---
title: "Security incidents, seen from a Mac: npm worms, AI agents and stealers · Kilobat"
url: "https://kilobat.app/incidents"
description: "Real supply-chain and Mac malware incidents, what they did on the network, and what Kilobat would and wouldn’t have caught."
---

Incidents

# Real incidents, seen from a Mac.

Case studies of supply-chain attacks and Mac malware: what each one did, what it looked like on the network, and what Kilobat would have shown or blocked. Each page also says where Kilobat wouldn’t have helped, and how to check your own Mac today.

## How to read these pages

- **Blocklists catch up after the fact.** Threat lists add an attack’s hosts once someone has found them. None of these pages claim Kilobat would have stopped an attack unless its rules would have, on the day.
- **A lot of attacks look like normal traffic.** Stolen data sent to github.com, or a secret printed in a CI log, never touches a suspicious host. The pages say so.
- **Facts come from the people who investigated.** Maintainers’ post-mortems, the researchers who found the attack, and advisories such as GitHub’s and CISA’s. Each page lists them with the date they were checked.

## Case studies

[26–27 August 2025 · npm package compromise **Nx “s1ngularity”** Malicious Nx versions ran installed AI CLIs to find secrets, then published them to a new repository in the victim’s GitHub account. Protection: wouldn’t help Agent guard: wouldn’t help Agent network log: limited *Read the case →*](https://kilobat.app/incidents/nx-s1ngularity)[September and November 2025 · self-spreading npm malware **The “Shai-Hulud” npm worm** A worm that stole developers’ tokens, republished itself with them, and leaked secrets through GitHub and webhook.site. Protection: wouldn’t help Agent guard: wouldn’t help Agent network log: limited *Read the case →*](https://kilobat.app/incidents/shai-hulud-npm-worm)[Since April 2023 · macOS infostealer **Atomic macOS Stealer (AMOS)** Rented-out Mac malware spread by fake ads and download pages, which posts passwords, cookies and wallets to its servers. Protection: limited Ask about new apps: limited App traffic: would show Agent guard: wouldn’t help *Read the case →*](https://kilobat.app/incidents/atomic-macos-stealer)[14–15 March 2025 · GitHub Action compromise **tj-actions/changed-files** A compromised GitHub Action printed the secrets of workflows in thousands of repositories into their own logs. Protection: wouldn’t help Agent guard: wouldn’t help Agent network log: wouldn’t help App traffic: limited *Read the case →*](https://kilobat.app/incidents/tj-actions-changed-files)[September 2025 · malicious MCP server **The postmark-mcp backdoor** An MCP server for sending email through Postmark quietly added a blind copy to every message. Protection: wouldn’t help Agent guard: wouldn’t help Agent network log: limited *Read the case →*](https://kilobat.app/incidents/postmark-mcp)

“Would block” means Kilobat’s own rules would have refused the connection on the day: an agent-guard rule, or a host that was on the threat lists then. “Would show” means the agent network log or Kilobat’s app list would have recorded it for you to see. “Limited” means it depends on how the attack reached your Mac.

## Know what every app and agent on your Mac connects to.

[Download for Mac ↓](https://kilobat.app/downloads/Kilobat-1.31.1.dmg?via=site)

```
brew install seifip/kilobat/kilobat
```