npm's Shai-Hulud Worm, Shieldstral, and the Harness Beats the Model

Good morning. It's Wednesday, August 5, and we're covering a credential-stealing worm that compromised the keyv maintainer's GitHub account and swept through the npm registry, Mistral's open-weights answer to content moderation, and Databricks publishing its own coding-agent benchmark with a conclusion that upends how most teams pick their stack.

The Shai-Hulud worm reached 434 packages across 1,381 versions before anyone published a full account, with a combined install base north of 2 billion monthly downloads. Databricks' results landed hours later and drew a different kind of crowd: 374 points for the claim that the harness a model runs in matters more than the model itself.

In today's brief:

• The Shai-Hulud npm worm: keyv's maintainer account was compromised, and a credential-stealing payload shipped to a package family pulling 2 billion installs a month, with valid GitHub provenance attached
• Databricks benchmarked coding agents on its real multi-million-line codebase: harness choice moved cost per task by more than 2x while quality stayed flat
• Mistral's Shieldstral: a 3B open-weights moderation model that takes your policy as a plain-language question, no retraining
• DeepSeek V4 Flash on a single AMD MI300X, and our own cost math on the 90% off Novita deal that dropped out of the same release

THE BIG ONE

The Shai-Hulud Worm: 434 npm Packages, 2 Billion Installs, One Compromised Account

Aikido security research documented the "Shai-Hulud" supply chain attack (243 points, 131 comments on HN): on August 4, attackers compromised the GitHub account of the maintainer behind keyv, a key-value storage library with roughly 127 million weekly downloads, and used it to inject a credential-stealing worm across his entire package family - keyv, flat-cache, file-entry-cache, cacheable, cacheable-request, cache-manager and several others, every one a caching utility that sits in thousands of lockfiles.

The mechanics are what make this one worse than the usual registry poisoning. The attacker pushed malicious files straight to main and immediately cut new releases, so the poisoned versions shipped to npm with valid provenance signed by GitHub Actions. Every package in the family gained two files - setup.mjs and Math_Symbol.js - plus a "preinstall": "node setup.mjs" entry, which means a plain npm install executed the dropper before the install even finished. The dropper silently downloads the Bun runtime and hands off to a 728 KB obfuscated payload that harvests npm tokens, GitHub PATs, OAuth tokens and OIDC tokens (on Actions runners it reads the runner's process memory to dump the secret store), AWS credentials from profiles, IMDS and Secrets Manager, Kubernetes service-account tokens, Vault secrets, and Stripe and Slack keys, then scans roughly 200 filesystem glob patterns for .env, private keys, Terraform state and IDE configs. The loot is encrypted and uploaded to public GitHub repos whose description reads "Shai-Hulud: Here We Go Again" - about 1,300 of them at time of writing - with a fallback domain whose rotation is controlled by an Ethereum smart contract.

Then the worm propagates. Using stolen npm tokens it lists every package the victim can publish to, bumps the patch version, injects the preinstall hook and republishes - that is how the count ran past 434 packages within hours, including @deliveroo/reevent, @qlik/embed-runtime and picasso.js. With a stolen GitHub token it commits malicious hooks into .claude/settings.json and .vscode/tasks.json in up to 50 branches per repo, authored as claude with the message chore: update config, so the payload fires the next time anyone opens the repo in VS Code or starts a Claude Code session. No install required. The HN thread spent the day on the same uncomfortable question: if a maintainer's account is the crown jewel, and AI-adjacent config files are now executable surface, what does trust in the registry even mean.

Why it matters: Agent config files and preinstall hooks are the new attack surface, and signed provenance only proves the pipeline was used, not that the pipeline was honest. This is the argument for treating every install and every .claude/ or .vscode/ file in a repo as untrusted until proven otherwise. Our supply chain trust boundaries post covers exactly where to draw those lines, and the config-files-are-executable analysis explains why the worm's repo-commit vector works at all.

RESEARCH

Databricks: The Harness, Not the Model, Is the Cost Multiplier

Earendil's Pi's Minimalism Is Its Advantage (374 points, 153 comments on HN) pulled a Databricks engineering benchmark back into the front page - and it is the clearest public data yet that harness choice changes the economics of agentic coding more than model choice. Databricks built its own benchmark from real merged PRs against its multi-million-line codebase (Python, Go, TypeScript, Scala, Rust, Bazel), held out the tests, and graded agents on whether the tests passed - no LLM judge, and with git history sealed after early runs showed agents walking forward through git log to recover the answer.

