Supply Chain Worms, AI Tooling Weaponization, and the Expanding Attack Surface for State Government Networks

Public Sector

Published on

May 19, 2026

Table of Contents

Threat Assessment Level: ELEVATED (trending toward HIGH) <h2> Executive Summary </h2> State government IT leaders face an unprecedented convergence of supply chain attacks, identity infrastructure exploitation, and novel persistence techniques targeting developer tooling and AI coding assistants. In the past 48 hours, a self-propagating npm worm compromised hundreds of packages — including libraries with over one million weekly downloads — while a separate VS Code extension compromise demonstrated the ability to forge cryptographic supply chain provenance attestations. Simultaneously, Russian intelligence services have forced NATO allies to abandon Signal for government communications, and Siemens issued seven new ICS advisories affecting systems deployed in state water and transportation infrastructure. This is not theoretical. If your developers ran npm install on affected packages in the last 24 hours, credentials have already been exfiltrated. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Date </th> <th> Impact to State Government </th> </tr> </thead> <tbody> <tr> <td> Mini Shai-Hulud npm worm — Wave 3 (@antv ecosystem, echarts-for-react, timeago.js) </td> <td> May 19 </td> <td> Any state developer using affected packages has had CI/CD secrets, npm tokens, and cloud credentials stolen. Worm self-propagates using stolen tokens. </td> </tr> <tr> <td> Nx Console VS Code extension compromise (2.2M installs) </td> <td> May 18 </td> <td> 11-minute exposure window. Harvests 1Password vaults, AWS/GitHub/npm credentials. Introduces Sigstore provenance forgery — defeating "verify before deploy" controls. </td> </tr> <tr> <td> Poland officially abandons Signal for government communications </td> <td> May 19 </td> <td> Russian APT campaigns using QR code device-linking attacks compromised officials' accounts. Germany and Netherlands taking parallel action. Direct precedent for state executive communications policy. </td> </tr> <tr> <td> Siemens ICS advisory batch — 7 advisories (Ruggedcom ROX, SIMATIC CN 4100, gWAP, Universal Robots) </td> <td> May 14 </td> <td> Ruggedcom ROX and SIMATIC CN 4100 deployed in state DOT and water treatment infrastructure. Input validation and RCE vulnerabilities. </td> </tr> <tr> <td> ClickFix/FileFix/ConsentFix evolution documented with DPRK attribution </td> <td> May 18 </td> <td> Social engineering attacks that operate within browser/identity workflows, bypassing endpoint security and MFA. Targets state employee credentials. </td> </tr> <tr> <td> China-nexus IOC refresh — CIRCUITPANDA + EMISSARY PANDA (APT27); CVE-2025-53690 exploited in Sitecore deploying WeepSteel backdoor </td> <td> May 17–18 </td> <td> Active operational preparation against government targets; government portal compromise via CMS exploitation. </td> </tr> </tbody> </table> Threat level rationale: Maintained at ELEVATED (unchanged from May 18). The npm supply chain worm represents active compromise of developer ecosystems, but no confirmed state government network breach has been reported. Escalation to HIGH would be triggered by confirmed exploitation of state infrastructure or active ransomware targeting. <h2> Conflict and Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor/Attribution </th> <th> Relevance </th> </tr> </thead> <tbody> <tr> <td> May 14 </td> <td> Siemens ICS advisory batch (7 advisories) </td> <td> N/A (vulnerability disclosure) </td> <td> State water/transportation OT infrastructure </td> </tr> <tr> <td> May 15 </td> <td> CISA KEV addition </td> <td> N/A </td> <td> Patch prioritization signal </td> </tr> <tr> <td> May 17 </td> <td> CVE-2025-53690 Sitecore CMS exploitation with WeepSteel backdoor </td> <td> China-nexus (prior cycle) </td> <td> Government portal compromise </td> </tr> <tr> <td> May 17 </td> <td> NightshadeC2 botnet