GitHub OIDC trusted-publishing solved the stored-credential problem and created a new attack surface in the same motion: three independent actors exploited it in a single week, producing malicious packages carrying valid provenance attestations.
The Mini Shai-Hulud worm now operates inside Red Hat's official npm namespace, proving that vendor-maintained packages are viable supply chain targets; simultaneously, the first confirmed AI-assisted ransomware toolchain documents a qualitative shift in what moderately skilled operators can build.
Microsoft's Fox Tempest takedown exposes a criminal market for code-signing trust sold per payload; a PAN-OS zero-day with six weeks of state-sponsored exploitation went unreported through all of W21; and Shai-Hulud nearly doubled in scope with Grafana's source code as the first named downstream casualty.
Three independent threat campaigns in early 2026 (the North Korea-attributed Contagious Interview operation, the GlassWorm Zig-dropper IDE extension malware, and the TeamPCP cascading supply chain compromise) converged on the same conclusion: developer workstations are now the highest-value initial access target in enterprise environments. The convergence is a price signal, not a coincidence.
The rapid exploitation of CVE-2026-42208 in LiteLLM marks the first confirmed weaponization of the AI API proxy layer, while TeamPCP's new ransomware partnership turns out to be a wiper with no recovery path.
Security