A library for vibers building vibeware.

In October 2026 an AGENTS.md file that nobody had written appeared in a developer's Downloads folder. When a coding agent was started there, it read the file as project instructions and tried to install function-color, an npm package from the MALFEX campaign. The install was blocked. The researchers who caught it then showed that a web page can drop such a file without a click, that Codex followed a planted file into editing its own config.toml in more than 90% of trials, and that a CLAUDE.md variant got Claude Code to write an API base URL that leaked the login token. No vendor bug, nothing to patch: the agent did what an instruction file told it to.

On October 21, 2026 an attacker holding three LiteLLM developers' GitHub CLI credentials overrode branch protection, pointed the release workflow at a lookalike repository, and published litellm 1.107.0 to PyPI and Docker Hub. The wheels drop cook.pth, cook.py and sitecustomize.py into site-packages, so every Python process on the host reruns a credential stealer, pip included, and the payload targets cloud credentials, SSH keys, and the auth files of AI coding tools. PyPI pulled it after 1 hour 43 minutes; the hosts that installed it in that window are the incident.

On October 21, 2026 the PHP project released fixes for two engine bugs, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remote code execution in every SAPI that serves web requests. Honeypots saw exploitation within three days and CISA added both to its Known Exploited Vulnerabilities catalog on October 26. The bug is in PHP itself, so the application on top does not matter: WordPress, Laravel, a vibe-coded admin panel, all equally exposed until the runtime moves to 8.2.35, 8.3.36, 8.4.27 or 8.5.12.

Overnight on October 16 to 17, 2026 an attacker got into a legacy part of the OpenCode Console, the hosted side of the open-source coding agent, and may have taken the third-party provider keys stored in users' workspaces. OpenCode said 1.4% of Console users were affected, all of them people who had linked an external provider, and told them to revoke and replace the keys and review usage for charges. The agent on the laptop was never involved; the key custody was.

In late September 2026 an internet-wide study took the Supabase project URL and anon key that thousands of sites publish in their JavaScript, asked each database for a table called users, and 16,326 of roughly 300,000 domains handed back rows. More than half held personal information; a smaller share exposed passwords and auth tokens. No product flaw: Row Level Security is on by default for tables made in the dashboard, and off for tables created programmatically, which is the route a coding agent takes.

On August 25, 2026, Next.js shipped 15.5.24 and 16.3.3 to close two unauthenticated remote code execution advisories. One reaches back to Next 10.0.0 through the Image Optimization API. The other affects Windows-hosted servers and has no workaround. The second half of this report is about what happened the next day, when the aggregated advisory feeds had not caught up yet and the reflex check still reported nothing.

On August 17, 2026, five vm2 advisories went public and the answer was to upgrade to 3.11.6. On August 24, ten more were published, several of them naming 3.11.6 as the affected version, one at CVSS 10.0 described as an incomplete fix for the first round. A developer who patched promptly spent a week on the single version the second wave was aimed at. This is a field report about what that says for sandboxing untrusted code in a Node process at all.

Between August 10 and August 26, 2026, six products that run coding agents published advisories describing the same failure. A tool call that was supposed to stop and ask a human did not stop. VS Code, Cursor, Continue CLI, CodeWhale, Amazon Strands and goose each shipped a way for an agent to reach the shell, the filesystem or a privileged container without the consent gate firing. This is a field report about why that gate carries more weight than it can hold, and what bounds the damage when it fails.

On August 4, 2026, a hijacked maintainer GitHub account published malicious versions across the keyv and cacheable package families, libraries with roughly two billion combined monthly downloads, and the Shai-Hulud worm rode them into hundreds of downstream packages within hours. The persistence hides in AI coding agent configuration, and the dead-man-switch from the May wave is back, so the response sequence matters as much as the detection.

A review of the May 12 to July 25, 2026 npm window produced a long list of claimed compromises and three that could be confirmed against a primary advisory. This is a field report about the gap between those two numbers, why it is growing, and how to check a supply-chain claim before you act on it.

84 malicious versions across 42 @tanstack/* packages published in a six-minute window on May 11, 2026, exploiting GitHub Actions to publish with valid SLSA provenance. If you installed any affected version on May 11, your machine and CI environment should be treated as compromised, and there is a specific defensive sequence that matters.

April 29, 2026: the second confirmed wave of the Mini Shai-Hulud worm. Targeted SAP CAP toolchain packages including @cap-js/sqlite and @cap-js/db-service. Same threat actor (TeamPCP) that would later run the May 11 TanStack wave at 4x scale. 1,800+ machines compromised, credentials exfiltrated from ~1,200 GitHub repositories.

Two April 2026 supply-chain incidents from overlapping actor groups. Bitwarden CLI 2026.4.0 (April 22) shipped a backdoored release of the official password-manager CLI that explicitly hunted Claude, Cursor, and Codex credentials. Seven days later, intercom-client 7.0.4 / 7.0.5 and lightning 2.6.2 / 2.6.3 (April 29) carried the same Mini Shai-Hulud credential stealer with combined ~8.3M downloads exposure.

On March 31, 2026, the DPRK-aligned actor Sapphire Sleet published axios 1.14.1 and 0.30.4 with a hostile dependency on plain-crypto-js. Any install pulled a RAT through axios postinstall. The incident moved npm cooldown advice from "nice to have" to default-on in CI hardening guides.