The results cluster into three findings. First, token price is a poor predictor of task cost: Sonnet 5 is about 1.7x cheaper per token than Opus 4.8, yet cost $2.09 per task against Opus's $1.94 while scoring 81% to 87% - it worked longer and burned 1.9x the tokens to get there. Second, open models are now daily drivers: GLM 5.2 landed in the top capability tier, statistically tied with Opus 4.8 on quality at $1.28 per task against $1.94. Third, and most interesting: running the same model with the same thinking effort through two different harnesses changed cost per task by more than 2x at identical quality. The Earendil-side writeup names the mechanism - Pi sent roughly 3x less context per turn, kept a tighter working set, and finished in fewer runs - and Databricks frames it as context discipline rather than magic: harnesses that feed the model less redundant context get the same answer for a fraction of the spend.

The takeaway for teams is uncomfortable but actionable: the frontier is not a single model ranking, it is a frontier of model-harness pairs, and your default harness may be the most expensive part of your stack. Databricks is investing in Omnigent to make model-and-harness swaps seamless and pushing routine work down to the Haiku and GPT 5.4 Mini classes. If your team only ever benchmarks models, you are optimizing the half of the equation that moved least.

Why it matters: When cost per task can double from harness choice alone, the tooling around the model is where the next round of agent spend optimization happens - and open-weights models like GLM and DeepSeek make the cheap end of the pair frontier much more crowded. Our parallel-agent cost analysis is the real-world version of the same finding.

MODELS

Shieldstral: Moderation As a Yes/No Question, At 3B Parameters

Mistral released Shieldstral (424 points, 109 comments on HN), a 3B-parameter open-weights multimodal safety classifier under Apache 2.0 that frames content moderation as a binary question-answering task. Instead of baking a fixed taxonomy of harm categories into the weights, you write the policy as a plain-language question at inference time - "Does this content promote violence against a protected group?" - and the model softmax-normalizes the yes and no logits into a calibrated safety score from a single forward pass. One checkpoint handles text, images, and prompt-response pairs, and re-targeting to a new deployment context means changing the query, not retraining. It runs on a single 16 GB GPU.

The benchmark claims are the headline: it matches or beats open guard models up to 7x its size on text safety, refusal detection, and policy adaptability, and sets a new state of the art on multimodal moderation, per its technical report. The training recipe is the interesting engineering: Mistral unified heterogeneous safety datasets with conflicting taxonomies into one instruction-query-document format, built contrastive pairs that deliberately violate one policy but not its sibling to teach policy discrimination rather than label memorization, and merged three LoRA checkpoints with SLERP. It is the latest signal that the open-weights safety layer is getting serious - and that moderation is becoming a prompt-engineering problem rather than a fine-tuning problem.

Why it matters: For developers shipping anything with user-generated content or agent outputs, a policy-adaptive classifier that runs locally on one GPU makes LLM-based moderation feasible as a default rather than a vendor API call - and it changes how you write policies: they become deployed artifacts you can version. Our Shieldstral deep-dive has the benchmark table and a working vLLM setup.

INFRASTRUCTURE

DeepSeek V4 Flash on a Single MI300X: 168 Tok/s, No Quantization

Ryan Zhou's DeepSeek V4 Flash on a single AMD MI300X (371 points, 95 comments on HN) is a production-grade recipe for running the 304B-parameter checkpoint on one card: the model fits entirely in HBM3 with no weight quantization and no offload - 156.67 GiB of weights - and the pinned stack delivers 168.6 tok/s median single-stream decode, 7.9-8.5K tok/s prefill with tuned kernels, validated 256K context, and an 830 tok/s aggregate on a 64-stream burst without OOM. The repo is a museum of what running frontier-class open weights on AMD actually costs in engineering: FNUZ versus OCP FP8 format differences that can silently produce factor-of-two scale errors, MoE routing bugs that corrupted tool names on long prompts, missing AITER tuning tables for gfx942, and a CPU KV tier that needed a fencing fix upstream vLLM never merged.

The economics are the point. The model runs as shipped with DSpark-7 speculative decoding, on hardware that costs roughly half an H100 at list price with 2.4x the HBM capacity - which is exactly the kind of number that makes the open-weights serving story concrete. It also lands the same week the Flash pricing story got more aggressive: our analysis of DeepSeek V4 Flash at 90% off through Novita on Vercel AI Gateway - the deal runs through August 11 and drops the effective rate to $0.014 input / $0.028 output per million tokens - shows what a 10x cheap agent inner loop does to routing decisions. Between a single-card deploy at 168 tok/s and a 90% discount on the API, Flash is the cheapest serious agent loop available right now.

