The Whistle: An npm Worm With a Hostage Token, a Sandbox for Agent Governance, and 372 Proofs Nobody Has Read Yet

Mon, 12 Oct 2026 08:00:00 -0400

Security owned the week again, and not subtly. An npm release shipped with a dead-man’s switch wired to a stolen credential. Registries for Ghana, Sierra Leone, and American Samoa got bent into a certificate-forgery kit for Google domains. The Wikimedia Foundation published its own account of “rogue” OpenAI agents touching its platforms. Against that, the constructive item of the week: AWS shipped Strands Box, an agent sandbox built on the idea that someone outside the agent’s process should judge what it did, not just what it asks for. Security first, then that, then the rest of the week.

Npm on StackRef Whistle

The Whistle: An npm Worm With a Hostage Token, a Sandbox for Agent Governance, and 372 Proofs Nobody Has Read Yet