Run by two students, Project6 hosts 48-hour mansion hacker houses in S’pore & beyond

Singapore’s startup scene has a problem.

It’s organised, well-funded, and growing, but it’s missing something essential: a “scrappy culture,” a sense of urgency, and spaces where builders can just… build, at least according to Canaan Poh, 23, and Xander Minzenmay, 21, the founders behind Project6.

So they did something unconventional: they rented a mansion and filled it with founders.

For 48 hours, participants are expected to do one thing—build. Sleep is optional. Shipping (turning an idea into a working product, for those not in the startup world) is not.

They’ve not only hosted their mansion hacker houses in the region, but also in Montreal, with plans to expand to more international locations, drawing hundreds of founders from across the globe. And it all started because Canaan and Xander got frustrated with how Singapore’s startup ecosystem actually worked.

Bringing the Silicon Valley spirit to Singapore

Canaan and Xander are currently both students, but deeply interested in the startup system.

Canaan studies at NTU and also runs lythe, an AI infrastructure startup. Meanwhile, Xander studies at the University of Queensland in Australia and has directed one of the largest university-focused startup conferences in the country.

The two met at a student networking event hosted by Canaan’s startup in Singapore while Xander was on exchange at SMU—and that’s where things began to take shape.

After the event, Xander left with the sense that the conversations weren’t going far enough. Much of the room was focused on introductions, LinkedIn exchanges, and conversations around fundraising and investor updates. While connections were being made, it felt like there was less emphasis on what people were actually building day to day.

He vented to Canaan afterwards. And Canaan got it immediately—he’d been feeling the same thing.

Compared to Silicon Valley in San Francisco, the culture felt different. There, high school dropouts raise millions and college students build billion-dollar companies. Credentials mattered less, and execution mattered more.

The question was obvious: Why couldn’t Singapore be like that?

They started by hosting founder dinners

The duo started small.

They began by hosting dinners at Canaan’s apartment, inviting founders they knew from hackathons and their network.

Each gathering brought together around 10 people, with no pitches or structured networking—just a deliberate effort to get the right people in a room and let conversations develop naturally.

They later expanded beyond Canaan’s home, holding dinners at cafés and restaurants. As interest grew, larger organisers began to take notice. Organisations such as SCAPE, along with other community spaces, eventually came on board to co-host these gatherings.

But dinners only went so far. They created space for conversation, but not necessarily for building. Ideas were discussed, connections were made, but most people still left and returned to their day-to-day work unchanged.

If the goal was to shift founders from talking to building, the format itself needed to change. So they started thinking bigger.

Inspired by hacker houses in Silicon Valley, they began experimenting with a new model: bringing founders together under one roof for short, high-intensity residencies.

In Jan 2026, they tested the idea for the first time. The pair rented a mansion in Johor Bahru and invited 10 founders from Singapore’s ecosystem for a 48-hour sprint.

Once the founders arrived, the structure was simple. After a short introduction phase, they quickly moved into building. Teams formed based on shared ideas and complementary skills, then spent the weekend developing products, coding, and iterating.

By the end of the 48 hours, each group presented what they had managed to build, ranging from early prototypes to functional demos.

Operating the hacker houses have not been straightforward

That first mansion went viral on LinkedIn. VCs and tech giants wanted in. More founders were keen on attending.

By Apr 2026, they had run a total of four 48-hour residencies. Applications for each cohort numbered in the hundreds.

But operating these hacker houses has not been straightforward, particularly in Singapore.

“The main challenge has been designing something that is sustainable and properly aligned with the local housing environment,” said Canaan.

As a result, their first founders’ meet-up took place in Johor Bahru, where short-term rentals were more feasible, followed by a second in Kuala Lumpur.

They eventually managed to organise a third residency in Singapore, in collaboration with AI.SEA, a builder-first initiative focused on Southeast Asia, with support from engineers at OpenAI.

Even so, the duo said they are still working closely with government stakeholders to explore how such residencies can be run more effectively within local constraints. They are currently planning to launch a dedicated house in Singapore, though details remain under wraps.