Why it matters: The gap between "open weights exist" and "open weights run in your own datacenter" just got visibly smaller, and when a 304B model serves comfortably from one accelerator, the cost floor for agentic workloads keeps dropping. Our DeepSeek V4 economics breakdown has the Flash-versus-Pro routing math.

PLATFORMS

Stateless MCP Recaptured Simon Willison - and Everyone's Interest

Simon Willison's Stateless MCP has recaptured my interest (220 points, 113 comments on HN) is the clearest sign yet that MCP 2.0's stateless spec, released July 28, is the real deal. The change is exactly what it says: legacy MCP needed two HTTP requests - initialize a session, get a Mcp-Session-Id, then call a tool - while stateless MCP collapses this into a single request with MCP-Protocol-Version and Mcp-Method headers, no server-side session state, no session affinity routing. That kills an entire class of deployment complexity for anyone building MCP servers as web services, and it is why Willison - who spent most of 2025 arguing that agents with a terminal and curl made MCP redundant - came back and built three implementations in a week.

His new tools are worth looking at individually: mcp-explorer, a uvx-installable CLI for listing, inspecting and calling tools on any stateless MCP server; datasette-mcp, a Datasette plugin exposing /-/mcp with three SQL tools he says is the fourth attempt that finally felt right to release; and llm-mcp-client, his LLM tool's long-overdue MCP plugin, flagged for potential inclusion in LLM core. His framing for why MCP matters again: giving an agent a shell and internet access is fraught, while MCP tools are easier to audit and control, and simple enough that smaller laptop-class models can drive them.

Why it matters: Statelessness is the difference between an MCP server you can deploy on any serverless function and one that needs session pinning and sticky state - and it reopens the build-versus-buy decision for the tooling layer between your agents and your services. Our MCP server ecosystem guide covers where stateless MCP fits in the 2026 landscape.

TOOLS WORTH A LOOK

1. Claude Code v2.1.222 (paid) - the release is mostly security hardening, and it landed hours after the Shai-Hulud disclosures: worktree-isolated sessions and subagents can no longer run destructive git commands against the main checkout, and PreToolUse auto-allow hooks can no longer bypass tool restrictions in background tasks.
2. Maple-Preview (free / OSS) - Show HN: ternary 20B MoE at 120 tok/s on an iPhone (121 points): the local-model ladder keeps climbing downward, now with ternary weights.
3. Soup (free / OSS) - Show HN: fine-tune an 8B model on a 4 GB laptop GPU (128 points): LoRA-style fine-tuning that fits in a laptop's memory budget.
4. llm 0.32 (free / OSS) - the release: adds reasoning traces, OpenAI Responses support, server-side tools and smarter logging.

WHAT ELSE IS HAPPENING

• AI-generated images discourage me from reading your blog (759 points, 442 comments): the loudest anti-AI-art signal on the front page in weeks, and a reminder that your article images are a trust signal.
• Apple says more ex-employees may have taken data to OpenAI (367 points): the follow-up to yesterday's OpenAI rebuttal - Apple now names a broader group of former employees, and the lawyer-screenshot phase of the lawsuit continues.
• OpenAI: third-party cyber evaluations: OpenAI explains recent third-party cybersecurity evaluation incidents involving its models and announces new safeguards around model testing access (5 min read).
• libexpat funded by the City of Munich (281 points): the XML parser that sits in every C program gets six months of paid maintainer time from a city government - the most concrete public-sector OSS funding story of the week.
• Oxide Computer raises $445M (243 points): per an SEC Form D, the rack-scale cloud hardware maker's largest round yet, for its serverless cloud platform.
• Flowise is shutting down (50 points): the popular open-source LLM app builder announced sunset, a data point for anyone building on no-code agent platforms.

FROM THE SITE

• DeepSeek V4 Flash Is 90% Off Through Novita on Vercel AI Gateway: The Cost Math - the verified before/after numbers on a deal that drops Flash to $0.014/$0.028 per million tokens through August 11, with the provider-pinning setup that makes it stick.
• Also today: our Shieldstral benchmark deep-dive from yesterday is the companion read to the Mistral release above, with a working local setup.

---

Every link above goes to a primary source or our sourced coverage. Tomorrow's brief lands when the news does - subscribe to get it by email.