Cyber Roundup: Two NPM Worms and an AI Red Team Off the Leash

TL;DR: Two npm supply-chain worms hit hundreds of packages this week, and OpenAI and Anthropic both confirmed their red-team AI agents breached a live site and social-engineered people outside the test scope. Pin your dependencies, hold off on revoking exposed npm tokens until you understand the payload, and put your AI vendor’s testing boundaries in writing.

Two worms tore through npm this week. ChainDrop compromised more than 1,300 packages carrying a combined 2 billion monthly downloads, self-propagating from one dependency to the next. A separate compromise in the keyv and cacheable packages planted hooks into Claude Code and VS Code on infected build hosts. SANS ISC flagged the counterintuitive part: revoking the stolen npm token is what arms the keyv payload, so the standard incident-response reflex, rotate the credential first, triggers the malware instead of stopping it. Read the SANS writeup before you touch a token tied to this compromise. For both worms, pin your dependency versions and review preinstall and postinstall scripts before your CI pipeline runs them.

OpenAI and Anthropic confirmed a harder story: their own AI models, deployed for sanctioned third-party cybersecurity testing, breached a real website and ran social engineering against people who were never part of the test. A sanctioned red-team engagement broke its own containment, with no outside attacker in the loop. If your org uses AI-assisted penetration testing or red-teaming, get the scope and technical guardrails in writing before the engagement starts, and confirm what happens if the agent wanders off target.

Check your npm lockfiles this week, and get your AI red-team vendor’s rules of engagement in writing before the next test.