A new variant of the Shai-Hulud npm worm has poisoned hundreds of packages while adding propagation techniques that can leave little trace in the corresponding source repositories. In Frank Herbert’s Dune, Shai-Hulud was the name of the giant self-sustaining desert sandworms that moved silently beneath the surface of the planet Arrakis. So it made sense that when some new self-replicating malware with computer worm-like behavior appeared in September 2025, security researchers would name it after Herbert’s fictional creatures. The latest variant of Shai-Hulud, dubbed “ChainDrop” by Microsoft and others, is no mere sequel, however. Now, the npm community is discovering a Shai-Hulud variant spreading with new stealthy superpowers that circumvent the usual safeguards of open source repositories. On August 4, multiple security researchers identified a large-scale npm supply chain attack using this Shai-Hulud variant that had infected 444 packages from multiple publishers, which are collectively downloaded about 2 billion times a month. The operation targeted widely used deep infrastructure dependencies, such as keyv, flat-cache and cache-manager. Abby Kearns, CEO of enterprise open source security company ActiveState, noted in a Medium post that what is unique about this particular attack is that it doesn’t use the typical methods of breaching the defenses of open source repositories. Even if you never install an infected package (“npm install” in npm argot), you can still get the nasties – though that is one possible route of infection. Once triggered, ChainDrop also places startup hooks into the repository configuration files themselves: Simply opening an infected Git branch in VS Code or Claude Code can bring your repository under ChainDrop’s control. Scouring your code itself may not provide evidence of tampering. ChainDrop propagates not by repository source commits but by tarballs, an archive format for downloading file packages. ChainDrop travels by tarball When executed, the software scours the user’s workspace for npm tokens with full write privileges, as well as for other credentials like cloud keys and secrets. It looks in shell configurations, environment variables and even live memory. Any purloined data is encrypted and sent back to attacker-controlled endpoints. Should it find an npm token, it then downloads the tarballs of all the packages that token has full access to, bypassing the repositories themselves. That’s the genius part: ChainDrop self-replicates by rebuilding the tarball to include its own payload. Reviewing the source code repository won’t reveal any evidence of shenanigans. ChainDrop’s attack is two-pronged. It also searches for GitHub credentials. If it finds any, it queries the GitHub API to list all accessible repositories and branches and then commits its malicious configuration code directly into those branches. So when other developers open these repositories using Claude or VS Code, a background task gets triggered that harvests credentials, beginning the whole cycle anew. What a dev can do This attack is particularly pernicious because npm is widely integrated into automated CI/CD pipelines, which can automatically pull patch updates for dependencies during a rebuild - giving the worm a path to wiggle into fresh builds. If you think you've been infected, the first thing to do is check for any .claude/settings.json and .vscode/tasks.json files you did not add yourself, ActiveState’s Kearns advised. And don’t just check the main branch, but all the other branches as well. All the infected packages were quickly yanked from npm. Open source security firm SafeDep offers a list of all the compromised packages along with version numbers, so check those against what you currently have running. Beyond cleaning up the mess, developers and security teams should rethink how their systems could be breached in light of ChainDrop. Trusted publishing tools such as GitHub Actions should be evaluated, for starters. Begin “treating repository-supplied configuration as executable content, because that is what it is now,” Kearns wrote. “What this campaign really found was an execution path that dependency scanning tools were not configured to look at, sitting inside the exact tools engineering organizations have spent two years adopting as fast as they could,” Kearns wrote. “This is the first campaign to notice the gap and use it at scale. It will not be the last one.” ®

Lego has released its largest Hubble Space Telescope yet – a model built at approximately minifig scale that dwarfs the observatory included with its Space Shuttle Discovery set. The first thing to say about this set is that there is an awful lot of grey. This is perhaps the greatest weakness of an otherwise excellent set and feels a little penny-pinching on the part of the Danish brick botherer. Lego has produced several versions of Hubble over the years. There is a version to fit in the payload bay of its large Space Shuttle Discovery set, and a much smaller incarnation on a plinth in the Women of NASA set. Both are retired, so scratching that Hubble itch with a current official set means dropping £119.99 on the Icons Hubble Space Telescope. It's a large set. According to Lego, the 1,252-piece set measures 32 cm tall, 38 cm long (with the aperture door open), and 38 cm wide. An astronaut minifigure is included to indicate the model's approximate scale – a shame there's just one, since the servicing missions