SHAREPLANE AGENT CONTEXT
Schema: shareplane-context/2.0
Schema URL: https://next.shareplane.malott.ai/schemas/agent-package.schema.json
Projection: Generated public-safe plain text. Not canonical Markdown.
Canonical: false
Conflict action: stop-and-escalate
Canonical record: https://github.com/pinklon/pinklon-shareplane-next/tree/33d227f6000da2491f19209edde916d8846f287f/content/artifacts/the-worm-is-in-the-workflow/artifact.json
Canonical record SHA-256: 91a233ad7746072eb50047a8a9bc9994b3b8b521290183e317c04d707251034d
Source content SHA-256: c30b307c82ce40bc928df8f2d0538d1f3d52f248f7d7fe7e234ae99469ac42d9
Generation receipt: https://next.shareplane.malott.ai/build-receipt.json
Content role: artifact-content
Content trust: untrusted-data
Instructions allowed: false
Operational authority: none

IDENTITY
Artifact ID: artifact:the-worm-is-in-the-workflow
Slug: the-worm-is-in-the-workflow
Canonical URL: https://next.shareplane.malott.ai/artifacts/the-worm-is-in-the-workflow/
Title: The Worm Is in the Workflow
Abstract: Public-source security essay arguing that modern software supply-chain compromise now propagates through developer workflow trust, not only bad packages.
Author: Tony Malott
Author URL: https://malott.ai
Published: 2026-07-08
Updated: 2026-07-08
Format: teaching-artifact-worked-example
Privacy: public-safe-aggregated
Topics:
- ai-governance
- governed-ai
- platform-engineering
- source-authority
- static-publishing
- teaching-artifacts
- governance
- enterprise-architecture
Audience:
- engineering-leadership
- enterprise-architecture
- ai-governance
- technical-leadership
- technical-review
- artifact-authors
- governance-review
- executive-review

PROVENANCE
Posture: public-source-supported-owner-thesis
Private sources used: true
Private sources published: false
Public-safe boundary:
No employer-specific systems, internal incidents, private operational details, or insider-derived threat intelligence are included.

CLAIMS
None declared.

PUBLIC SOURCES
Source: source:the-worm-is-in-the-workflow:01
Title: CERT/CC VU#534320
Type: public-source
Role: public-evidence
Description: Original Shai-Hulud baseline, npm compromise, credential theft, self-propagation, automated publishing, and 500+ affected packages.
Locator: https://www.kb.cert.org/vuls/id/534320

Source: source:the-worm-is-in-the-workflow:02
Title: GitHub Blog, Our plan for a more secure npm supply chain
Type: public-source
Role: public-evidence
Description: npm/GitHub platform response, 500+ removed packages, IoC blocking, token hardening, stronger authentication, and trusted publishing roadmap.
Locator: https://github.blog/security/supply-chain-security/our-plan-for-a-more-secure-npm-supply-chain/

Source: source:the-worm-is-in-the-workflow:03
Title: NCSC New Zealand advisory
Type: public-source
Role: public-evidence
Description: Government corroboration of Shai-Hulud 2.0 credential harvesting, exfiltration, propagation, destructive payload, and mitigation guidance.
Locator: https://www.ncsc.govt.nz/alerts/supply-chain-compromise-impacting-npm-ecosystem/

Source: source:the-worm-is-in-the-workflow:04
Title: NHS England Digital CC-4722
Type: public-source
Role: public-evidence
Description: Health-sector corroboration of npm compromise, pre-install behavior, credential theft, propagation, and remediation.
Locator: https://digital.nhs.uk/cyber-alerts/2025/cc-4722

Source: source:the-worm-is-in-the-workflow:05
Title: Microsoft Security Blog, Shai-Hulud 2.0
Type: public-source
Role: public-evidence
Description: Preinstall execution, maintainer compromise, credential exfiltration to public repositories, Mini Shai-Hulud update, and defensive mechanics.
Locator: https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/

