Developer Tooling Under Siege: May 2026's Attack Surface Convergence

Between May 18 and May 27, 2026, four independent attack campaigns converged on a single target: the developer workstation. The week ended with GitHub’s internal source code stolen, 5,561 public repositories backdoored in six hours, AI coding agents turned into unwitting credential exfiltrators, and a year-long developer-targeting botnet finally dismantled.

These campaigns share no coordination. GlassWorm, TrapDoor, TeamPCP, and Megalodon are distinct threat actors with separate infrastructure and objectives. What they share is a conclusion: the developer machine is the highest-value target in modern organizations. Developer workstations sit at the intersection of source code, cloud credentials, package publishing tokens, and CI/CD pipeline access. Compromising one gives an attacker more leverage than any single production system.

This post traces all four campaigns in technical depth, connects the credential-cascade dynamics that link them, and gives your team specific defensive actions mapped to each vector.

Four Campaigns, One Target: The May 18-27 Convergence Window

The ten-day convergence started on May 11 when TeamPCP compromised TanStack’s npm ecosystem - the initial access event that seeded the Nx Console breach seven days later. On May 12, the Shai-Hulud worm source code was released publicly, converting a targeted attack capability into freely available infrastructure. On May 18, Megalodon and the Nx Console attack launched simultaneously. TrapDoor ran from May 19 to May 25. The GlassWorm takedown concluded on May 26-27.

gantt
    title May 2026 Developer Toolchain Attack Timeline
    dateFormat YYYY-MM-DD
    axisFormat %b %d

    section GlassWorm (Oct 2025 start)
    Active botnet campaign      :glassworm_bg, 2026-05-01, 2026-05-25
    Coordinated takedown        :crit, glassworm_td, 2026-05-26, 2026-05-28

    section TeamPCP
    TanStack npm compromise     :tanstack, 2026-05-11, 2026-05-12
    Shai-Hulud open-sourced     :shulud, 2026-05-12, 2026-05-13
    Nx Console breach           :crit, nxc, 2026-05-18, 2026-05-20
    GitHub exfiltration         :crit, ghex, 2026-05-19, 2026-05-22

    section TrapDoor
    34 packages across npm/PyPI/Crates :trapdoor, 2026-05-19, 2026-05-26

    section Megalodon
    5,561 repos poisoned in 6hr :crit, mega, 2026-05-18, 2026-05-19

Four independent campaigns targeting developer infrastructure in a 10-day window. Shared targeting logic, not shared coordination, explains the convergence.

Developer machines became the preferred attack surface because they aggregate access that no single production system holds. A compromised developer laptop typically yields active session tokens for GitHub, AWS, GCP, and npm; write access to package registries reaching millions of downstream users; and CI/CD pipeline credentials that can inject payloads into software builds. CrowdStrike’s Adam Meyers put the strategic calculation directly: “Adversaries are no longer just targeting products, they’re targeting the developers who build them.”

GlassWorm: The Year-Long Botnet That Targeted Developers

GlassWorm operated since at least October 2025, targeting software developers through trojanized VS Code extensions on OpenVSX, malicious npm and Python packages, and over 300 poisoned GitHub repositories. The first detected wave in October 2025 involved seven compromised OpenVSX extensions with approximately 35,800 combined downloads.

What made GlassWorm distinctive was its targeting specificity. The malware doesn’t run on any infected machine indiscriminately. It checks locale, language, and timezone at runtime and exits silently on machines in CIS countries. The campaign targeted not only VS Code but also Cursor, Positron, Windsurf, and VSCodium - every major IDE in the AI coding ecosystem. The malware deployed SOCKS proxy servers and hidden VNC servers for remote access, stole npm, GitHub, and Git credentials, and drained cryptocurrency wallets.

The operators showed sustained operational evolution. Across the campaign they moved their core payload implementation from JavaScript to Rust to Zig, adapting to security detection while maintaining the same underlying C2 architecture.

How GlassWorm Spread Through IDE Extensions and Package Registries

The initial infection vector was trojanized IDE extensions published to OpenVSX. Compromised extensions included developer utilities for syntax highlighting, Git workflows, and documentation - the kind of tools developers install without scrutiny. Once on a developer machine, GlassWorm used the stolen credentials to force-push malicious code into GitHub repositories owned by that developer, self-propagating when other developers cloned or pulled those repositories.

