Malware now moves faster than advisories, targets the AI agents writing your code, and arrives with no CVE attached. Blue Shield blocks malicious packages and skills at the agent, the workstation, and CI/CD — one verdict, one intelligence backbone. Free core tier open today.
Media contact: Phil Moroni, Head of Sales & Press Distribution, Phoenix Security · press@phoenix.security
Free core tier and intelligence portal: phxintel.security
Phoenix Security launches Blue Shield, a supply chain firewall that blocks malicious packages and AI agent skills at the point of install — with a free core tier
LONDON — June 14, 2026 — Phoenix Security today launched Blue Shield, a supply chain firewall built for a threat that has outrun the defenses most teams still rely on. Over the past year, software supply chain attacks have shifted from isolated incidents to sustained, self-propagating campaigns that arrive without a CVE, move faster than any advisory, and increasingly target the AI coding agents now writing a large share of production code. Blue Shield stops malicious packages and agent skills before they run, across the agent session, the developer workstation, and CI/CD. A free core tier is open to everyone today.
The problem: the supply chain is under sustained, accelerating attack
The flood is real, and it is self-propagating
September 2025 was the inflection point. The Shai-Hulud worm became the first self-replicating npm malware, and Palo Alto’s Unit 42 has since tracked a steady acceleration in both the frequency and technical depth of supply chain compromises, describing the registry as a force multiplier for malware distribution. What was once a nuisance is now a high-consequence threat landscape.
The pace since has been relentless, and each wave is documented by multiple independent vendors:
- On May 19, 2026, a Mini Shai-Hulud wave attributed to the group TeamPCP published more than 300 malicious versions across 323 packages in a roughly 22-minute automated burst, hitting Alibaba’s AntV ecosystem and packages representing around 16 million weekly downloads (Snyk, StepSecurity).
- By early June, a descendant named Miasma had infected at least 57 npm packages and over 300 malicious versions, scanning each victim for cloud credentials and using them to spread further.
- On June 1, the same family backdoored at least 32 packages in Red Hat’s @redhat-cloud-services npm namespace, bypassing code review entirely (Unit 42).
- In mid-May, after the Trivy scanner incident, TeamPCP open-sourced the worm — and copycats appeared within days, making attribution harder and the volume worse
GitHub’s own ecosystem data tells the same story from another angle: npm malware advisories rose 69% year over year in 2025, the highest volume since malware tracking began (reported via Resilient Cyber). Phoenix Security’s own intelligence corpus tracks 59 campaigns and 657 indexed malicious package versions from June 2024 through June 2026, with the first half of 2026 alone carrying roughly 4.5 times the malicious package volume of all of 2025.
The attack surface moved to the AI agent
This is the part most tools cannot see. Attackers no longer limit themselves to packages. They target the developer’s IDE extensions and the skills and configuration files that AI coding agents load and execute on their own. A poisoned VS Code extension, a malicious CLAUDE.md entry, a rogue MCP tool — each turns the developer’s own assistant into the thing exfiltrating secrets, without a single suspicious binary ever running.
Phoenix’s scanning bears this out: agent skills carry a markedly higher risk rate than IDE extensions, and more than one in four deep-scanned skills triggered a critical-risk finding. With AI now writing an estimated 30% to 41% of code at the largest engineering organisations, the agent is both the fastest-growing producer of code and the fastest-growing attack surface.
The system built to warn you has structurally fallen behind
Even when a flaw does merit a CVE, the advisory pipeline can no longer keep pace. In April 2026, NIST formally narrowed how it enriches the National Vulnerability Database, moving everything published before March 1, 2026 into a lowest-priority category it may never fully process. It cited a 263% rise in CVE submissions between 2020 and 2025 and enriched nearly 42,000 CVEs in 2025 — 45% more than any prior year — while still falling behind (NIST). A May 2026 federal audit put the unprocessed backlog above 27,000 vulnerabilities, and FIRST has forecast that 2026 will be the first year to cross 50,000 published CVEs (reported via NowSecure and Infosecurity Magazine).
| The structural truth Across all 59 campaigns in Phoenix’s corpus, zero CVEs were assigned during active exploitation. These attacks are not code defects — they are abuses of trust: a maintained package, a trusted publisher, a legitimate CI identity. There is no flawed code path to assign a CVE to, and no advisory to wait for. A defence that begins with “wait for the advisory” has already lost. |
And now the attacker has reasoning
The mythos-level shift is that frontier models compress the discovery-to-exploit cycle toward zero. Generation has become cheaper than interpretation: AI can find and weaponise a flaw in hours, while defensive review still assumes a human committing once a day. A handful of organisations have privileged access to the most capable frontier systems; everyone else defends on a limited budget against commodity models that are catching up fast. When attackers have reasoning, defenders need it too — but pointed at curated context, not the whole internet, or the economics never work.