The mansion hacker house in Singapore ran concurrently with the Montreal edition. While founders were based in Singapore for the local residency, the Montreal house was operated in partnership with two individuals embedded in Canada’s startup scene.

15 projects shipped & over S$500K raised

Outcomes from Project6’s 48-hour residencies have been tangible.

“We have had multiple startups launched, with some already raising angel rounds of over S$500,000,” said Xander.

According to its website, 15 projects have been shipped across all houses.

This includes automotion, a tool that takes a static design, like a screenshot of an app or a UI layout, and automatically turns it into animation instructions and developer-ready code. Another one is TACK,

Another project is TACK, a real-time AI meeting moderator designed to keep discussions on track. It helps teams stay focused, captures key points as they emerge, and ensures conversations move forward productively rather than drifting off-topic.

For Canaan and Xander, the shipped products and capital raised serve as validation for their approach, evidence that short, intensive residencies can consistently translate into real startup outcomes.

They describe the initiative as a “third space for founders”—a setting outside of home and traditional offices where builders can live, work, and collaborate in a more immersive, high-intensity environment.

Looking ahead, Project6 is focused on scaling that model.

“Over the next one to two years, we see Project6 evolving to be active in more than 50 countries,” said Canaan, adding that cities such as Shenzhen, Hong Kong, and California are among the potential locations under consideration.

The long-term goal, he explained, is to establish flagship hacker houses in Singapore and San Francisco, effectively creating a bridge between the two ecosystems—giving Singapore-based founders greater access to global capital and networks, while also providing a landing point for international founders looking to build in Singapore.

We are bullish that hacker houses will become the new sourcing layer instead of the traditional accelerator model for the next wave of talent founders and builders, and ultimately, we will grow to support these founders on their journey.

• Find out more about Project6 here.
• Read other articles we’ve written on Singaporean businesses here.

Featured Image Credit: Canaan Poh/ Xander Minzenmay

X is closing its Communities feature in May, X Head of Product Nikita Bier has announced. Communities were introduced before Twitter was acquired and rebranded by Elon Musk, and act as a way for users to create, join and moderate public groups focused on a particular interest. Communities make it possible to follow a feed made up of only the people or subject matter you care about, but they haven’t been used at the scale the social platform wanted.

“Communities had a great vision, but they were used by less than 0.4% of users — yet contributed to 80% of spam reports, financial scams, and malware on X,” Bier said in a separate post. “It occupied half the team’s time some weeks, while the rest of the app suffered.” And while some real people did use groups to organize around niche topics, the most active groups were “user-acquisition channels for Kick or compensated clipper communities,” according to Bier, not really the intended uses for the feature in the first place.

X’s proposed replacement for Communities is its new XChat app, which can currently host group chats of up to 350 people, and will be expanded to support group chats of up to 1,000 people in the future, Bier says. Moderators are able to pin links in their Communities so members can join a group chat before the Communities feature is fully retired on May 30, an extension to the previously proposed deadline of May 6.

While that could keep groups together, a live group chat is fairly different from the asynchronous, separate-timeline-of-posts experience that Communities offered.  Group chats are typically active and demand your attention in a way a separate feed doesn’t. To get a timeline of posts focused on an interest, users will now have to turn to X’s new custom timelines feature, which uses Grok to automatically organize posts into feeds focused on topics like food, art or photography.

• High energy costs are forcing AI workloads out of the UK
• Cheaper electricity is becoming the deciding factor for AI deployment
• The US infrastructure advantage is accelerating the shift of AI workloads

British businesses are paying more than four times as much for electricity as their American counterparts, and the AI industry is taking notice.

According to CUDO Compute, 20% of UK firms have already moved AI workloads out of the country due to high power costs.

Redwood Materials chief operating officer Chris Lister is leaving the battery recycling company to retire, TechCrunch has learned — and he’s not the only executive that recently departed.

