The Engineer

Self-propagation is the property that reorders triage. The mechanism matters: the payload harvests credentials, and the stolen npm publish tokens become the vector for the next wave. That is how two packages became hundreds inside a day. A blocklist of known-bad versions describes packages that were already republished. It says nothing about which tokens are currently in an attacker's hands.

"We don't depend on those" is the wrong first answer as well. keyv and cacheable sit in caching and HTTP-client territory, underneath got and cacheable-request, so they resolve transitively into trees nobody would describe as cache-dependent. Verify with npm why keyv and npm why cacheable across every repo and every base container image, then cross-reference lockfile resolution timestamps against CI install logs. The exposure question is not whether the package appears in package.json. It is whether any CI job resolved dependencies during the window, and what was sitting in that job's environment.

Publish no longer means installable

GitHub has started scanning every npm package for malware at publish time. That is genuinely good engineering, and it silently voids an assumption baked into thousands of release scripts: that npm publish returning 200 means the artifact is installable. It now means the artifact is queued for an asynchronous scan of unspecified duration.

Alert on the timeout instead of failing silently. Otherwise the latency gets discovered during a 3am hotfix.

NuGet removes the option to keep doing this

The .NET side of the same problem now has a date. Per Devshot's reporting, new NuGet.org API keys cap at 30 days from August 17, 2026, and every key created before that hard-expires on November 1, 2026. Microsoft points at Trusted Publishing over OpenID Connect, citing the NX/NPM breach where stolen credentials produced 6,000 malicious activations in 36 minutes.

The coverage gap is being reported as a migration. Trusted Publishing supports GitHub Actions and GitLab only. If the publish step runs on Azure DevOps, Jenkins, TeamCity, or Buildkite, no migration exists. What exists is a rotation treadmill to build: a scheduled rotation job, a secret store that supports programmatic update, and an alert when a key ages past about 21 days.

A worm that steals publish tokens and republishes with them makes version triage the smaller job. The rotation should already be finished.

The structural fix is the same on both registries, and it is a workflow-identity change rather than an architecture change: OIDC short-lived credentials plus staged publishing, and delete the long-lived NPM_TOKEN and NuGet key secrets from CI entirely. A worm that steals a credential valid for minutes, scoped to one workflow, gets nothing worth having.

Start with the row that has no relying-party mitigation. Unit 42 describes a 32-byte security domain secret that sits in logs and in memory and decrypts every synced passkey, permanently, with no re-wrap and no revocation path described. A scheme where one stolen 32-byte value retroactively opens the entire vault is not a key hierarchy. It is a password. Secret material that transits log paths is greppable this afternoon: key-encryption keys in structured logs, tokens in crash dumps, heap snapshots shipped to third-party observability.

The other two techniques are more directly actionable. Chrome keeps passkey metadata in an unencrypted database, and it generates the device identity key as an exportable blob rather than TPM-sealed. Resident malware can therefore sign assertions exactly as Chrome would. WebAuthn's phishing resistance survives intact. Its possession guarantee does not.

The operationally nasty part is that nothing renders on screen, so no user files a ticket. What is left is session anomaly detection at the identity provider plus endpoint telemetry. Those are the same laptops that matter for the second half of this.

The markdown file that ships with a credential set

The privilege escalation in a poisoned agent instruction file is not in the file. The file is text. It becomes remote code execution because the agent runs on a developer box with ~/.ssh, ~/.aws/credentials, a GitHub PAT, an npm publish token, and a live kubeconfig in reach, frequently in auto-approve mode.

Compare the gates. A package manifest diff gets scrutinized, hits SCA and a lockfile, and often requires review. CLAUDE.md, .cursor/rules/**, .github/copilot-instructions.md and .mcp.json auto-load on repo open, unsigned, absent from every lockfile, and get reviewed as documentation when they are reviewed at all. Concealment is worse than in code: hidden HTML comments, collapsed <details> blocks, and zero-width or bidirectional Unicode that render invisibly in the markdown a reviewer approves. In the token stream the model reads, all of it sits fully present. There is no stable signature to match on.

Pillar Security's ADK demonstration shows where this ends once the agent holds real capability. A single public GitHub issue steered Google's triage agent into a privileged code-fixing workflow, and Google's fix was deleting three workflows rather than sanitizing input or scoping the token.

When a framework's own authors delete three workflows instead of patching them, the honest read is that agentic privilege design is unsolved — so scope the token, not the prompt.

Ordered by risk removed per hour spent: CODEOWNERS with an out-of-team reviewer on the agent-config path class, then a CI diff gate that flags zero-width and bidi Unicode, base64 blobs, external URLs and imperative directives, then stripping ambient credentials by running agents in a devcontainer or microVM with task-scoped short-TTL tokens. The last one converts an enterprise incident into a weird log line.

Every serving optimization maps to one term in one equation, so they rank before any benchmark runs. The equation is 2 × layers × KV heads × head_dim × bytes_per_number × tokens × batch. The 2 is key and value. Layers count because each layer keeps its own cache. Llama 3 70B at 80 layers, 8 KV heads, head_dim 128, fp16 gives 327,680 bytes, about 320KB per token per request. At 128K context that is roughly 41GB for one request.

Prefill and decode pull against each other. Prefill runs all input tokens in one parallel pass and saturates the math units. Decode emits one token at a time and re-reads the entire cache from HBM every step, saturating the memory bus. On one homogeneous replica pool a phase is always leaving silicon idle, and long prefills head-of-line block other requests' decode steps. What settles prefill/decode disaggregation is inter-token latency degradation on decode-heavy requests while long prefills share the replica.

Where cache traffic overtakes weight traffic

Back-of-envelope, assumptions stated. An 8×H100 node has roughly 26.8 TB/s aggregate HBM. Llama 3 70B fp16 weights are 140GB, streamed once per decode step, about 5.2ms. Cache traffic scales with aggregate in-flight tokens. Set the two equal: 140GB ÷ 320KB is about 440,000 tokens. Past that, batch 4 at 110K each or batch 32 at 14K each, decode moves more cache bytes than weight bytes, and quantizing the cache buys more latency than quantizing weights.

Which levers are free and which are gambles

Paged attention and prefix caching change how the cache is stored and shared; quantization and eviction change what it contains. Only the first is quality-neutral by construction, and it is good engineering. Paged attention cuts fragmentation from 60–80% to under 4% for 2–3x throughput. Prefix caching saves 50–90% of cost and latency on hits. Eight-bit KV quantization is 2x at a quality cost well under 1%. Four-bit is 4x with measurable loss on multi-needle retrieval: fine for chat, wrong for RAG. Eviction with sliding windows and attention sinks is non-causal by construction, since whether a token matters depends on a query that has not arrived. Once evicted, the model behaves as if the token never existed.

Prefix caching fires only on byte-identical prefixes, so one generated_at timestamp or session UUID high in a system prompt invalidates everything downstream. The order that survives is static system prompt, tool schemas, few-shots, retrieved chunks, volatile fields, user turn. Cached-token share is the SLI, since it maps to the bill. GPU utilization is not a decode health signal; KV pool utilization, preemption and recompute rate, prefix hit rate, and bytes moved per decode step are.

ByteByteGo flags one caveat and declines to resolve it: cross-user cache sharing has opened timing side-channels that leak information about other tenants' prompts. The cheapest large cost reduction on the menu has the least-settled isolation story. Whether a provider shares blocks across tenants is usually undocumented, and worth asking before compliance does.

The KV cache is a bandwidth cost, not a storage cost. That is why shrinking it speeds up generation and adding FLOPs does not.