When supply-chain attacks meet coding agents, look out

Welcome to Runtime! Today: A sophisticated supply-chain attack on a widely used open-source package could have compromised a huge number of systems, Anthropic inadvertently leaks Claude Code's source code, and the latest funding rounds in enterprise tech.

Please forward this email to a friend or colleague! If it was forwarded to you, sign up here to get Runtime each week, and if you value independent enterprise tech journalism, click the button below and become a Runtime supporter today.

Become a Runtime Supporter

Everything everywhere, all at once

Attacks on software supply chains continue to offer criminals and nation-state adversaries the best bang for their hacking buck because they only have to compromise one code base in order to infect thousands, if not millions of developers who rely on that code. And as more companies experiment with coding agents that will happily download whatever they need to accomplish a task, a successful supply-chain attack could really take off.

Late Monday evening hackers successfully obtained the GitHub credentials of one of the maintainers of Axios and used those credentials to publish two updates to the open-source project that contained sneaky links to malware. Axios (not the smart brevity merchant) is one of the most popular software packages on npm's registry and is downloaded around 100 million times a week by developers who want to connect JavaScript applications to the internet without having to write their own code.

"This is among the most operationally sophisticated supply chain attacks ever documented against a top-10 npm package," StepSecurity wrote in a detailed explanation of how the attack unfolded.
npm flagged the malicious package, and GitHub helped Axios maintainers regain control of its GitHub account, but it was available for download for about three hours.
Google's Threat Intelligence Group attributed the attack to North Korean hackers most likely bent on stealing cryptocurrency or other sensitive credentials from developers that downloaded the package, according to Bloomberg.

This attack was particularly tricky given that no malicious code was ever inserted into the new version of Axios that popped up last night. Instead, the attackers inserted a new dependency into the package that prompted it to download a remote-access trojan onto developer machines and then wipe those systems of that dependency, covering their tracks.

"Within two seconds of npm install, the malware was already calling home to the attacker's server before npm had even finished resolving dependencies," Step Security wrote.
Step Security said one of its products "detected the compromised axios package making anomalous outbound connections to the attacker's C2 domain across multiple open source projects," suggesting that the fallout from the attack spread very quickly.
Huntress, another security company, wrote that "within our partner base, Huntress observed at least 135 endpoints across all operating systems contacting the attacker's command-and-control infrastructure during the exposure window."
Several security companies published instructions for developers worried they may have been compromised, which basically involves downgrading any Axios packages used in their software to the previous version.

It will probably take a few days to get a better picture of how many systems and companies were affected by this incident, but it arrived right as coding agents are becoming much more widely used in the software-development process. Some developers experimenting with coding agents and desktop apps like OpenClaw like to give them projects to run overnight, which given the hour of this attack could have had devastating results.

Aikido suggested "pinning" verified versions of open-source packages, or instructing software that depends on packages like Axios to only install a specific, vetted version rather than grabbing the latest version, when building an update.
Companies can also work with vendors like Chainguard or Docker to make sure their developers and coding agents are only using verified packages in their software builds, but that can get expensive.
And as coding agents become more widespread, package registries are going to have to adjust, according to Andrej Karpathy: "I think ultimately the defaults of package management projects (pip, npm etc) have to change so that a single infection (usually luckily fairly temporary in nature due to security scanning) does not spread through users at random and at scale via unpinned dependencies," he wrote on X.

Whoops

Somebody at Anthropic is really annoyed that the North Koreans didn't target its code base last night, because at least they would have a better excuse for leaking its crown jewels onto the internet. The company confirmed Tuesday that an employee mistakenly included the source code for the popular coding agent in a release of Claude Code published to npm early Tuesday morning.

"No sensitive customer data or credentials were involved or exposed," the company said in a statement to VentureBeat, adding that the leak was caused by "human error, not a security breach." Either way, it allowed pretty much every AI developer on the internet to examine the code for clues as to how Anthropic built Claude Code into the leading coding agent of the current moment.

It also shed light on Anthropic's model roadmap — although a lot of those details were exposed in a separate leak last week — and could give hackers several opportunities to poke holes in Claude Code. VentureBeat also noted that Anthropic appears to have built an "undercover" mode into a future release of Claude Code, which "provides a technical framework for any organization wishing to use AI agents for public-facing work without disclosure."

Enterprise funding

OpenAI raised $122 billion in new funding that values the frontier model maker at $852 billion post-money — just astonishing figures for a deeply unprofitable company — ahead of an expected IPO later this year that will be a real doozy.

Rebellions landed $400 million in new funding for its AI data center hardware, which includes servers as well as rack and cluster infrastructure.

Starcloud scored $170 million in Series A funding to build data centers in space, which a lot of experts think will be impractical at scale, but, a counterpoint; data centers in spaaaaaaace…

Granola raised $125 million in Series C funding for its AI notetaking app, which it hopes to expand across the enterprise with new features that allow teams to collaborate and set boundaries around sensitive information.

Depthfirst landed $80 million in Series B funding for its application security platform, which uses AI to find problems in applications under development before they ship.

Qodo scored $70 million in Series B funding for its code review software, which looks to help companies solve the review bottleneck created by coding agents.

The Runtime roundup

Oracle's massive layoffs hit Tuesday morning, part of cuts that Bloomberg reported earlier this month would number in the "thousands" as it struggles to keep up with its larger cloud provider rivals during the AI buildout.

Microsoft's stock fell 23% during the first quarter of 2026, in what CNBC said was the worst quarter for its stock since 2008.

Meanwhile, U.K. regulators said they'd take another look at Microsoft's cloud software licensing practices, even after both Microsoft and Amazon said they'd make changes to satisfy earlier concerns.

AWS will waive all charges for customers using its UAE and Bahrain regions after a month's worth of disruption following attacks on those facilities during the war with Iran.

Thanks for reading — see you Thursday!