Lister, a former vice president who led operations at Tesla’s Nevada Gigafactory, has been with Redwood since late 2023. He started as the company’s chief supply chain officer and was quickly promoted to the COO role in 2024. The promotion put him closer in the org chart to Redwood founder and CEO JB Straubel, who was Tesla’s longtime chief technology officer and currently sits on the automaker’s board.

Redwood Materials recently informed employees that Lister was retiring, according to an employee who was granted anonymity to speak about the announcement. The company confirmed Lister’s departure to TechCrunch on Thursday. “We wish him the best in his retirement,” a spokesperson said via email.

News of Lister’s retirement comes just a few days after TechCrunch revealed Redwood Materials recently laid off around 10% of its workforce, or roughly 135 employees.

Those cuts were part of a restructuring that Straubel told employees about in an email viewed by TechCrunch earlier this week. He said the shuffle will help support the company’s growing energy storage business. Redwood has recently signed deals with automaker Rivian and artificial intelligence company Crusoe to provide refurbished batteries that can be used as grid storage.

Other executives have left Redwood in recent months, too.

Bradley Mayhew, Redwood’s vice president of integrated supply chain and a former Tesla employee, left the company earlier this month, according to LinkedIn. Guillermo Urquiza, Redwood’s vice president of mechanical engineering — and another former Tesla employee — left in March. And Carlos Lozano, the company’s vice president of manufacturing, left earlier this year for a leadership role at Panasonic, according to LinkedIn.

Mayhew, Urquiza, and Lozano didn’t respond to requests for comment. Redwood declined to specifically comment on their departures, but noted that Straubel said in his all-staff email that he is trying to reduce layers of management at the company.

Straubel also told employees in his message that “parts of the company have expanded faster than needed” and that he was “more excited than ever with our path ahead as we build the most integrated and cost-effective critical materials and energy storage business in the world.”

“We are confident that we can deliver on our critical projects with a smaller team that is more focused,” he wrote. “We have successfully adapted to changes in the market that have bankrupted many of our competitors.”

Porsche will start selling an all-electric Cayenne coupe in late summer, the latest signal from the German automaker that it still sees market demand for EVs.

The Cayenne coupe EV — which has four doors, unlike a traditional coupe — will join several other all-electric variants of the SUV when it comes to market later this year, including the base Cayenne Electric, Cayenne S Electric, and Cayenne Turbo Electric. Porsche does, after all, love its variants.

And it could be its most successful. When Porsche introduced a coupe version of its gas-powered Cayenne in 2019, it took just a year for the sportier version of the crossover SUV to capture 20% of sales within the Cayenne lineup. Five years later, the coupe variant accounts for 40% of Cayenne sales, according to Porsche. In some markets, the coupe accounts for as much as 90%.

In other words, the numbers suggest that the all-electric Cayenne coupe is a worthy bet even with its six-figure price tag.

The Cayenne Coupe Electric (as it is officially branded) won’t replace its gas-powered or hybrid brethren, unlike the Porsche Macan compact SUV, which will only be sold as an EV after this year.

The company says the Cayenne coupe EV will be sold alongside the other fuel variants well beyond 2030, according to a Porsche spokesperson. That could produce some valuable data for Porsche on what flavor of Cayenne coupe consumers actually want to buy — and whether this electric variant proves to be its most popular. (The extra front trunk space alone could influence some buyers, not to mention gas prices.)

None of those questions can be answered, however, until the Cayenne Electric, Cayenne S Electric, Cayenne Turbo Electric, and Cayenne Coupe Electric go on sale globally later this year — about nine months after the EV version was first unveiled.

When the Cayenne coupe EV does go on sale, it will be offered in three variants: the base version, an S coupe, and a turbo coupe. (If you think that’s a lot, go check out how many versions of its flagship Porsche Taycan EV exist.)

The Cayenne Coupe Electric starts at $113,800, not including the $2,350 delivery fee. Prices rise from there with the Cayenne S Coupe Electric at $131,200, and the Cayenne Turbo Coupe Electric at $168,000. Consumers can, of course, spend even more by adding on options like the lightweight sport package, which includes a carbon roof, performance tires, and motorsports-inspired interior features.