had a pair of spacewalkers – along with a power tool. There is also a stand featuring some of Hubble's iconic imagery and a plaque with more information, including the dates of the Space Shuttle servicing missions. Lego has not included replacement instruments to recreate the various servicing activities. Inside are Lego representations of Hubble's instruments and systems, including its gyroscopes, primary mirror, and secondary mirror. Outside are posable solar arrays and antennas, along with an aperture door that opens. Some parts are a little fiddly, and the set is aimed at ages 18+. That seems a little on the high side, but this isn't something you'd want a young child trying to build. The level of detail is impressive, considering the nature of Lego components, but it is difficult to avoid all that grey plastic. The Hubble Space Telescope included with the Space Shuttle Discovery Icons set uses silver bricks, which makes the choice of grey plastic feel cheap in comparison. And then there are the stickers. Thankfully, there aren't too many, but printed parts are readily available, and Lego uses its own, so why make builders fiddle with sticker alignment? And then there are the solar arrays, which are single-sided and feel a little cheap compared with the arrays on some of the MOCs The Register has built over the years. Still, these are minor niggles in what is otherwise a fun build lasting 6-12 hours. The set is an excellent addition to the Icons range, but such is the affection for Hubble that details matter. The set also acknowledges Hubble's 35th anniversary, celebrated in April 2025, with a "35" decal on the back of the astronaut minifigure. The real thing continues to orbit, although its days are likely numbered. The Lego version is likely to endure until a careless elbow knocks it off the shelf, or a creative builder decides to repurpose its components for an orbital animal amusement park. Which, after all, is the whole point. ®

In an effort to "watermark" text that Claude has generated and comply with the EU AI Act, Anthropic unveiled a plan on Friday to modify its bots' choice of words in a way that would be detectable as the product of an AI. Traditional watermarks are patterns or images overlaid on currency, postage, or official documents as an assertion of authenticity. In the digital realm, the term is more flexible and can refer to a variety of techniques for applying an identifier to electronic data. Anthropic's approach involves influencing inconsequential word choices made by its models, a technique introduced in Google DeepMind's SynthID-Text paper. To oversimplify things, large language models are fancy autocomplete engines which work by predicting the next word in a sequence of words. Anthropic explains that while composing sentence output like "The weather today was cold and…" a model like Claude might respond with words like "cold" or "gray" and would be unlikely to respond with a word like "sugary." That's the theory, but when actually asked to complete that sentence, Claude Opus 4.8 went a bit overboard: "…crisp, the kind of cold that nips at your fingertips and turns your breath to little clouds. The sky was a pale, washed-out blue, and everything felt sharp and clear." And then it checked to see if users thought that was useful, asking， "Want me to take it somewhere specific — cozy, gloomy, cheerful? Or keep going with the same tone?" But remove whatever training has been applied to promote engagement and simulate literary style, and that's basically what Claude is doing here – predicting the next word in a sequence. Anthropic asserts that in most cases, the example sentence could be completed by either "cold" or "gray" and "the meaning of the sentence is largely the same either way." The watermark is generated by deviating from the predicted word to something else. A different source of randomness is used and that can be detected with a digital key. As Google DeepMind researchers explain in their paper: "Generative watermarking works by carefully modifying the next-token sampling procedure to inject subtle, context-specific modifications into the generated text distribution. Such modifications introduce a statistical signature into the generated text; during the watermark detection phase, the signature can be measured to determine whether the text was indeed generated by the watermarked LLM." Anthropic insists this will be done with low-stakes passages in a way that won't alter the meaning. "In internal testing, we’ve seen no impact of watermarking on the content, level of creativity, or readability of Claude’s text," the company said, adding that in a controlled study, human raters saw no difference in quality between watermarked and unwatermarked answers. That assumption hinges on not applying the watermark to any consequential text. As Anthropic puts it, "Watermarking is sparser on factual passages where there are fewer choices that can be made without decreasing the accuracy of the text." The biz goes on to say that the situation is similar with code – the watermarking algorithm can't simply start swapping method names. In the context of literature, the notion that some words are interchangeable is likely to raise a few hackles. While it may be a satisfying thought experiment to imagine Claude emitting, "It was the best of times, it was the least of times…" or "Telephone me Ishmael", anyone trying to pass off generated text as serious writing probably