SAN FRANCISCO — This past fall's
Shai-Hulud worm attacks may be only the beginning of an epidemic of similar attacks that weaponize the automatic-update features of many open-source-software repositories to create backdoors, steal information, or cause any kind of digital mayhem, two security engineers said in a presentation at the RSAC conference here last week (March 25).
"Today, updater automation has real authority," explained Shilpi Mittal, lead security engineer at Tyson Foods. "A dependency updater can pull changes, write fixes, merge PRs [pull requests], and publish artifacts."
Dependency dangers
As most developers know, the open-source ecosystem is a vast and tangled universe of tens of thousands of pieces of software referring to and depending on each other to function. Open-source code often finds its way into commercial projects as well, so proprietary software is not immune. Whichever way you look, it's dependencies all the way down.
To tame this mess, which is now too complex for any human to keep track of, many open-source repositories use auto-updating
continuous integration/continuous delivery (CI/CD) functions, such as GitHub Actions or AWS CodeBuild. If one piece of code is updated far down the line, it automatically propagates upward and outward so that all other pieces of software that depend on it receive the updated version.
This is a great idea in theory, but it also creates a vast
supply-chain attack surface for miscreants to add
malicious code.
"If any part of that chain is compromised," said Mittal, "the attacker can get code execution inside your organization."
If enough of the process is automated, both inside and outside of an organization that uses open-source software, then malicious activity may escape human detection and get to the point where it reproduces itself across an environment and becomes a true software worm.
"We can't review everything," Mittal said, "so attackers can 'spray and pray' across registries" to get results.
She defined an autonomous-dependency worm as a self-propagating supply-chain compromise that uses CI/CD to modify other projects and repositories.
"The worm rides trusted automation to turn one foothold into a repeatable spread across repositories, languages and registries," she explained. "It doesn't have to be perfect — just good enough."
Living off the land
But shouldn't existing tools catch this kind of activity? Not unless it involves a known malicious package, has a static pattern or signature, fails policy changes or has obvious anomalies, Mittal said. It can instead live off the land, change variants, spread using stolen tokens, or run only in development environments.
"Scanning tools aren't built to scan run-time behavior," she said.
We've already seen worm-like signals in open-source software, Mittal said. The
xz-utils backdoor (CVE 2024-3094) of 2024 was not a worm, but it demonstrated how malicious code could be added to a widely used project with almost no one noticing.
In 2025, the
tj-actions/changed files GitHub Action bug (CVE 2025-30066) forced repositories to leak secrets, while the Shai-Hulud NPM worms were genuinely self-replicating. In January 2026,
six serious flaws were found in top package managers that would enable more auto-update worms.
How to stop auto-update worms
To defend against this kind of self-propagating supply-chain attack, Ankit Gupta, principal security engineer at Exeter Finance, recommended a practical playbook using four layers that would work even when scanners fail.
Layer 1, he said, is to govern autonomy by disabling auto-merge, requiring code owners to approve build or CI changes, quarantining new software maintainers, and enforcing
MFA and short-lived publish tokens.
Layer 2 hardens CI/CD runtimes by eliminating long-lived secrets, restricting egress, and separating test cycles from publishing cycles.
Layer 3 verifies provenance by signing, attesting, and verifying updates and generating provenance attestations in CI.
Layer 4 detects and contains the spread of dependency worms by looking for unusual publish patterns, CI secrets accessed unusually, new outbound destinations, new post-install/pre-install scripts, or similar code appearing across multiple packages.
"Autonomy is the new attack surface and identity is the work's fuel," said Gupta.
Yet, as Mittal made clear, this kind of attack has surprisingly little to do with the main topic of this year's RSAC conference.
"This is not about
AI being dangerous," she said, "but about autonomy itself."
Facts Only
Shai-Hulud worm attacks occurred in fall 2025, targeting automatic-update features in open-source repositories.
Security engineers Shilpi Mittal (Tyson Foods) and Ankit Gupta (Exeter Finance) presented findings at the RSAC conference in San Francisco on March 25, 2026.
Open-source software relies on interconnected dependencies, often managed by CI/CD tools like GitHub Actions or AWS CodeBuild.