For that kind of money, consumers will get a lot of horsepower and torque tucked inside a crossover body with a sloping roofline that is reminiscent of the iconic 911. All variants of the coupe EV come with an 800-volt powertrain, air suspension, and a shared roof design that features a new windshield and an adaptive rear spoiler. The Cayenne coupe EV is also equipped with the North American Charging Standard port, or NACS, that Tesla popularized, as as well as an additional AC charging port.

From here, some specs change depending on the version a consumer buys. The base coupe EV generates up to 435 horsepower and 615 pound-feet of torque, with a top speed of 143 miles per hour and a zero-to-60 time of 4.5 seconds.

For those who aren’t satisfied, there are two more powerful options that push those performance specs much higher. At the top end, the turbo version generates up to 1,139 horsepower and 1,106 pound-feet of torque — putting it up there with the Tesla Model S Plaid, Lucid Air Sapphire, and Porsche Taycan Turbo GT. The turbo version has a top speed of 162 mph and can travel from 0 to 60 mph in an eye-watering 2.4 seconds.

Porsche hasn’t released EPA estimates for the range these coupe EVs will deliver on a single charge. But early real-world testing is in line with other Cayenne electric variants, which is about 360 miles. Of course, if coupe EV buyers opt for those larger tires — which create more rolling resistance, requiring the battery to work harder — the range could drop about 10%.

Disclaimer: Unless otherwise stated, any opinions expressed below belong solely to the author. Data sourced from the Sensing SG survey by Blackbox Research.

The impact of the war in Iran is being felt by Singaporeans, according to the latest update to the long-running domestic sentiment survey carried out by Blackbox Research on approximately 1500 residents in Apr. The disruption caused by the closure of the Strait of Hormuz, which has led to oil and gas shortages across Asia, is also reflected in higher energy and petrol prices in Singapore.

This, in turn, not only influences the day-to-day transportation costs or electricity tariffs, but the costs of most goods as well, since the country imports almost everything, and all those goods have to arrive by air, road, or, mostly, sea.

It’s hardly a surprise, then, that the cost of living has rebounded as a top national concern, rising from 34% of responses in Q4 2025 to 46% in Q1 2026.

What’s more, according to Blackbox, just 46% of Singaporeans feel better off today than a year ago, which is the lowest reading recorded yet and sharp drop from 54% in Q4 of 2025.

And optimism about the future is melting equally quickly.

43% of respondents believe that the country will be doing better a year from now (down from 53%), while the share of those who think it’s going to be worse has doubled from just 19% to 38%.

There’s a warning for the government hidden in these statistics, too, as public confidence in the management of cost pressures is sliding already.

While the Government continues to receive high marks for Defence and National Security, which rose by six percentage points to 90%, its performance on Cost of Living has slipped 6 points to 46%.

Other key measures, such as housing affordability, the wealth gap, and GST, have all declined by at least three percentage points.

While a vast majority of the population may be happy with how the country is managed, they do expect the authorities to proactively address crises such as the current one caused by a distant, foreign war. Since the measures announced by PM Wong are only scheduled to be deployed in the coming months, most people haven’t yet felt them in their wallets.

Singaporeans still believe in themselves

Interestingly, the pessimism about the next 12 months in Singapore doesn’t translate into self-doubt, as still more than half of the local residents (52%) expect to be better off. Even though it’s a drop from 59% in Dec, it is relatively much smaller.

Similarly, just 19% see themselves falling behind over the next year—half as many as those who predict that to be the case for the entire country.

What’s more, in spite of the headwinds caused by the war, 86.3% are satisfied with the current situation in Singapore, 81.4% rate the economic situation positively, and 76.5% are happy with their personal finances.

In other words, while more people are anxious about what the turbulent future might bring, the vast majority are still very comfortable with where they are. And feel about the same about Singapore as a whole, too.

• Read other articles we’ve written on Singapore’s current affairs here.