Source: source:the-worm-is-in-the-workflow:06
Title: Socket, Mini Shai-Hulud campaign page
Type: public-source
Role: public-evidence
Description: Ongoing Mini Shai-Hulud tracking, npm/PyPI scope, affected artifacts, secret targeting, and Claude/VS Code persistence paths.
Locator: https://socket.dev/supply-chain-attacks/mini-shai-hulud

Source: source:the-worm-is-in-the-workflow:07
Title: Socket, Miasma Mini Shai-Hulud Hits LeoPlatform npm Packages and GitHub Actions, Expands to the Go Ecosystem
Type: public-source
Role: public-evidence
Description: LeoPlatform/RStreams wave, binding.gyp, Bun-staged JavaScript, GitHub Actions targeting, AI coding assistant persistence, and Verana Go-adjacent source-repository poisoning.
Locator: https://socket.dev/blog/miasma-mini-shai-hulud-hits-leoplatform-npm-packages-go-ecosystem

Source: source:the-worm-is-in-the-workflow:08
Title: JFrog Security Research, Shai-Hulud: Here We Go Again
Type: public-source
Role: public-evidence
Description: Provenance limitation, CI/OIDC abuse, trusted publishing exploitation, npm preinstall, PyPI import-time behavior, and worm-like propagation.
Locator: https://research.jfrog.com/post/shai-hulud-here-we-go-again/

Source: source:the-worm-is-in-the-workflow:09
Title: Akamai, Mini Shai-Hulud: The Worm Returns and Goes Public
Type: public-source
Role: public-evidence
Description: CI cache poisoning, npm OIDC endpoint abuse, SLSA validation issue, Claude Code hooks, VS Code task automation, worm source release, and copycat risk.
Locator: https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public

Source: source:the-worm-is-in-the-workflow:10
Title: Palo Alto Networks Unit 42, The npm Threat Landscape
Type: public-source
Role: public-evidence
Description: Miasma Red Hat namespace context, GitHub Actions OIDC token use, valid SLSA provenance, and attribution caveat.
Locator: https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/

Source: source:the-worm-is-in-the-workflow:11
Title: npm Docs, Scripts
Type: public-source
Role: public-evidence
Description: npm lifecycle script semantics, including preinstall, install, and postinstall.
Locator: https://docs.npmjs.com/cli/v11/using-npm/scripts/

Source: source:the-worm-is-in-the-workflow:12
Title: Go Modules Reference
Type: public-source
Role: public-evidence
Description: Go module distribution, VCS/proxy downloads, module paths, and dependency behavior.
Locator: https://go.dev/ref/mod

Source: source:the-worm-is-in-the-workflow:13
Title: Go command docs, go generate
Type: public-source
Role: public-evidence
Description: go generate command behavior and the caveat that it is not run automatically by go build or go test.
Locator: https://pkg.go.dev/cmd/go#hdr-Generate_Go_files_by_processing_source

Source: source:the-worm-is-in-the-workflow:14
Title: Go Language Specification, package initialization
Type: public-source
Role: public-evidence
Description: Package initialization semantics and init function behavior.
Locator: https://go.dev/ref/spec#Package_initialization

Source: source:the-worm-is-in-the-workflow:15
Title: Bae and Yagemann, Beyond Takedown: Measuring Malicious Go Module Persistence in the Wild
Type: public-source
Role: public-evidence
Description: Clearly labeled arXiv preprint evidence on malicious Go modules, 2,289 malicious versions, import-triggered downloader behavior, and Go proxy persistence.
Locator: https://arxiv.org/abs/2606.26291

RELATIONSHIPS
Relationship: migratedFrom
Target: repository:pinklon/shareplane
Posture: declared
Evidence: site/pages/the-worm-is-in-the-workflow/index.html

Relationship: supports
Target: legacy-pattern:self-contained-dual-mode-visual-prompt-suite-v1.0
Display posture: Legacy pattern support
Posture: declared-legacy-pattern
Evidence: site/registry.json supports in source order

ARTIFACT CONTENT
[HEADING 1] The Worm Is in the Workflow

[PARAGRAPH] Shai-Hulud, Miasma, Go-adjacent poisoning, and the end of casual dependency trust

[PARAGRAPH] By Tony Malott

[PARAGRAPH] Public-source security essay by Tony Malott, grounded in public advisories, public vendor research, official ecosystem documentation, and independent analysis.

