Amazon's threat intelligence team traced domain records from the open-source software hack to a smaller, earlier compromise by the same North Korean group.

The worm blends in with thousands of other commands occurring daily in any given environment, yet its intent and origins remain unknown.

Aikido found that AI coding tools from Google, Anthropic, OpenAI and others regularly embed untrusted prompts into software development workflows.