Known GlassWorm-compromised extension IDs: codejoy.codejoy-vscode-extension, l-igh-t.vscode-theme-seti-folder, serenity-dsl.serenity-dsl, rust-doc-viewer.rust-doc-viewer, dark-theme-sm.dark-theme-sm, git-worktree-menu.git-worktree-menu, better-nunjucks.better-nunjucks.

# Check installed extensions for known GlassWorm-compromised IDs
code --list-extensions | grep -iE "codejoy|vscode-theme-seti-folder|serenity-dsl|rust-doc-viewer|dark-theme-sm|git-worktree-menu|better-nunjucks"

# For Cursor users
cursor --list-extensions | grep -iE "codejoy|vscode-theme-seti-folder|serenity-dsl|rust-doc-viewer|dark-theme-sm|git-worktree-menu|better-nunjucks"

Four C2 Channels Designed to Survive Takedown

GlassWorm’s most technically notable feature was a C2 architecture built explicitly to survive partial disruption:

graph TD
    I[Infected Developer Machine] --> A[Solana Blockchain\nC2 addresses encoded in transaction memo fields]
    I --> B[BitTorrent DHT\nConfig data keyed to hardcoded public keys]
    I --> C[Google Calendar\nBase64-encoded C2 paths in event titles]
    I --> D[VPS Direct Connections\nPayload delivery]
    A --> E[C2 Server]
    B --> E
    C --> E
    D --> E
    E --> F1[SOCKS Proxy Deployment]
    E --> F2[Hidden VNC Server]
    E --> F3[Credential Harvest\nnpm / GitHub / Git / crypto wallets]

GlassWorm’s four-channel C2 architecture. Disrupting any single channel leaves three active paths intact. All four required simultaneous takedown.

Taking down any single channel leaves three others operational. The Solana blockchain and BitTorrent DHT channels are particularly resistant: both are decentralized networks with no central operator to contact or court order to serve. The Google Calendar dead-drop exploits a legitimate service that cannot be blocked without disrupting normal business operations.

The Coordinated Takedown

CrowdStrike, Google, and The Shadowserver Foundation planned and executed simultaneous disruption of all four C2 channels on May 26, 2026 at 14:00 UTC. The operation required coordination across three organizations to ensure no single channel remained operational long enough for the malware to receive updated C2 addresses through an intact fallback path.

TrapDoor: When Your AI Coding Assistant Becomes the Attacker

Between May 19 and May 25, TrapDoor published 34 malicious packages across 384 versions on npm, PyPI, and Crates.io. All packages link to accounts asdxzxc and ddjidd564, with an internal marker P-2024-001 embedded in payloads. The packages impersonate development utilities targeting crypto, DeFi, Solana, and AI developer communities.

TrapDoor is the first documented supply chain attack that deliberately weaponizes AI coding assistants as attack executors.

Zero-Width Unicode: Invisible Instructions for AI Agents

When a TrapDoor package installs, it plants .cursorrules and CLAUDE.md files in the project directory. These configuration files look normal to human reviewers. Between the visible characters, hidden zero-width Unicode code points encode attacker-controlled instructions.

graph TD
    A[Malicious npm Package Installed] --> B[Plants .cursorrules and CLAUDE.md\nwith embedded zero-width Unicode]
    B --> C[Developer Opens Project\nin Cursor or Claude Code]
    C --> D[AI Agent Reads Config File]
    D --> E[Zero-width Unicode decoded\nas hidden instructions]
    E --> F[AI executes credential exfiltration\ndisguised as automated security scan]
    F --> G1[SSH Keys]
    F --> G2[AWS Credentials]
    F --> G3[GitHub Tokens]
    G1 & G2 & G3 --> H[Transmitted to attacker-controlled C2]

How TrapDoor weaponizes AI coding assistants. A human reviewer sees a normal config file. The AI agent reads the hidden instructions and executes them.

Zero-width Unicode characters (U+200B zero-width space, U+200C zero-width non-joiner, U+200D zero-width joiner, U+2060 word joiner, U+FEFF BOM) render as whitespace or nothing in most text editors. The AI agent cannot distinguish hidden malicious instructions from legitimate configuration because, from the model’s perspective, both are text in a trusted configuration file.