introduces UAC Prompt Bombing </td> <td> Unattributed criminal </td> <td> EDR evasion technique </td> </tr> <tr> <td> May 18 </td> <td> CIRCUITPANDA + EMISSARY PANDA (APT27) IOC refresh </td> <td> China-nexus </td> <td> Active operational preparation against government targets </td> </tr> <tr> <td> May 18 </td> <td> Tycoon2FA OAuth device code phishing confirmed active </td> <td> Criminal/nation-state convergence </td> <td> Bypasses MFA on M365 tenants </td> </tr> <tr> <td> May 18 </td> <td> Nx Console VS Code extension compromise (11-min window) </td> <td> Unattributed </td> <td> Developer credential theft + Sigstore forgery </td> </tr> <tr> <td> May 18 </td> <td> Bridewell documents ClickFix/FileFix/ConsentFix evolution </td> <td> DPRK-linked </td> <td> Credential theft bypassing endpoint controls </td> </tr> <tr> <td> May 19 </td> <td> Mini Shai-Hulud npm worm Wave 3 (@antv ecosystem) </td> <td> Unattributed </td> <td> Active supply chain worm stealing CI/CD secrets </td> </tr> <tr> <td> May 19 </td> <td> Poland abandons Signal for government use </td> <td> Russian APT (Polish/Dutch/German intel) </td> <td> Executive communications security precedent </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Mini Shai-Hulud: A Self-Propagating npm Supply Chain Worm </h3> This is the third and largest wave of a worm campaign that has escalated from SAP packages to TanStack to now Alibaba's @antv visualization ecosystem. The campaign compromised hundreds of packages including echarts-for-react (1.1 million weekly downloads) and timeago.js. How it works: <ul> <li> Malicious preinstall hook executes JavaScript at package installation time </li> <li> Steals CI/CD secrets, npm tokens, AWS credentials, and GitHub tokens from the developer's environment </li> <li> Plants persistence in .vscode/tasks.json and .claude/settings.json (AI coding assistant configs) </li> <li> Self-propagates by republishing infected packages using stolen npm tokens </li> <li> Exfiltrates to C2 domain t.m-kosche[.]com </li> </ul> Why this matters for state government: Any citizen portal, internal application, or shared service built with Node.js that pulls from the npm ecosystem is potentially affected. The worm's self-propagating nature means a single infected dependency can cascade across your entire build pipeline. ATT&CK Techniques: T1195.002 (Supply Chain Compromise), T1059.007 (JavaScript Execution), T1552.001 (Credentials in Files), T1567.001 (Exfiltration to Code Repository), T1137 (Office Application Startup — via IDE config) <h3> 2. Nx Console Compromise and Sigstore Provenance Forgery </h3> A separate but related supply chain attack compromised the Nx Console VS Code extension (2.2 million installs) on May 18 through stolen developer credentials. The 11-minute exposure window delivered a 498KB obfuscated stealer that harvests 1Password vaults, AWS/GitHub/npm credentials, and Anthropic Claude Code configurations. The critical innovation: The attacker integrated Sigstore — the industry-standard supply chain provenance system — to sign malicious packages with valid cryptographic attestations. This means packages that pass SLSA provenance verification may still be compromised. Organizations that adopted "verify provenance before deploy" as their supply chain security control now have a gap. Indicators of compromise: <ul> <li> File: ~/.local/share/kitty/cat.py (macOS backdoor) </li> <li> File: ~/Library/LaunchAgents/com.user.kitty-monitor.plist (persistence) </li> <li> Extension: rwl.angular-console v18.95.0 </li> <li> Behavior: Avoids execution on Russian/CIS timezone machines </li> </ul> <h3> 3. Russian APT Signal Campaigns Force Government Policy Changes </h3> Poland's Ministry of Digital Affairs has instructed all government officials to cease using Signal for sensitive communications following sustained Russian APT campaigns. The attacks use social engineering — fake support staff and malicious QR codes — to link attacker-controlled