This is unsettling. No evidence of any OpenHands transitive dep being breached, but the campaign is large enough (TeamPCP / Mini Shai-Hulud: ~500 packages, 1,000+ malicious versions, 99% npm) that having a "what if it's us" protocol ready may be worth it. The supply-chain leg hit legitimate packages (PyPI durabletask 1.4.1 through 1.4.3, guardrails-ai) through stolen publish tokens, not typosquats. A trusted dependency shipping a poisoned patch is invisible to "is this real / is the maintainer legit" checks, and the payload was a credential stealer that moved through CI and dev machines. The npm waves propagate by forging GitHub Actions publish tokens, so our own CI is in scope, not just our deps. I checked software-agent-sdk: 404 Python packages, hash-locked in uv.lock and installed with uv sync --frozen, none of the named packages present. No exposure from this incident. Two gaps I did find: the agent-server's npm install for ACP agents has no lockfile (transitive deps float, unhashed), and all 156 GitHub Actions refs are tag-pinned rather than SHA-pinned while Dependabot bumps them weekly. One is tj-actions/changed-files, the action behind the March 2025 secret-leak compromise. Auditing the other OpenHands repos against the aggregate list now, will report back this afternoon. Questions for the group: - Do we have a version-bump cooldown anywhere? I don't see one in software-agent-sdk. - Any objection to SHA-pinning Actions (Dependabot still updates the SHA) and adding a lockfile to the agent-server npm install? I can open both PRs. https://thehackernews.com/2026/05/github-investigating-teampcp-claimed.html

Any objection to SHA-pinning Actions (Dependabot still updates the SHA) and adding a lockfile to the agent-server npm install? I can open both PRs.

About that, there it was already a proposition for that: https://github.com/OpenHands/software-agent-sdk/issues/2876 @calm-artist-7206 can give more info. cc. @dry-book-58714 perhaps this is interesting for you

Also - anyone investigating this attack vector would be wise to do it inside a VM. Infected packages have been documented to carry a dead-man switch that wipes your home directory.

nod We are currently using • packager (uv, npm) chooses > 7 days • the agent / reviewer knows about 7 days I am trying to add dependabot too; dependabot PRs ignored the 7 days, but apparently there's a configuration option for that

I agree it belongs in AGENTS.md and the pr-review prompt too. I cross-referenced both repos against the aggregate Mini Shai-Hulud list (2,766 entries): both clean, closest call litellm (we're on 1.83.14, the poisoned releases were 1.82.7/1.82.8). The campaign spreads by forging Actions publish tokens, so this is the live vector. I'll open Phase 1 (pinact to convert the external refs to SHAs, version in a trailing comment, CI green) and take the agent-server ACP npm lockfile as a separate PR.