# Detect zero-width Unicode in .cursorrules and CLAUDE.md files
grep -rP '[\x{200B}\x{200C}\x{200D}\x{2060}\x{FEFF}]' .cursorrules CLAUDE.md 2>/dev/null

# Hex dump to reveal hidden content
xxd .cursorrules | grep -i "e2 80 8b\|e2 80 8c\|e2 80 8d\|e2 81 a0\|ef bb bf"

The Pull Request Campaign Against Open-Source AI Projects

The same attacker account (ddjidd564) submitted pull requests to LangChain, MetaGPT, OpenHands, browser-use, langflow, and llama_index. PR titles were crafted to look routine: “docs: add .cursorrules with dev standards and build verification.”

If any had merged, every developer cloning those repositories would have received poisoned AI configuration files with no package installation required. GitHub flagged at least one PR for containing hidden bidirectional Unicode text before it merged. This vector doesn’t require a developer to install a new package - only to clone a repository they already trust.

Socket detected the malicious TrapDoor packages with a median detection time of 5 minutes 27 seconds.

# Check for known TrapDoor packages in lockfile
grep -iE "eth-security-auditor|solana-dev-tools|defi-audit-kit" package-lock.json

Why AI Configuration Files Are the New Attack Vector

AI coding tool configuration files (.cursorrules, CLAUDE.md, .github/copilot-instructions.md) represent an attack surface that security tooling wasn’t designed to monitor. These files are trusted by default by AI agents, not validated against a schema or signature, distributed through normal project workflows without security review, and invisible to traditional malware scanners that don’t understand AI agent configuration formats.

A Wiz analysis found 24 CVE-assigned vulnerabilities across popular AI-enhanced IDEs including Cursor, Windsurf, GitHub Copilot, Zed, Roo Code, and Junie. 100% of tested AI IDEs were vulnerable to prompt injection attacks enabling remote code execution when combined with legacy IDE features.

Nx Console to GitHub: How a VS Code Extension Exposed Copilot Source Code

The Nx Console attack demonstrates how a single stolen credential can cascade from an open-source npm package to enterprise crown jewels in under a week.

The Credential Cascade: TanStack to Nx to GitHub

sequenceDiagram
    participant TS as TanStack npm (May 11)
    participant NC as Nx Contributor
    participant NX as Nx Console v18.95.0
    participant GHE as GitHub Employee
    participant GH as GitHub Internal
    participant D as Downstream Orgs

    TS->>NC: TeamPCP worm spreads, steals GitHub CLI OAuth token
    Note over NX: May 18, 12:30 UTC
    NC->>NX: Stolen token publishes trojanized v18.95.0
    Note over NX: 2.2M total installs, auto-update enabled by default
    NX->>GHE: GitHub employee receives malicious auto-update
    GHE->>GHE: Credential stealer runs silently
    Note over GHE: 1Password, Claude Code config, npm tokens, AWS, GitHub creds
    GHE->>GH: Stolen employee token accesses internal systems
    GH->>GH: ~3,800 internal repos exfiltrated
    Note over GH: Copilot source code, proprietary platform code, billing data
    GH-->>D: OpenAI (2 employees), Grafana Labs, Mistral AI compromised

The credential cascade: seven days, five organizations, no zero-days. A single compromised npm package eventually yielded Copilot source code.

The chain started on May 11 when TeamPCP (tracked by Google Threat Intelligence Group as UNC6780) compromised TanStack’s npm ecosystem, spreading a worm-like payload across 170+ packages. That payload included a credential stealer that silently exfiltrated an Nx contributor’s GitHub CLI OAuth token.

Seven days later, on May 18, the attacker used the stolen token to publish Nx Console v18.95.0 to the VS Code Marketplace. The malicious version was live on VS Marketplace from approximately 12:30 to 13:09 UTC before a maintainer received an unexpected publisher notification and unpublished it. Open VSX took roughly 36 additional minutes to remove it.

The trojanized extension looked and behaved normally but silently downloaded a hidden package from a planted commit on the official nrwl/nx repository, disguised as a routine MCP setup task. The credential stealer harvested data from 1Password vaults, Anthropic Claude Code configurations, npm tokens, GitHub credentials, and AWS keys.

A GitHub employee running Nx Console with auto-update enabled was compromised. TeamPCP used the stolen GitHub employee credentials to exfiltrate approximately 3,800 internal repositories containing Copilot source code, proprietary platform code, and billing information. Confirmed downstream victims include OpenAI (two employee devices compromised), Grafana Labs, and Mistral AI. TeamPCP put the stolen data on sale for $50,000.