devices to victims' Signal accounts, providing persistent access to all future messages. Germany (migrating Bundestag to Wire) and the Netherlands (AIVD/MIVD confirmed compromises) are taking parallel action. This is not a Signal vulnerability — it is a social engineering attack exploiting the device-linking feature present in all modern messaging platforms. Relevance to state government: If any state executives, legislators, or agency heads use Signal, WhatsApp, or similar apps for official business, they are vulnerable to identical attacks. The attack requires no malware — only convincing the target to scan a QR code. ATT&CK Techniques: T1566.002 (Spearphishing Link), T1078 (Valid Accounts via device linking), T1656 (Impersonation) <h3> 4. China-Nexus Actors in Active Preparation </h3> From the prior cycle (May 18): CIRCUITPANDA and EMISSARY PANDA (APT27) simultaneously refreshed government-targeting malware indicators, signaling active operational preparation. APT27-associated IOCs (including Ramnit dropper variants) were confirmed active in ThreatStream intelligence feeds. Combined with the May 17 exploitation of CVE-2025-53690 in Sitecore CMS deploying the WeepSteel backdoor against government portals, China-nexus groups remain the primary nation-state espionage threat to state government networks. Critical absence: Volt Typhoon and Salt Typhoon — the Chinese groups specifically focused on pre-positioning in U.S. critical infrastructure — have shown no new indicators for four consecutive cycles. Given their documented focus on living-off-the-land techniques in network infrastructure (routers, firewalls, VPN concentrators), silence should be treated as a signal warranting proactive hunting, not reassurance. <h3> 5. ICS/OT Vulnerability Exposure </h3> Seven Siemens advisories published May 14 affect systems deployed in state government OT environments: <ul> <li> Ruggedcom ROX (3 advisories): Input validation in Scheduler, feature key installation flaws, third-party vulnerabilities pre-v2.17.1. Deployed in state DOT network infrastructure. </li> <li> SIMATIC CN 4100 : Multiple vulnerabilities affecting availability, integrity, and confidentiality. Deployed in water treatment automation. </li> <li> gWAP : Remote code execution via third-party library. </li> <li> Universal Robots Polyscope 5 : Authentication bypass with code execution. </li> </ul> No active exploitation has been confirmed for these specific advisories, but the combination of Volt Typhoon's known interest in water/transportation infrastructure and unpatched Siemens devices creates an unacceptable risk window. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional Mini Shai-Hulud waves targeting new npm namespaces </td> <td> 75% (HIGH) </td> <td> 7 days </td> <td> Campaign accelerating — each wave larger than the last. Worm has self-propagation capability. </td> </tr> <tr> <td> Canvas LMS breach (275M users) produces credential stuffing against state higher education portals </td> <td> 50% (MODERATE) </td> <td> 14 days </td> <td> Stolen credentials from large breaches historically appear in stuffing campaigns within 2-3 weeks. </td> </tr> <tr> <td> AI coding assistant configs exploited for persistent access in government developer environments </td> <td> 40% (MODERATE) </td> <td> 30 days </td> <td> Two independent campaigns (Mini Shai-Hulud, Nx Console) now weaponize this vector. Technique will be adopted. </td> </tr> <tr> <td> Ransomware group targets a U.S. state/local government entity </td> <td> 35% (LOW-MODERATE) </td> <td> 14 days </td> <td> Three-cycle quiet period + active access brokers (HOOK SPIDER) suggests pre-positioning phase. </td> </tr> <tr> <td> Volt Typhoon/Salt Typhoon activity surfaces in U.S. state infrastructure </td> <td> 30% (LOW-MODERATE) </td> <td> 30 days </td> <td> Four-cycle absence of indicators for groups known to be active. LOTL techniques are inherently difficult to detect. </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Hunting