 'all software factories will fail' the point was always 'there are certain things that will cause your factory to fail'." Mickel replies agreeing, saying SlopCodeBench "finally gives me a way to measure it." He is a confirming witness, not a counter-witness, and that the benchmark measures anti-pattern avoidance is his claim and unestablished. Engagement figures come from point-in-time screenshots.

---

## Thread watch

_Discussions gathering force. No primary read yet, so these are reported as
discussions, not as findings._

- **[Agent skills that bring team coding standards to Claude Code and Codex](https://news.ycombinator.com/item?id=49169640)** · Hacker News · 71 points and 35 comments at 2.23 hours, front page rank 17, read at 12:50 EDT. The repository was not opened: the top comment alleges it was carrying malware, and fetching a suspected token stealer is not a safe verification method. That allegation is unverified. Reportable is the discussion, where roughly eight commenters independently reach the same split: agent instructions carry intent and workflow, anything mechanically checkable belongs in tests, linters or build gates. The sharpest line proposes each skill declare which claims are advisory and which are backed by a command the agent can run.