# Check if compromised version was ever installed
code --list-extensions --show-versions | grep -i "nrwl.angular-console"
# If version shows 18.95.0, uninstall immediately and rotate all credentials on the machine

Why Are 97% of VS Code Extensions a Supply Chain Risk?

The Nx Console breach reveals a structural problem in the VS Code extension ecosystem. According to Security Boulevard’s analysis, 97% of the 60,000+ extensions in the VS Code Marketplace are unverified. Extensions install with filesystem, terminal, environment variable, and network access. The marketplace vetting process provides no structural security guarantees for the extensions developers install and trust.

Microsoft has not announced structural changes to extension vetting following this breach. The Nx team released v18.100.0 as the remediated version.

Megalodon: 5,561 Repos Poisoned in 6 Hours

On May 18, 2026 between 11:36 and 17:48 UTC, the Megalodon campaign pushed 5,718 malicious commits to 5,561 GitHub repositories. This is the largest single-day repository poisoning campaign on record.

Infostealer Credentials as Supply Chain Attack Fuel

Megalodon didn’t exploit a vulnerability in GitHub’s systems. It used GitHub credentials previously stolen by infostealer malware already running on developer machines. Hudson Rock’s analysis found that over 33% of affected account usernames were direct matches to computers infected by infostealer malware.

This represents a structural shift in how supply chain attacks are resourced. Commodity infostealer malware distributed through pirated software and phishing now directly supplies the credentials needed for large-scale repository poisoning. The attack chain: infostealer infects developer machine (cheap, scalable at criminal market prices) yields valid GitHub credentials, credentials enable push access to repositories the developer owns or collaborates on.

The attackers forged commit author identities designed to blend into CI workflows: build-bot, auto-ci, ci-bot, pipeline-bot with emails like build-system@noreply.dev. Commit messages were written to look routine: “ci: add build optimization step.”

Two Payload Variants: Mass Exfiltration vs. Dormant Backdoors

Megalodon deployed two distinct variants with different strategic objectives:

SysDiag (mass variant): Injects a new workflow file triggered on every push and pull request. Maximizes automated execution across the repository’s full CI activity. Any new commit to any branch triggers credential exfiltration.

Optimize-Build (targeted variant): Replaces existing workflows with workflow_dispatch triggers only, creating dormant backdoors. The attacker activates these on demand via the GitHub API - no visible pipeline activity until the attacker chooses to execute.

Both variants exfiltrate environment variables, AWS access keys, GCP OAuth tokens, SSH private keys, Kubernetes configs, and GitHub Actions OIDC tokens via HTTPS POST to 216.126.225.129:8443.

# Search for known Megalodon commit author identities
git log --all --author="build-bot" --author="auto-ci" --author="ci-bot" --author="pipeline-bot" --since="2026-05-18" --oneline

# Check for suspicious workflow files added recently
git log --all --diff-filter=A --name-only -- '.github/workflows/*.yml' --since="2026-05-18"

# Inspect workflows for base64-encoded payloads (Megalodon signature)
grep -rn 'base64.*-d\|echo.*|.*base64\|curl.*216\.126\.225\.129' .github/workflows/

Is Megalodon Linked to TeamPCP?

The Cloud Security Alliance links Megalodon as “Wave 2” of TeamPCP’s campaign following the open-source release of the Shai-Hulud worm source code on May 12. The Shai-Hulud release converted a targeted attack capability into freely available infrastructure. Within six days, Megalodon-scale attacks appeared using the same patterns. CSA’s attribution is based on timeline proximity and shared targeting patterns; StepSecurity’s primary Megalodon analysis does not make a firm attribution.

The Pattern: Credential Cascades and Trust-Based Attack Surfaces

The connecting thread across all four campaigns is that none required zero-day vulnerabilities. Docker’s assessment applies across the board: “This attack did not require any zero-days, novel tradecraft, or nation-state level budgets. The ingredients are stolen credentials and time, and both are abundant right now.”

The credential cascade pattern is visible in each campaign:

• GlassWorm: Stolen developer credentials used to force-push malicious code into 300+ GitHub repositories, propagating infections to other developers who clone those repos.
• Nx Console: TanStack compromise yields Nx contributor OAuth token, yields VS Code Marketplace publishing credentials, yields GitHub employee access, yields 3,800 internal repos and Copilot source code.
• Megalodon: Infostealer-harvested credentials yield push access to 5,561 repositories with live CI pipeline environments containing cloud credentials.