Auto-updating systems can propagate malicious code across projects if compromised.
The xz-utils backdoor (CVE 2024-3094) was discovered in 2024, demonstrating undetected malicious code insertion.
The tj-actions/changed files GitHub Action bug (CVE 2025-30066) in 2025 forced repositories to leak secrets.
Six flaws in top package managers were identified in January 2026, enabling auto-update worms.
Gupta proposed a four-layer defense: governing autonomy, hardening CI/CD, verifying provenance, and detecting anomalies.
Mittal defined autonomous-dependency worms as self-propagating supply-chain compromises using CI/CD.
Scanning tools often fail to detect runtime behaviors or "living off the land" attacks.
The RSAC conference focused on autonomy as a new attack surface, distinct from AI-related threats.
Executive Summary
Security engineers Shilpi Mittal and Ankit Gupta warned at the RSAC conference in San Francisco that automated update features in open-source software repositories could be weaponized to create self-replicating "dependency worms." These worms exploit CI/CD pipelines to propagate malicious code across projects, leveraging the interconnected nature of open-source ecosystems. Recent incidents, such as the xz-utils backdoor (2024) and the Shai-Hulud NPM worms (2025), demonstrate the vulnerability of these systems. To mitigate risks, Gupta proposed a four-layer defense strategy: governing autonomy, hardening CI/CD runtimes, verifying provenance, and detecting unusual activity. The threat is not tied to AI but to the inherent risks of automated, trusted systems.
The open-source supply chain's complexity makes manual oversight impractical, increasing reliance on automation that attackers can exploit. While scanning tools may fail to detect runtime behaviors, proactive measures like multi-factor authentication, short-lived tokens, and behavioral monitoring can reduce exposure. The discussion highlights a broader challenge: balancing efficiency with security in an ecosystem where dependencies are ubiquitous and often invisible.
Full Take
The strongest version of this narrative is its clear-eyed assessment of a systemic vulnerability: automation in open-source ecosystems, while efficient, creates an attack surface that traditional security tools struggle to monitor. The engineers deserve credit for framing the issue not as a failure of open-source principles but as a consequence of scale and complexity. The proposed defense layers are pragmatic, acknowledging that perfect detection is impossible but that structural safeguards can limit damage.
Pattern scan: The discussion avoids emotional exploitation or distortion, focusing on technical realities. However, the framing of "autonomy as the new attack surface" could subtly reinforce a techno-pessimist narrative, where progress inherently invites risk. This isn’t a manipulation pattern per se, but it echoes the broader tension between innovation and security—a recurring theme in cybersecurity discourse.
Root cause: The paradigm here is trust in automation. The unstated assumption is that open-source’s collaborative model, while powerful, lacks built-in mechanisms to verify intent at scale. Historically, this mirrors earlier supply-chain attacks (e.g., SolarWinds), where trust in update mechanisms was exploited. The difference now is the potential for self-replication, turning isolated breaches into epidemics.
Implications: Human agency is both the problem and the solution. Developers rely on automation to manage complexity, but that same automation can bypass human oversight. The cost of inaction is clear—widespread compromises—but the cost of overcorrection (e.g., stifling open-source collaboration) is equally risky. Second-order consequences include eroded trust in open-source ecosystems, which could push organizations toward proprietary alternatives, ironically increasing centralization and opacity.
Bridge questions: How might open-source communities redesign trust models to balance automation with accountability? What role should regulatory bodies play in mandating supply-chain security, and could such interventions backfire? If the core issue is "autonomy as fuel," how do we distinguish between beneficial and malicious automation without stifling innovation?
Counterstrike scan: A coordinated influence campaign might exaggerate the threat to push proprietary software or surveillance tools under the guise of security. However, this article’s focus on technical solutions and absence of fear-mongering suggests no alignment with such a playbook. The analysis remains grounded in observable risks and practical mitigations.
Patterns detected: none
Sentinel — Human
The analyzed text shows signs consistent with a human writer. The piece provides insight into the potential risks of automated software updates in open-source repositories, offering practical solutions to mitigate these risks.