Featured Image Credit: Guo Xin Goh via Unsplash

from the ctrl-alt-speech dept

Ctrl-Alt-Speech is a weekly podcast about the latest news in online speech, from Mike Masnick and Everything in Moderation‘s Ben Whitelaw.

Subscribe now on Apple Podcasts, Overcast, Spotify, Pocket Casts, YouTube, or your podcast app of choice — or go straight to the RSS feed.

In this special episode, Mike and Ben reflect on 100 episodes of the podcast, followed by an important announcement: we’re launching a Patreon and making some changes to Ctrl-Alt-Speech!

Starting on May 28th, Patreon members will get early access to extended weekly episodes with in-depth coverage of an extra major story. The free episodes will continue here on this feed, just slightly shorter and released one day later. 

You can become a member now at one of two levels: Supporters get early access to the extended episodes, and for a limited time Founders get that plus the opportunity to send us news stories that you think we should cover each week. After the new episodes begin at the end of May, the Founder tier will become the Insider tier with all the same benefits at a slightly higher price, so act now if you don’t want to miss out (you’ll also get bragging rights as a founding member!)

We’re immensely grateful to the incredible audience we’ve found over these past 100 episodes, and this is our way of helping make the podcast sustainable for the next 100!

Filed Under: content moderation, trust and safety

Companies: patreon

Summary: Meta is cutting approximately 8,000 employees (10% of its workforce) beginning 20 May, cancelling 6,000 open roles, and planning additional cuts for H2 2026. The layoffs, announced via an internal memo from HR head Janelle Gale, are structural rather than performance-based, reorganising teams into AI-focused “pods” while Meta spends $115-135 billion on AI infrastructure this year. The cuts arrive alongside executive stock options worth up to $921 million each and a workplace surveillance programme capturing employee keystrokes to train AI agents.

Meta told employees on Wednesday that it will cut approximately 8,000 jobs, roughly 10% of its global workforce, beginning on 20 May. The company is also cancelling 6,000 open requisitions it had planned to fill, bringing the effective headcount reduction to 14,000 positions. Additional cuts are planned for the second half of the year, though their timing and scope have not been finalised. If the second wave matches the first, Meta will have eliminated roughly 20% of its pre-2026 workforce. The memo announcing the cuts was written by Janelle Gale, Meta’s head of human resources, who said the announcement came early because details had already leaked. “We’re doing this as part of our continued effort to run the company more efficiently and to allow us to offset the other investments we’re making,” Gale wrote. “This is not an easy tradeoff and it will mean letting go of people who have made meaningful contributions to Meta during their time here.”

The investments she is referring to cost between $115 billion and $135 billion this year alone. That is Meta’s guided capital expenditure for 2026, a 73% increase over the $72.2 billion it spent in 2025, nearly all of it directed at AI infrastructure. The company is building Prometheus, a one-gigawatt AI supercluster in Ohio coming online this year, and Hyperion, a 2,250-acre, $10 billion facility in Louisiana capable of five gigawatts. It hired Alexandr Wang, the former Scale AI chief executive, as its first chief AI officer in June 2025 through a deal that included a $14.3 billion investment in Scale AI. It is poaching elite AI talent with packages worth up to $1.5 billion for a single engineer. The people being hired are not the same people being fired. That is the point.

The rolling layoffs

The May cuts are the third wave of 2026 layoffs at Meta. In January, the company eliminated more than 1,000 positions in Reality Labs, shutting down several VR game studios and cutting roughly 10% of the division. In March, it cut another 700 employees across at least five divisions, including Reality Labs, Facebook social, recruiting, sales, and global operations. The May round is company-wide and structural rather than performance-based, a distinction Gale’s memo made explicitly. Meta is reorganising teams into AI-focused “pods” and transferring engineers from across the company into the Applied AI organisation. New role categories are being created: “AI builder,” “AI pod lead,” and “AI org lead.” The company’s internal language describes the goal as driving “a step change in engineering productivity and product quality” through “fundamentally rewiring how we operate.”

