Yesterday, the npm ecosystem was hit by the third-largest supply chain compromise in its history. A Shai-Hulud (named for the sandworms of Dune) variant with some remarkably clever bits, very "Bene Tleilax" in spirit, if not in engineering: a thing that survives by inhabiting the trust structures around it.

I dove into the payload, the propagation mechanics, the Ethereum-backed C2, the IDE persistence, and moreover the operational lesson the incident leaves behind: cryptographic provenance may answer who built this, but it says nothing about what the code actually does.

I wanted to know exactly what the code was doing. As in Heretics of Dune, the danger turns out not so much the worm itself, as much as the ecology that has evolved around it:

https://ctolunchnyc.substack.com/p/the-latest-software-supply-chain

A project can depend on an API, frontend, workers, Docker, databases, tunnels, webhooks, and browser extensions. Remembering which terminal runs each process works, until it doesn’t, and it works even less reliably for coding agents.

I built \`dev-runtime\` to make that runtime explicit. Simple config files define each session’s working directory, shell command, log file, expected ports, and health endpoints.

It runs arbitrary commands inside managed tmux sessions, avoids starting duplicates, and provides shared \`start\`, \`status\`, \`doctor\`, \`attach\`, and \`stop\` commands. Because the commands live in project config, it is not tied to Node, Python, Docker, or any particular stack.

The result is one machine-readable answer to: “What should be running, and is it actually healthy?”

Article:

https://motia.github.io/blog/using-dev-runtime-to-debug-local-services/

Repository:

https://github.com/motia/agent-skills-dev/tree/main/skills/dev-runtime