Podcast Covers Team PCP’s Mini Shai-Hulud Campaign and Recent Security Incidents
Summary
OpenSourceMalware’s episode discusses Lovable and Vercel incident response, a GitHub RCE, EDR false positives with AI coding agents, and Team PCP’s Mini Shai-Hulud campaign targeting developer tools and packages.
Key points
- The speakers say a Lovable regression let free-account holders view other users’ source code and chat histories; they criticize the company’s initial response. They also fault Vercel for not giving customers actionable mitigation steps.
- The episode discusses a GitHub RCE involving the -o option on git push, which the speakers say allowed supplied code to execute through GitHub.
- An EDR tool falsely flagged and quarantined a developer’s library during AI-assisted refactoring, reportedly interpreting rapid file changes as ransomware-like behavior.
- The speakers describe Team PCP’s Mini Shai-Hulud campaign as compromising the Lightning Python package and Intercom’s npm client, among others, and say it targets both CI environments and developer machines.
- They describe malicious package scripts that launch an infostealer and establish persistence, including through VS Code tasks files. Stolen data may be stored in newly created GitHub repositories; the speakers cite more than 2,000 repositories.
- Suggested precautions include reviewing dependency auto-upgrade policies, pinning dependencies, adding cooldown periods, improving secrets visibility and rotation, and hardening developer tools and AI agents.
Article Details
- Event Type
- Multiple cybersecurity incidents and a software supply-chain campaign, including security exposure at Lovable, a GitHub remote code execution vulnerability, and the Mini Shai-Hulud campaign attributed to Team PCP.
- Impact
- Lovable’s regression reportedly allowed free-account holders to view other users’ source code and chat histories, potentially exposing credentials. The GitHub vulnerability reportedly enabled arbitrary code execution through the -o option on git push. Team PCP’s campaign compromised developer and CI environments and packages including Lightning and the Intercom npm client; the payload stole information and credentials, established persistence, and stored stolen data in newly created GitHub repositories. More than 2,000 affected repositories were reported.
People
Threat Actors
Lazarus GroupNamed in the discussion as the North Korean group associated with earlier campaigns using VS Code tasks-file persistence; the article says Team PCP is not North Korean.Team PCPThreat actor group described as responsible for the Mini Shai-Hulud campaign and compromises involving developer and CI environments and software packages.
Vendors
LovableLovable and Vercel incident response failures: Two AI-native platforms had significant security incidents in recent weeks, and both initially responded by minimizing the severity. We break down why Lovable’s regressionVercelLovable and Vercel incident response failures: Two AI-native platforms had significant security incidents in recent weeks, and both initially responded by minimizing the severity. We break down why Lovable’s regression
Products
ClaudePaul’s EDR flagged his own development environment as infected while he was refactoring a library with Claude. We unpack why AI agents operating at non-human speed trigger the same behavioral signatures asCursorbut it also adds persistence across all your git repos and finds all the places to put things in for Cursor and VS Code. From that point on, once that runs, they have persistence on your machine. This is how TeamGitHubGitHub RCE via git push: A remote code execution vulnerability sitting in GitHub’s codebase for over a decade allowed arbitrary code to be passed and executed via the -o option on a git push. We discuss why thisGitHub Actionsthey’re the original threat actors. Instead, they are this crew that has pivoted to focusing on GitHub Actions and compromising GitHub Actions in a number of ways. The inside baseball I’m hearing is that we’reIntercom npm clientlatest campaign compromised the Lightning Python package (15 million downloads per week) and the Intercom npm client (370,000 downloads per week), among others. We cover what makes this campaign notable: Team PCP haslightningMini Shai Halud by Team PCP: Team PCP’s latest campaign compromised the Lightning Python package (15 million downloads per week) and the Intercom npm client (370,000 downloads per week), among others. We cover whatnpmlatest campaign compromised the Lightning Python package (15 million downloads per week) and the Intercom npm client (370,000 downloads per week), among others. We cover what makes this campaign notable: Team PCP hasPyPIcompromise you initially in CI, and they also have all these packages they’re pushing out in both npm and PyPI. Lightning is a package used, unfortunately, in a lot of AI tech stacks. It’s downloaded 15 million timesVS Codedownloads per week), among others. We cover what makes this campaign notable: Team PCP has adopted the VS Code tasks file persistence technique previously seen only in DPRK-linked campaigns like TasksJacker and