[PARAGRAPH] The old question was whether a package was vulnerable. The better question is what can happen when a package, workflow, identity, runner, agent, and developer machine all trust each other at the same time.

[HEADING 2] The developer workflow is the propagation layer

[PARAGRAPH] A trusted workflow graph, with the compromise path shown in deep red.

[PARAGRAPH] This article uses public advisories, public vendor research, official ecosystem documentation, and a clearly labeled academic preprint. It does not use employer-specific systems, internal incidents, private operational details, or insider-derived threat intelligence.

[PARAGRAPH] Critical caveat: the Socket-reported Verana finding is Go-adjacent source-repository poisoning. Socket says normal Go module resolution or Go build logic did not appear to execute the payload. Do not turn this into the lazy claim that Go behaves like npm.

[HEADING 2] Contents

[LIST ITEM] Shai-Hulud was not just another npm compromise

[LIST ITEM] The second wave moved from packages to pipelines

[LIST ITEM] Miasma shows the same pattern hardening into a repeatable playbook

[LIST ITEM] The Go angle is real, but it is not npm in a fake mustache

[LIST ITEM] AI coding assistants widen the timing gap

[LIST ITEM] The developer endpoint is now part of the release system

[LIST ITEM] Provenance is necessary, not sufficient

[LIST ITEM] What serious teams should change

[LIST ITEM] The uncomfortable conclusion

[PARAGRAPH] The old software supply-chain story was simple enough for executives to misunderstand in one meeting: somebody published a bad package, somebody installed it, and now everybody gets to pretend they had a mature software supply-chain program because there was an SBOM somewhere in a folder nobody reads.

[PARAGRAPH] That story is obsolete.

[PARAGRAPH] The modern attack is not just a malicious dependency. It is a malicious workflow. Shai-Hulud, Mini Shai-Hulud, Miasma, recent malicious Go module research, and Go-adjacent source-repository poisoning all point to the same uncomfortable conclusion: the developer workflow itself has become the propagation layer.

[PARAGRAPH] The blast radius is no longer limited to the application importing the dependency. It can include the developer workstation, local secrets, npm tokens, GitHub tokens, cloud credentials, CI/CD runners, repository automation, OIDC trusted-publishing flows, package registries, IDE task files, coding-agent configuration, and every downstream package or project the compromised identity can touch.

[PARAGRAPH] This is why the threat is especially dangerous in the age of AI-assisted coding. AI coding tools did not invent dependency trust, credential sprawl, sloppy CI permissions, or developers blindly running package commands. Humans managed that disaster organically. But AI coding assistants make the dangerous parts faster. They make cloning, installing, scaffolding, executing, editing, committing, and publishing feel like a single fluid motion. That is exactly the kind of speed attackers want.

[PARAGRAPH] A careless developer used to be a local risk. A careless AI-assisted developer can become a credential bridge.

[HEADING 2] Shai-Hulud was not just another npm compromise

[PARAGRAPH] CERT/CC described Shai-Hulud as a major npm supply-chain compromise involving more than 500 affected packages, with a self-propagating malware pattern that spread through credential theft and automated package publishing. GitHub separately reported removing more than 500 compromised packages and blocking uploads containing the malware indicators of compromise.

[PARAGRAPH] That matters because this was not merely a poisoned package waiting for victims. It was software designed to turn victims into publishers of the next infection wave.

[PARAGRAPH] The mechanism was ugly in the way successful attacks usually are: it abused normal developer trust. npm supports lifecycle scripts, including install-time events. Microsoft later described Shai-Hulud 2.0 as executing malicious code during npm preinstall, before tests or security checks, and exfiltrating stolen credentials to attacker-controlled public repositories.