should face whatever social backlash watermarking may entail. On the plus side, Anthropic's flavor of watermarking isn't excessively intrusive. It doesn't involve any personally identifying information and only serves to indicate that Claude was probably involved at some stage of the creation of the marked text. What's more, the technique is expected to be only semi-effective. In its FAQs, Anthropic points out that some amount of editing should erase the watermark. "Light editing probably won’t remove the watermark completely; a complete rewrite where every word is replaced will," the company said. "In the latter case, of course, it’s arguable whether the text can any longer be described as AI-generated." In all likelihood, Anthropic doesn't care if its watermarking scheme can be defeated. The company's post makes clear that it is implementing it to demonstrate its attempts at compliance and has chosen a solution that doesn't raise costs. "Watermarking has a negligible impact on the speed of models, and because it produces no extra tokens, the model is the same price to serve and use," the biz said. Hey Claude, what's another word for performative compliance? ®

DeepSeek has piqued the interest of the developer community by releasing an early version of its open source agent harness. This happens as harnesses have become increasingly important to those working with machine learning models. "Powered by the Cordis meta-framework, DeepSeek Harness is an agent harness built around one core idea: Everything is a plugin," the China-based AI biz said. "Models, tools, skills, sessions, sandboxes, filesystems, loops, orchestration, and UI are ALL implemented as plugins, and can be mixed, matched, replaced, and extended." The term "harness" came into common use this year to describe a longstanding software function – middleware or a mediation layer that handles the input passed to an AI model and the output returned from it. Harnesses oversee prompts, context management, tool orchestration, the agent loop, state management, error handling, safety, permissions, and related concerns. Claude Code serves as a harness for Anthropic's Claude model family and Codex performs a similar function for OpenAI's GPT model family. And there are many other model harnesses, including Aider, Cline, Goose, OpenCode, OpenHands, and Pi, to name a few. The term isn't precise: It may be used to refer just to the agent loop and tools, or it may be extended to a broader set of concerns related to orchestrating different tools, services, and capabilities like sandboxing, subagents, and so on. Google Antigravity, for example, consists of the Antigravity Agent Runtime (harness) that can be accessed through the Agent SDK, the Antigravity 2.0 desktop application, and the Antigravity CLI. Vague definitions aside, AI model harnesses are now where much of the competition is happening, particularly as models proliferate and become commoditized. The harness often implements the user interface, a source of user inertia, and once developers configure their tooling and become accustomed to doing things a certain way, it becomes more burdensome to switch to a competing product, even if the interface consists mainly of a command line. What's more, various studies have suggested that model performance (and cost) varies significantly with the harness used, due to different design choices. For example, the Pi coding agent relies on a minimal system prompt of about 200 tokens. Claude Code by comparison uses a system prompt of around 10,000 tokens (or did until last month when Anthropic trimmed the system prompt by about 80 percent). The same model will produce different results with different harnesses. DeepSeek Harness is noteworthy because of its innovative design, and because it shows Chinese AI labs moving to compete beyond model benchmarks and pricing. First, it treats everything as a plugin. It uses the plugin system from its underlying Cordis framework, which is designed to make it possible to add and remove components dynamically without wreaking havoc. "Plugins provide every agent capability, including models, tools, skills, sessions, sandboxes, storage, loops, scheduling, and the UI," the DeepSeek Harness website explains. "Cordis services and events let the plugins work together. Developers can select, swap, or extend any capability in configuration without changing the DeepSeek Harness source code." A DeepSeek paper [PDF] by researchers Yifan Shi, Wei Zhang, and Tianyi Cui explains the function of Cordis in more detail. Cordis is designed to support dynamic composability – adding plugins and removing them on the fly without breaking the application. The paper refers to this as temporal composability – removing a component and reverting its effect upon removal – and spatial composability – allowing components to manage dependencies upon other components. It cites as an example the plugin system used by Microsoft's Visual Studio Code. VS Code, the authors explain, runs all of its extensions in a shared process called the extension host. Once activated, they cannot be removed on the fly; the host has to be restarted. While VS Code provides a way for extensions to declare dependencies between extensions, it's seldom used. DeepSeek Harness supports plugin dependencies. The DeepSeek researchers argue temporal and spatial composability are necessary in a system where modification can occur continuously with little or no human oversight. It's