Each attack exploits trust relationships load-bearing in developer workflows: trust in IDE extension publishers, trust in npm package maintainers, trust in project configuration files, trust in CI bot commit authors. These trust relationships were established before supply chain attacks made them liabilities, and they haven’t been redesigned.

What Your Team Should Do This Week

The following actions address the specific attack patterns observed across all four campaigns. Prioritize in the order listed - the first three can be completed in hours.

Attack Vector	Detection	Prevention	Response
IDE Extensions	code --list-extensions --show-versions	Extension allowlist policy, disable auto-update	Uninstall, rotate all machine credentials
AI Config Files	grep -rP '[\x{200B}...]' .cursorrules CLAUDE.md	Pre-commit hook scan, git hook validation	Remove file, audit AI tool logs
CI/CD Workflows	Inspect recent workflow additions, check commit authors	Pin actions to full commit SHAs	Remove poisoned workflows, rotate pipeline secrets
Package Registries	npm audit signatures, lockfile diff	Socket or Snyk registry monitoring	Remove packages, audit downstream consumers
Credentials	Hudson Rock Infostealer API, infostealer IOCs	Scoped tokens, short TTLs, hardware keys	Rotate immediately, audit cloud access logs

Defensive actions mapped to each attack vector. Detection items can be scripted into CI gates.

IDE Extension Audit

Audit installed extensions across your organization and enforce an approved list. Auto-update on VS Code extensions is enabled by default - this is exactly how the Nx Console breach reached GitHub employees. Disable auto-update for extensions in high-trust environments and pin to verified versions.

# Verify current Nx Console version is safe (18.100.0 and later)
code --list-extensions --show-versions | grep -i "nrwl.angular-console"

AI Coding Tool Hygiene

Any project cloned from an untrusted source may contain poisoned .cursorrules, CLAUDE.md, or .github/copilot-instructions.md files. Add a check to your pre-commit hooks or CI pipeline:

# Detect zero-width Unicode in AI config files before commit
grep -rP '[\x{200B}\x{200C}\x{200D}\x{2060}\x{FEFF}]' .cursorrules CLAUDE.md 2>/dev/null && echo "WARNING: Zero-width Unicode found in AI config files"

Anthropic’s security-guidance plugin for Claude Code (released May 27) reviews code changes at three levels - file edits, model turns, and commits - and has shown a 30-40% decrease in security-related comments on PRs in internal benchmarks. It is free for all Claude Code users.

Restrict AI coding tool network access and shell command execution permissions in your IDE settings. The tool cannot steal credentials it cannot transmit.

CI/CD Pipeline Hardening

Pin all GitHub Actions references to full commit SHAs. Tag-based references (v4, latest) are mutable and can be redirected. This is the same mechanism TeamPCP used to poison 76 of 77 trivy-action tags in the earlier wave. SHA pinning breaks the entire tag-poisoning attack class:

# Before: mutable tag reference (vulnerable)
- uses: actions/checkout@v4

# After: pinned to immutable SHA
- uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

# Minimum required permissions (reduce blast radius)
permissions:
  contents: read
  actions: none

GitHub’s 2026 Actions security roadmap introduces native dependency locking that locks all direct and transitive dependencies by commit SHA with hash mismatches stopping execution before jobs run. Also coming: a Layer 7 egress firewall operating outside the runner VM (immutable even with root access inside the runner) and scoped secrets that bind credentials to specific execution contexts. Public preview is 3-6 months out.

Package Registry Monitoring

# Compare installed package checksums against the registry
npm audit signatures

# Check for known TrapDoor indicators in lockfile
grep -iE "eth-security-auditor|solana-dev-tools|defi-audit-kit" package-lock.json

Enable automated package registry monitoring via Socket, Snyk, or similar tools. Socket detected the TrapDoor packages in a median of 5 minutes 27 seconds - fast enough to block most developer installs.

Credential Hygiene and Infostealer Detection

Megalodon’s use of infostealer-harvested credentials reveals a gap in how most organizations think about endpoint security: an infostealer infection on a developer machine is now a supply chain risk, not just an endpoint security incident. Monitor for infostealer infections using Hudson Rock’s Infostealer API or similar services, and treat any confirmed infection as a trigger for full credential rotation across all services that machine had access to.