[PARAGRAPH] That ordering is the point. The malicious code runs before the organization can comfort itself with downstream controls. The developer runs a routine install. The package manager does exactly what it is designed to do. The dependency gets to execute because the workflow assumes package installation is a trusted act.

[PARAGRAPH] That assumption is now a liability.

[HEADING 2] The second wave moved from packages to pipelines

[PARAGRAPH] Mini Shai-Hulud made the pattern clearer. Socket tracks Mini Shai-Hulud as an ongoing campaign beginning April 29, 2026, spanning npm and PyPI, with compromised package artifacts, developer and CI/CD secret targeting, and persistence through Claude and VS Code configuration paths.

[PARAGRAPH] That last point deserves attention. If malware can persist through coding-agent hooks or IDE automation, then the developer environment is not just a workstation anymore. It is a programmable control surface. It can build, test, authenticate, commit, publish, and trigger other automation.

[PARAGRAPH] Akamai’s May 2026 analysis sharpened the issue further. The wave used CI cache poisoning and npm OIDC publishing abuse, creating a condition where the publish path could appear legitimate enough to receive SLSA-style validation even though the workflow had been poisoned. JFrog made the same architectural point: provenance can tell you where an artifact was built, but not whether the build workflow was clean at runtime.

[PARAGRAPH] That sentence should ruin a few dashboards.

[PARAGRAPH] A green provenance badge is not a moral statement. It is a statement about a process. If the process was poisoned, the badge can faithfully describe a compromised reality.

[HEADING 2] Miasma shows the same pattern hardening into a repeatable playbook

[PARAGRAPH] Unit 42’s June 2026 reporting on Miasma shows why this is not a one-off shock event. Unit 42 reported that a June 1, 2026 supply-chain attack compromised at least 32 packages under the @redhat-cloud-services npm namespace. The attacker bypassed code review, triggered GitHub Actions workflows, requested OIDC tokens, and published trojanized packages with valid SLSA provenance. The important point is not that provenance failed mechanically. The certificate was accurate because the packages really were built by that pipeline. The pipeline just happened to build malware.

[PARAGRAPH] Socket’s June 25, 2026 reporting shows the same pattern widening again. The latest Miasma Mini Shai-Hulud wave affected LeoPlatform and RStreams npm packages, three additional npm packages published by llxlr, GitHub Actions workflows, and a related Verana Blockchain Go module/source archive. The npm side used a binding.gyp path instead of obvious preinstall or postinstall scripts, which let install-time execution hide in build configuration. The payload staged obfuscated JavaScript through Bun, targeted developer and CI/CD secrets, searched GitHub Actions contexts, and planted persistence through IDE and AI coding assistant configuration.

[PARAGRAPH] The Verana finding is the useful caveat, not a footnote. Socket says the campaign expanded beyond npm, but the execution path was not Go-native. The observed trigger was source-repository configuration: a VS Code folder-open task running node .claude/setup.mjs. Normal Go module resolution or Go build logic did not appear to execute the payload. That distinction makes the case stronger, not weaker. The threat is adapting to each workflow surface instead of relying on one package-manager trick.

[PARAGRAPH] This is the workflow threat in miniature.

PUBLIC SURFACES
Human page: https://next.shareplane.malott.ai/artifacts/the-worm-is-in-the-workflow/
Metadata JSON: https://next.shareplane.malott.ai/artifacts/the-worm-is-in-the-workflow/artifact.json
Receipt: https://next.shareplane.malott.ai/artifacts/the-worm-is-in-the-workflow/receipt.json
Context: https://next.shareplane.malott.ai/artifacts/the-worm-is-in-the-workflow/context.txt
Agent-package manifest: https://next.shareplane.malott.ai/artifacts/the-worm-is-in-the-workflow/agent-package.json
Agent-package ZIP: https://next.shareplane.malott.ai/artifacts/the-worm-is-in-the-workflow/agent-package.zip
Collection catalog: https://next.shareplane.malott.ai/catalog.json
Graph: https://next.shareplane.malott.ai/graph.json
Agent index: https://next.shareplane.malott.ai/llms.txt