The cumulative toll since 2022 now exceeds 33,000 jobs. Meta cut 11,000 in November 2022, 10,000 in March 2023, 3,600 in January 2025 (framed as performance-based, though employees with positive reviews were caught in the sweep), and approximately 9,700 across the three 2026 waves. The company ended 2025 with 78,865 employees, up 6% year over year, having rehired aggressively through 2024 and 2025 after the original “year of efficiency” reductions. It is now cutting deeper than it rehired. US workers affected by the May round will receive 16 weeks of base pay plus two additional weeks per year of service, and 18 months of health coverage.

The 💜 of EU tech

The latest rumblings from the EU tech scene, a story from our wise ol’ founder Boris, and some questionable AI art. It’s free, every week, in your inbox. Sign up now!

The compensation contrast

Days before the March layoffs, Meta filed SEC disclosures revealing a new stock option programme tied to reaching a $9 trillion market capitalisation by 2031, roughly six times its current valuation. The potential payout: up to $921 million each for chief technology officer Andrew Bosworth, chief product officer Chris Cox, and chief operating officer Javier Olivan, and $787 million for chief financial officer Susan Li. Mark Zuckerberg is not included in the plan. The programme is modelled after Tesla’s Elon Musk compensation structure and is Meta’s first such award since going public in 2012.

The optics are difficult to defend. Stock-based compensation consumed approximately 96% of Meta’s $43.6 billion in free cash flow in 2025. Rank-and-file employees have seen reduced stock compensation in recent years while absorbing successive layoff rounds. The message, whether intended or not, is that the people who survive the cuts will work for less while the people who direct the cuts stand to make nearly a billion dollars each. The $9 trillion target requires Meta’s market capitalisation to grow at roughly 35% annually for five years. If the target is met, the stock appreciation that generates the executive payouts will have been funded in part by the labour cost reductions that the layoffs produce.

The surveillance question

The layoff announcement arrived days after a separate disclosure that sharpened employee anxiety. Meta is installing software on US employees’ work computers under a programme called the “Model Capability Initiative,” which captures keystrokes, mouse movements, and screenshots to train AI agents. Bosworth told employees that “there is no option to opt out of this on your work provided laptop.” The Register reported that employees protested the programme on internal forums. Cornell researchers raised consent and compensation questions about using employee behaviour as AI training data.

The juxtaposition is stark. Meta is asking its remaining employees to generate the training data that will teach AI systems to replicate computer-use patterns, while simultaneously laying off the employees whose patterns the AI will eventually replace. Zuckerberg is building a personal AI agent to handle executive information retrieval and coordination, the same kind of work that middle-management and operational roles traditionally perform. Internal tools called MyClaw and Second Brain are already reshaping how Meta employees interact with the company’s systems. The trajectory is clear: more AI, fewer people, and the people who remain will train the AI that makes the next round of people unnecessary.

The industry pattern

Meta’s cuts landed on the same day Microsoft announced its first voluntary retirement programme in 51 years, offering buyouts to roughly 7% of its US workforce. Oracle eliminated 20,000 to 30,000 employees in March. Atlassian cut 1,600 and replaced its CTO with two AI-focused executives. The tech sector has recorded more than 73,000 job cuts across 95 companies in the first four months of 2026, with projections that the full-year total will exceed the 124,201 eliminated in all of 2025. Every major company cites AI restructuring as the primary driver. The methods differ, Oracle’s was abrupt, Microsoft’s is voluntary, Meta’s is phased, but the direction is the same: traditional roles out, AI roles in, and the spending saved on the former redirected to the latter.

Meta’s Q4 2025 results, the most recent available, showed $59.89 billion in revenue (up 24%), $22.77 billion in net income, and earnings per share of $8.88, beating estimates by 8.4%. Full-year revenue crossed $200 billion for the first time. Q1 2026 results are due on 29 April, with revenue guidance of $53.5 billion to $56.5 billion. The company is not cutting because it is struggling. It is cutting because it has decided that the fastest path to a $9 trillion valuation runs through AI infrastructure, not through the 8,000 people it no longer needs. The question that Gale’s memo does not answer, and that no memo from any tech company this year has answered, is what those people are supposed to do next.

