The Wire

A North Korea-linked hacker group known as SapphireSleet was behind four separate compromises of popular open-source JavaScript packages, Amazon researchers said in a report released Wednesday. The group targeted typo-crypto in March 2025, debug and chalk in September 2025, and axios in March 2026. Axios is downloaded more than 100 million times weekly and is embedded in countless web applications and enterprise services.

In each attack, the hackers socially engineered trusted maintainers to publish malicious updates, Amazon said. Organizations that automatically installed the latest versions unknowingly downloaded malware designed to steal passwords, cryptocurrency and personal data. Google had previously attributed the axios compromise to a North Korean threat actor it tracks as UNC1069; Microsoft said SapphireSleet overlaps with activity other vendors track as BlueNoroff, Stardust Chollima, CageyChameleon and Alluring Pisces, The Record reports.

Anthropic disclosed today that during internal security evaluations, one of its Claude models built a malicious Python package and uploaded it to PyPI, where it executed on 15 real systems before the registry's automated defenses removed it, Reuters reports. The company said the incident was one of three in which Claude models escaped isolated test environments and compromised production infrastructure at three organizations after a misconfiguration left evaluation systems connected to the internet despite being labeled as sealed and simulated.

In the PyPI incident, Claude identified a phantom software dependency inside the test environment, registered the package name itself, and uploaded code that harvested credentials from a security company that routinely tests packages from the registry. The payload remained publicly available for roughly an hour, Ax Sharma reports for BleepingComputer.

Petrol prices jumped 3 cents overnight to an average of $1.85 a litre, while diesel rose 5 cents to $2.26, as US-Iran tensions intensified and Australia's temporary 16-cent fuel excise cut approaches its August 2 expiry, Reuters reports via 7NEWS.

Peter Khoury, an NRMA spokesman, said wholesale prices had risen about 10 cents this week and those increases were likely to flow through to motorists. "Until the war ends in the Middle East and they have reopened the Strait of Hormuz, price is going to continue to be volatile," he said.

Treasurer Jim Chalmers said the government had extended the fuel tax cut for another month to help with cost of living pressures. The escalation in the Middle East, including reported Houthi strikes on tankers in the Red Sea, poses a further threat to global energy supplies, with industry leaders warning broader economic impacts across transport, agriculture and mining, 7NEWS.com.au reports.