Scope GitHub tokens to specific repositories and operations. Use GitHub OIDC for CI/CD credential access instead of long-lived static tokens. Long-lived tokens in infostealer-infected environments are directly how Megalodon scaled to 5,561 repositories.

How Are GitHub, Anthropic, and CrowdStrike Responding?

GitHub is building four structural controls into its Actions security roadmap: workflow dependency locking by commit SHA, a Layer 7 egress firewall outside the runner VM, scoped secrets tied to execution contexts, and centralized workflow policy rulesets. These address the core mechanics of both Megalodon (poisoned workflows, credential exfiltration via egress) and the credential-cascading dynamics that power all these campaigns.

Anthropic released a free security-guidance plugin for Claude Code on May 27. It reviews code changes at three levels - file edits, model turns, and commits - reducing the risk of TrapDoor-style attacks by flagging suspicious operations in AI agent workflows. Internal benchmarks show a 30-40% decrease in security-related PR comments.

CrowdStrike, Google, and Shadowserver established a new model for dismantling resilient C2 infrastructure through the GlassWorm operation: simultaneous takedown of all channels at a coordinated UTC timestamp. This is the template for future operations against multi-channel botnet C2 architectures.

The VS Code extension ecosystem remains structurally vulnerable. 97% of extensions are unverified and Microsoft has not announced structural changes to marketplace vetting following the Nx Console breach.

Frequently Asked Questions

Are GlassWorm, TrapDoor, Nx Console, and Megalodon Coordinated by the Same Group?

No. GlassWorm is attributed to Russian-speaking operators based on CIS-country exit checks built directly into the malware’s runtime detection. TrapDoor is a separate actor with internal marker P-2024-001. Nx Console and Megalodon are both linked to TeamPCP (UNC6780). The convergence reflects independent groups reaching the same conclusion about developer machines as the most valuable targets in modern organizations. The CSA links Megalodon as “Wave 2” of TeamPCP’s campaign following the open-source release of the Shai-Hulud worm source code on May 12, which turned a targeted capability into widely available attack infrastructure.

How do I check if my VS Code extensions were compromised by GlassWorm or Nx Console?

Run code --list-extensions --show-versions and check for (1) any of the seven known GlassWorm extension IDs listed above, and (2) Nx Console showing version 18.95.0 specifically. If found, uninstall immediately and rotate every credential that machine had access to: GitHub tokens, AWS access keys, npm publish tokens, SSH keys, and anything stored in password manager software. Check cloud provider access logs for unusual API calls originating from your machine’s IP during the exposure window.

Can AI coding assistants like Cursor and Claude Code be tricked into stealing credentials?

Yes. TrapDoor demonstrated that hidden zero-width Unicode characters in .cursorrules and CLAUDE.md configuration files can instruct AI coding assistants to perform credential exfiltration disguised as a routine security scan. The AI cannot distinguish hidden malicious instructions from legitimate configuration because both are syntactically valid text in a trusted config file. Defenses: scan AI config files for zero-width Unicode before running AI agents on any newly cloned project, restrict AI tool network access and command execution permissions, and use Anthropic’s new security-guidance plugin for ongoing monitoring.

How did infostealer malware enable the Megalodon GitHub Actions attack?

Megalodon used GitHub credentials previously stolen by commodity infostealer malware already running on developer machines - credentials harvested before this attack was planned. Hudson Rock found that 33%+ of affected account usernames were direct matches to computers infected by infostealer malware. This represents a structural shift: the same low-cost malware distributed through pirated software and phishing that endpoint teams have managed for years is now the direct upstream supply for large-scale supply chain attacks. Developer endpoint security is now a supply chain security concern, not just an HR or BYOD policy issue.

What five steps should my team take immediately?

1. Audit and allowlist IDE extensions across your organization, removing any not on your approved list and disabling auto-update in high-trust environments.
2. Scan .cursorrules and CLAUDE.md files in all repositories for zero-width Unicode characters using the commands above.
3. Pin all GitHub Actions references to full commit SHAs instead of mutable tags.
4. Enable automated package registry monitoring via Socket, Snyk, or npm audit signatures.
5. Rotate credentials for any developer tokens with push access to package registries or CI/CD systems, replacing long-lived static tokens with scoped, short-TTL alternatives.