Updated with further information from Bitwarden.

The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing payload capable of spreading to other projects.

According to reports by Socket, JFrog, and OX Security, the malicious package was distributed as version 2026.4.0 and remained available between 5:57 PM and 7:30 PM ET on April 22, 2026, before being removed.

Bitwarden confirmed the incident, stating that the breach affected only its npm distribution channel for the CLI npm package and only those who downloaded the malicious version. 

“The investigation found no evidence that end user vault data was accessed or at risk, or that production data or production systems were compromised. Once the issue was detected, compromised access was revoked, the malicious npm release was deprecated, and remediation steps were initiated immediately,” Bitwarden shared in a statement.

“The issue affected the npm distribution mechanism for the CLI during that limited window, not the integrity of the legitimate Bitwarden CLI codebase or stored vault data.”

Bitwarden says it revoked the compromised access and deprecated the affected CLI npm release.

The Bitwarden supply chain attack

According to Socket, threat actors appear to have used a compromised GitHub Action in Bitwarden’s CI/CD pipeline to inject malicious code into the CLI npm package.

According to JFrog, the package was modified so that the preinstall script and the CLI entry point use a custom loader named bw_setup.js, which checks for the Bun runtime and, if it does not exist, downloads it.

The loader then uses the Bun runtime to launch an obfuscated JavaScript file named bw1.js, which acts as credential-stealing malware.

Once executed, the malware collects a wide range of secrets from infected systems, including npm tokens, GitHub authentication tokens, SSH keys, and cloud credentials for AWS, Azure, and Google Cloud.

The malware encrypts the collected data using AES-256-GCM and exfiltrates it by creating public GitHub repositories under the victim’s account, where the encrypted data is stored.

OX Security says that these created repositories contain the string “Shai-Hulud: The Third Coming,” a reference to previous npm supply chain attacks that used a similar method and text string when exfiltrating stolen data.

The malware also features self-propagation capabilities, with OX Security reporting that it can use stolen npm credentials to identify packages the victim can modify and inject them with malicious code.

Socket also observed that the payload targets CI/CD environments and attempts to harvest secrets that can be reused to expand the attack.

The attack comes after Checkmarx disclosed a separate supply chain incident yesterday that impacts its KICS Docker images, GitHub Actions, and developer extensions.

While it is not known exactly how attackers gained access, Bitwarden told BleepingComputer the incident was linked to the Checkmarx supply chain attack, with a compromised Checkmarx-related development tool enabling abuse of the npm delivery path for the CLI during a limited time window.

Socket told BleepingComputer that there are overlapping indicators between the Checkmarx breach and this attack.

“The connection is at the malware and infrastructure level. In the Bitwarden case, the malicious payload uses the same audit.checkmarx[.]cx/v1/telemetry endpoint that appeared in the Checkmarx incident. It also uses the same __decodeScrambled obfuscation routine with the seed 0x3039, and shows the same general pattern of credential theft, GitHub-based exfiltration, and supply chain propagation behavior,” Socket told BleepingComputer.

“That overlap goes beyond a superficial resemblance. The Bitwarden payload contains the same kind of embedded gzip+base64 components we saw in the earlier malware, including tooling for credential collection and downstream abuse.”

Both campaigns have been linked to a threat actor known as TeamPCP, who previously targeted developer packages in the massive Trivy and LiteLLM supply chain attacks.

Developers who installed the affected version should treat their systems and credentials as compromised and rotate all exposed credentials, especially those used for CI/CD pipelines, cloud storage, and developer environments.

Update 4/23/26: Updated the story with information from Bitwarden confirming the incident was linked to the Checkmarx supply chain attack.

AI chained four zero-days into one exploit that bypassed both renderer and OS sandboxes. A wave of new exploits is coming.

At the Autonomous Validation Summit (May 12 & 14), see how autonomous, context-rich validation finds what’s exploitable, proves controls hold, and closes the remediation loop.

Claim Your Spot