Avital Harel
Everyone Read the OpenAI Breach as a Model Story, But It Was a Runtime Story
Key Takeaways Autonomous AI agents can now break out of a sandbox, cross an internal network, and breach a production system with no human at the keyboard. OpenAI's evaluation that hacked Hugging Face this month is the clearest proof on record. Most of the coverage read it as a story about a model turning dangerous.…
Building Autonomous Cloud & AI Security
How Upwind’s Agentic Pack uses NVIDIA Nemotron 3 Super and NVIDIA garak agent breaker probe to continuously validate cloud posture, attack surfaces, and AI applications. By: Avital Harel, Alon Saban, Yuval Elarat (Upwind). Eliya Cohen, Shiri Hochhauser, Orel Hazai (NVIDIA) Executive Summary AI-generated code, autonomous agents, MCP servers, and cloud-native architectures are transforming how software is…
Who’s watching the code AI writes?
It’s probably no shocker that most of the code shipping into production this year wasn't written by a person. The real question isn't whether it's any good, but who's watching what it does once it's running, because no human ever held the context for it in the first place. Here's a startling number that may…
Scale AI Adoption Securely With Upwind AI Security
AI is entering production faster than many security teams can keep up. As teams embed AI into applications, developer workflows, and cloud operations, security teams need to know where AI runs, what it can access, and which risks need action. Upwind AI Security connects AI usage to realtime cloud context, giving teams a practical way…
Newly Discovered durabletask Malware Targeted Kubernetes, Cloud Secrets, and CI/CD Infrastructure
Executive Summary Upwind identified a critical supply chain compromise involving durabletask==1.4.1, 1.4.2, and 1.4.3, three consecutive malicious releases of Microsoft's Azure Durable Task Python SDK published to PyPI. The malicious release contains a lightweight dropper embedded directly into durabletask/init.py. On import, the package downloads and executes a remote payload named rope.pyz from attacker-controlled infrastructure. The…
The New Face of Supply Chain Attacks: npm Malware Built for CI/CD and Cloud Compromise
Executive Summary Upwind is tracking an active software supply chain campaign impacting multiple npm packages commonly used across developer tooling, frontend frameworks, CI/CD pipelines, and cloud-native application environments. We identified malicious payloads designed specifically to target CI/CD systems, cloud identities, GitHub credentials, npm publishing workflows, developer machines, and AI developer tooling. The campaign includes install-time…
The Supply Chain Strikes Again: Credential-Stealing Malware Hidden in node-ipc
Executive Summary On May 14, 2026, malicious versions of the widely used node-ipc npm package were published through a legitimate maintainer account, introducing a sophisticated credential-stealing payload into a package with approximately 3.35 million monthly downloads. The malicious payload was hidden inside the CommonJS bundle (node-ipc.cjs) and silently executed whenever applications loaded the package through…
Shai-Hulud: Here We Go Again – Dissecting a Supply Chain Worm Across the TanStack Ecosystem
Executive Summary A new wave of the Mini Shai-Hulud campaign compromised dozens of official @tanstack/* npm packages by abusing CI/CD publishing workflows and trusted npm release mechanisms. Unlike traditional dependency malware focused only on downstream execution, this operation behaves as a self-propagating supply chain worm designed to continuously spread across repositories, developer environments, and CI/CD…
Mini Shai-Hulud Targets SAP npm Packages: CI/CD Publishing Pipeline Abused in Supply Chain Attack
Executive Summary Our research team identified a sophisticated supply chain attack targeting SAP Cloud Application Programming (CAP) framework packages. The campaign demonstrates advanced techniques for compromising trusted publishing pipelines and injecting malicious code directly into enterprise CI/CD workflows. The activity has been attributed to TeamPCP, a financially motivated threat actor known for large-scale supply chain…
Building Trusted LLM Security Operations with NVIDIA Nemotron
Executive Summary Large Language Models now sit directly on the edge of production systems. They respond to API calls, generate code, retrieve internal knowledge, and execute workflows, all while accepting free-form input from users they do not control. That input is not structured, validated, or predictable. It is language. And language can be manipulated. This…