Hypotheses </h3> Hypothesis 1: npm supply chain worm artifacts present on developer workstations <ul> <li> Hunt for: Files matching .vscode/tasks.json with unexpected task definitions; .claude/settings.json with unauthorized modifications; ~/.local/share/kitty/cat.py; ~/Library/LaunchAgents/com.user.kitty-monitor.plist; processes with __DAEMONIZED=1 environment variable </li> <li> ATT&CK: T1195.002 , T1137 , T1053 </li> <li> Data sources: EDR file creation events, process environment variable logging, LaunchAgent monitoring </li> </ul> Hypothesis 2: C2 communication to Mini Shai-Hulud infrastructure <ul> <li> Hunt for: DNS queries or HTTP connections to t.m-kosche[.]com from any endpoint </li> <li> ATT&CK: T1071.001 </li> <li> Data sources: DNS logs, proxy logs, NDR/firewall logs </li> </ul> Hypothesis 3: Signal device-linking attack against executives <ul> <li> Hunt for: New linked devices appearing on executive Signal accounts; reports of "Signal support" contacts; QR codes received via email or messaging </li> <li> ATT&CK: T1566.002 , T1078 , T1656 </li> <li> Data sources: User reporting, executive communications audit </li> </ul> Hypothesis 4: Volt Typhoon living-off-the-land in network infrastructure <ul> <li> Hunt for: Anomalous admin authentication to routers, firewalls, and VPN concentrators; unusual configuration changes; LOTL binary execution (certutil, netsh, wmic) on network management systems </li> <li> ATT&CK: T1078 , T1059 , T1562.001 </li> <li> Data sources: Network device authentication logs, configuration change management, SIEM correlation </li> </ul> <h3> Detection Rules to Deploy </h3> <table> <thead> <tr> <th> Rule </th> <th> ATT&CK </th> <th> Priority </th> </tr> </thead> <tbody> <tr> <td> File creation in .claude/settings.json or .vscode/tasks.json by non-IDE processes </td> <td> T1137 </td> <td> IMMEDIATE </td> </tr> <tr> <td> preinstall script execution spawning network connections during npm install </td> <td> T1195.002 , T1059.007 </td> <td> IMMEDIATE </td> </tr> <tr> <td> DNS/HTTP to t.m-kosche[.]com </td> <td> T1071.001 </td> <td> IMMEDIATE </td> </tr> <tr> <td> Python process executing from ~/.local/share/kitty/ </td> <td> T1059.006 </td> <td> IMMEDIATE </td> </tr> <tr> <td> LaunchAgent creation matching com.user.kitty-monitor.plist </td> <td> T1053 </td> <td> IMMEDIATE </td> </tr> <tr> <td> OAuth device code flow from untrusted locations (Tycoon2FA) </td> <td> T1078 </td> <td> 7-DAY </td> </tr> <tr> <td> VS Code extension installation of rwl.angular-console </td> <td> T1195.002 </td> <td> 7-DAY </td> </tr> </tbody> </table> <h3> Blocking Actions </h3> <ul> <li> Block domain t.m-kosche[.]com at DNS and proxy layers </li> <li> Block npm package installation from @antv, @lint-md, @openclaw-cn, @starmind namespaces until verified clean </li> <li> Block execution of rwl.angular-console extension version 18.95.0 </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Primary threat: Credential theft via ClickFix/ConsentFix social engineering targeting finance staff with access to ERP and payment systems </li> <li> Action: Deploy conditional access policies requiring compliant devices for all financial system access; block OAuth device code flow entirely for finance user groups </li> <li> Monitor: Unusual bulk data access patterns in tax/revenue databases that could indicate pre-positioning for extortion </li> </ul> <h3> Energy (State-Regulated Utilities, Grid Operations) </h3> <ul> <li> Primary threat: Siemens ICS vulnerabilities in SCADA environments; Volt Typhoon pre-positioning </li> <li> Action: Prioritize Ruggedcom ROX upgrade to v2.17.1+ on all energy sector network devices; implement network segmentation audit between IT and OT zones </li> <li> Monitor: Anomalous authentication to SCADA HMI systems, especially from IT network segments; configuration changes to Siemens PLCs outside maintenance windows </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Rhysida ransomware (confirmed active this cycle targeting healthcare); credential theft for access to PII/PHI databases </li> <li> Action: Verify offline backup integrity for Medicaid enrollment and claims systems; ensure MFA cannot be bypassed via ConsentFix-style browser-based attacks </li> <li> Monitor: HOOK SPIDER access broker listings mentioning healthcare or state health domains; unusual RDP/VPN access to claims processing systems </li> </ul> <h3> Government (Executive Branch, Legislature, Law Enforcement) </h3> <ul> <li> Primary threat: Russian APT Signal/messaging compromise of officials; China-nexus espionage (APT27, CIRCUITPANDA) targeting policy systems </li> <li> Action: Brief all elected officials and senior appointees on QR code device-linking attacks; audit Signal/WhatsApp usage for official business; review Sitecore CMS deployments for CVE-2025-53690 exposure </li> <li> Monitor: New device registrations on executive accounts; anomalous access to pre-decisional policy documents; WeepSteel backdoor indicators on web-facing portals </li> </ul> <h3> Aviation/Logistics (State DOT, Port Authorities, Transit Systems) </h3> <ul> <li> Primary threat: Siemens Ruggedcom ROX vulnerabilities in transportation network infrastructure; Volt Typhoon interest in transportation pre-positioning </li> <li> Action: Patch Ruggedcom ROX Scheduler and feature key vulnerabilities; audit Universal Robots Polyscope 5 deployments in automated logistics facilities </li> <li> Monitor: Configuration changes to traffic management systems; anomalous admin sessions on transportation SCADA networks; lateral movement from IT to OT segments </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🔴 </td> <td> DevOps </td> <td> Block npm package installation from @antv, @lint-md, @openclaw-cn, @starmind namespaces. Block C2 domain t.m-kosche[.]com at DNS/proxy. </td> </tr> <tr> <td> 🔴 </td> <td> SOC </td> <td> Hunt all developer workstations for: .vscode/tasks.json with unexpected tasks, .claude/settings.json modifications, cat.py in kitty directory, com.user.kitty-monitor.plist LaunchAgent. </td> </tr> <tr> <td> 🔴 </td> <td> DevOps </td> <td> Audit VS Code extension versions — confirm no installation of rwl.angular-console v18.95.0 occurred during May 18 14:36–14:47 CEST. If found, rotate ALL credentials on affected machines immediately. </td> </tr> <tr> <td> 🔴 </td> <td> IT Ops </td> <td> Verify npm token rotation for all service accounts that interact with the npm registry. Revoke and reissue any tokens that may have been exposed. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟠 </td> <td> CISO </td> <td> Brief executive communications team on Signal/messaging account compromise TTPs. Determine if state uses Signal for any official communications. Evaluate platform alternatives. </td> </tr> <tr> <td> 🟠 </td> <td> IT Ops </td> <td> Apply Siemens Ruggedcom ROX patches (upgrade to v2.17.1+) on all DOT/water infrastructure network devices. Prioritize SIMATIC CN 4100 patching. </td> </tr> <tr> <td> 🟠 </td> <td> DevOps </td> <td> Implement npm package age-gating — refuse installation of any package version published less than 72 hours ago in CI/CD pipelines. Pin all GitHub Actions to commit SHAs. </td> </tr> <tr> <td> 🟠 </td> <td> SOC </td> <td> Verify M365 conditional access policies block OAuth device code flow from untrusted locations (Tycoon2FA mitigation). </td> </tr> <tr> <td> 🟠 </td> <td> IR Team </td> <td> Update incident response playbooks to include supply chain compromise scenarios — specifically npm worm propagation and IDE persistence cleanup procedures. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟡 </td> <td> CISO </td> <td> Commission assessment of AI coding assistant security posture — inventory all Claude Code, GitHub Copilot, and VS Code AI extension deployments across state agencies. Develop configuration integrity monitoring policy. </td> </tr> <tr> <td> 🟡 </td> <td> SOC </td> <td> Conduct proactive threat hunt for Volt Typhoon living-off-the-land indicators across network infrastructure (router configs, VPN concentrator logs, firewall admin sessions). Focus on anomalous admin authentication patterns. </td> </tr> <tr> <td> 🟡 </td> <td> CISO </td> <td> Review supply chain verification controls in light of Sigstore provenance forgery. Provenance signatures alone are no longer sufficient — implement multi-layer verification (provenance + behavioral analysis + age-gating). </td> </tr> <tr> <td> 🟡 </td> <td> IT Ops </td> <td> Evaluate state government messaging platform policy. Document which platforms are authorized for which classification levels. Publish guidance based on Poland/Germany/Netherlands precedent. </td> </tr> <tr> <td> 🟡 </td> <td> Governance </td> <td> Assess Canvas LMS exposure — determine which state higher education institutions use Canvas, whether credential reuse with state systems exists, and prepare for credential stuffing campaigns from the 275M-user breach. </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following indicators are confirmed from intelligence collection and should be actioned immediately: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> t.m-kosche[.]com </td> <td> Mini Shai-Hulud npm worm C2/exfiltration </td> </tr> <tr> <td> SHA-1 </td> <td> 7cb42f57561c321ecb09b4552802ae0ac55b3a7a </td> <td> Malicious GitHub commit (exotic dependency reference) </td> </tr> <tr> <td> File Path </td> <td> ~/.local/share/kitty/cat.py </td> <td> Nx Console macOS backdoor </td> </tr> <tr> <td> File Path </td> <td> ~/Library/LaunchAgents/com.user.kitty-monitor.plist </td> <td> Nx Console persistence </td> </tr> <tr> <td> Package </td> <td> @antv/setup </td> <td> Malicious npm optional dependency </td> </tr> <tr> <td> Extension </td> <td> rwl.angular-console v18.95.0 </td> <td> Compromised VS Code extension </td> </tr> <tr> <td> File </td> <td> .vscode/tasks.json (unexpected modifications) </td> <td> Supply chain persistence indicator </td> </tr> <tr> <td> File </td> <td> .claude/settings.json (unexpected modifications) </td> <td> AI assistant config persistence </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream and partner feeds. <h2> Bottom Line </h2> The convergence of three supply chain compromises in 48 hours — each more sophisticated than the last — signals a fundamental shift in how adversaries approach state government networks. They are no longer attacking your perimeter. They are poisoning the tools your developers trust, forging the cryptographic signatures your procurement teams verify, and compromising the messaging platforms your executives rely on. The npm age-gating recommendation is the single highest-ROI defensive investment available today. It costs nothing to implement and would have prevented credential exfiltration from Mini Shai-Hulud. Do it before close of business. For the 30-day horizon: if your organization has no inventory of AI coding assistant deployments, you have a governance gap that is actively being exploited. Two independent campaigns now weaponize AI assistant configurations for persistence. This vector will only grow. The quiet period in ransomware targeting state and local government is not peace — it is preparation. Access brokers remain active. Credentials are being collected. The window to harden before the next wave is measured in weeks, not months. Act now. The adversary already has. Anomali CTI Desk | 2026-05-19 For questions or additional context on any finding in this report, contact your Anomali intelligence team.

FEATURED RESOURCES

May 19, 2026

Anomali Cyber Watch

Iran's Cyber Offensive Hits U.S. Fuel Infrastructure: What CISOs Must Know Now

May 18, 2026

Anomali Cyber Watch

Iran Conflict Cyber Operations: Russia-Iran Infrastructure Cooperation Deepens as Fuel Sector Targeting Confirmed

May 19, 2026

Anomali Cyber Watch

Public Sector

Supply Chain Worms, AI Tooling Weaponization, and the Expanding Attack Surface for State Government Networks

Explore All