The solution: Blue Shield
Blue Shield is the answer to a threat that does not announce itself. It does not wait for a CVE. It decides what a package or skill actually does — behaviourally — and blocks it at the moment of install, everywhere an install can happen.
Behavioural, not a blocklist
A blocklist only knows what is already known to be bad. Blue Shield reads behaviour: does this package reach for credentials, call out to infrastructure tied to a known campaign, drop an install hook, or carry a payload that fires on startup? Findings map to MITRE ATT&CK, and the verdict is explainable rather than a single opaque score. This is what lets it catch a fresh package from a campaign it has seen before, the day it is published, with no advisory in existence.
One verdict, every layer a package or skill enters
There is no single chokepoint that works. An install inside an agent skips your CI. A manual install on a laptop skips the agent. A poisoned skill never touches a package file. Blue Shield places a check at each layer and feeds them all from one intelligence backbone, Phoenix Blue, so a verdict made in one place holds in the others.
| Layer | What Blue Shield does there |
|---|---|
| AI agent | Checks every install the agent proposes before it runs. Tells the agent which version is safe and which is not, or blocks it — and routes genuine cases to a human. Critical when agents run autonomously or in a crowd. |
| Developer workstation | Protects against malicious packages and compromised skills installed locally, including installs that never involve an agent. |
| CI/CD pipeline | Blocks malicious packages as they move through the build, or decorates the pull request to flag which package should and should not be used. |
Blue Shield monitors across the package managers and systems attackers actually use — npm, PyPI, Maven, plus GitHub and Jenkins — and refreshes its intelligence continuously, so each verdict reflects where a package and its risk stand right now.
Endpoint monitoring and heartbeat
Blocking is half the job; you also need to know what you are running and whether your protection is alive. Blue Shield keeps a live inventory of every endpoint under its watch and a heartbeat from each collector, so the platform is the source of truth for what is installed and what is protected.
- See every endpoint — workstations, CI runners, and agent sessions in one view, with which are active and which have gone quiet.
- Know what’s on them — the packages, agent skills, and IDE or VS Code extensions per endpoint, with the risky ones flagged.
- Heartbeat and health — each collector reports in, so you can tell whether an endpoint is protected or has drifted. Each endpoint resolves to one stable identity, so the workstation and agent collectors on the same machine show as one endpoint, not two.
The human stays in control
When an agent works on its own, someone still needs to be able to step in. Blue Shield gives the agent a clear signal and routes real decisions to a person to approve, with the package’s behaviour and campaign context attached. The AI assists the decision. It never replaces the engineer, and every block is reviewable.
Free for the core tier, today
Phoenix has opened the core of Blue Shield, and the intelligence behind it, to everyone — because this is hitting teams who are doing everything right.
- Free core tier: protect your workstation, your pipeline, and your agents, starting today.
- Free intelligence: check any package and read the malware intelligence behind every verdict at phxintel.security — no account required.
- Paid tiers: Professional and Enterprise add higher limits and advanced controls for teams that need them.
From Phoenix Security
| “The attacks now move faster than the advisories meant to warn you, and they have moved onto the agents writing our code. We have watched the best-run organisations get hit through a package they trusted. So we built Blue Shield to decide what something does before it runs, and we opened the core tier and the intelligence to everyone — free — because cost should not be the reason a team goes unprotected. Don’t be afraid of this new wave. Go and protect your endpoints today.”— Francesco Cipollone, CEO and Co-Founder, Phoenix Security |
About Phoenix Security
Phoenix Security is an Actionable ASPM platform. It connects vulnerabilities from code to cloud, points each one at the team that owns the fix, and turns scattered findings into a single prioritized backlog. Blue Shield extends that to the supply chain, blocking malicious packages and skills at the agent, the workstation, and CI/CD, with endpoint monitoring across all three. The AI works alongside engineers, never in place of them — every block and every fix is something a person can review and approve.
Learn more at phoenix.security and phxintel.security. This is Blue Shield. Stay safe.
Selected sources
NIST NVD operations update (Apr 2026); Unit 42 npm threat landscape (Jun 2026); Snyk and StepSecurity Mini Shai-Hulud / AntV analyses (May 2026); SecurityWeek Miasma coverage (Jun 2026); Sonatype 2026 State of the Software Supply Chain; NowSecure and Infosecurity Magazine on the NVD backlog; Phoenix Security Malware Package Intelligence corpus.