a way of avoiding forced restarts and crashes when components appear and disappear. DeepSeek Harness also supports another useful feature: chain of thought traces. "Everything the model sees is recorded in an append-only session log: system prompts, reasoning, tool calls and results, subagent scheduling, and every context injection," the DeepSeek Harness website says. "In the Trajectory view, you can inspect these records by source. Resume, fork, search, and replay all operate on the same event stream." DeepSeek R1 made waves when it was released last year and it was trained to use chain of thought reasoning. This involves breaking down prompts into a series of "thoughts" and reflecting on those steps before emitting a final answer. Access to this intermediate reasoning turns out to be useful for assessing whether a model is reasoning well, whether its responses are accurate, how additional "thinking" affects output, and so on. Anthropic provides some access to thinking when extended or adaptive thinking is available (it varies by model). But increasingly the biz has been hiding model reasoning by summarizing chain of thought traces. That appears to be due in part to concerns that chain of thought traces can be used for copying models through a standard research process called distillation. Earlier this year, Anthropic said it had implemented classifiers for the "detection of chain-of-thought elicitation used to construct reasoning training data." The company also does not display raw chain of thought. It explains that "the text in a thinking block is a summary of Claude's reasoning." Accessing raw thinking requires contacting Anthropic sales personnel. Except for its open source models, OpenAI has also chosen to hide chain of thought reasoning, which the company uses for model monitoring. "After weighing multiple factors including user experience, competitive advantage, and the option to pursue the chain of thought monitoring, we have decided not to show the raw chains of thought to users," the biz said two years ago when it introduced its o1 reasoning model. With the newly released DeepSeek-V4-Pro and V4-Flash, the API provides thinking mode enabled by default. And as the open source model ecosystem matures, having access to chain of thought looks likely to become another opportunity for competitive differentiation. "I don't think the DeepSeek Harness is perfect but this is for sure the first time I have been looking at something new in the space and felt quite inspired to revisit some of our choices," said Armin Ronacher, co-founder of AI biz Earendil, which now steers the development of the Pi agent, in a social media post. "I love that part about Open Source a lot!" ®

Some 1.6 million unique email addresses tied to RingCentral have been leaked online, alongside names, physical addresses, and phone numbers, according to Have I Been Pwned. RingCentral disclosed the breach on July 28 and said “it was the target of a sophisticated social engineering campaign” affecting a “limited portion of RingCentral customers.” The comms platform said that it promptly responded to the intrusion upon detecting it, “took steps to stop the unauthorized activity,” and immediately launched an investigation into the security incident with help from a “leading third-party forensic firm.” “We have not seen any new unauthorized activity since taking these remediation efforts,” the company added. RingCentral did not immediately respond to The Register’s request for comment on this story. We will update it as needed. While the company hasn’t named its attacker, notorious data theft and extortion gang ShinyHunters previously claimed it compromised the collaboration platform, according to a post on its data leak site, viewed by The Register. Screenshots of the post also circulated on social media. The crooks claimed they stole more than 623 GB of data, and set a July 30 deadline for RingCentral to pay up - or else the crew would dump the stolen information online. RingCentral apparently didn’t pay the extortion demand, and ShinyHunters followed through on its threat, posting customers’ details on the internet. “The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don’t care,” the crims wrote on August 3. A ShinyHunters spokesperson told us that the group broke into RingCentral by voice-phishing an employee and tricking them into giving the crooks their password. This same group, which security sleuth Dominic Alvieri says is his “top threat group and probably is for most analysts,” has hacked hundreds of organizations since the start of the year, including education tech firms that provide services for schools and universities along with healthcare-sector organizations. Recently, ShinyHunters dumped data stolen from Abbott’s cancer diagnostics business with the leak containing 10.9 million unique email addresses alongside personal and health information. The crooks claim that they made off with more than 30 million rows of customer information, including more than one million Social Security numbers and 7.5 million dates of birth. More concerning, however, they said the haul includes 22 million-plus rows of client notes containing confidential doctor-patient conversations and health information, and more than 20 million medical-order records containing patient IDs, prescription types, order dates, and refill information.® Editor's note: This story was amended post-publication with comment from ShinyHunters.