The neutral tooling layer is gone, and your CI is on fire

Anthropic is paying north of $300M for Stainless, the four-year-old shop that generates the official Python, TypeScript, Go, and Ruby client libraries for OpenAI, Google, and Anthropic itself. Every team that has ever typed pip install openai has been shipping Stainless-generated code into production. As of this week, that code generator is owned by one of the three providers it serves.

The same week, TeamPCP backdoored the Checkmarx Jenkins AST Scanner plugin at version 2026.5.09 — their third supply-chain vector since February, after Trivy and the GitHub Actions/OpenVSX round. And a Bun-based npm worm tracked as Mini Shai-Hulud hit 169 package names across 373 versions, including packages adjacent to Mistral and TanStack, exfiltrating GitHub PATs, npm publish tokens, and cloud IAM keys through prepare hooks on optionalDependencies. TanStack alone: 84 malicious versions across 42 packages carrying 12M+ weekly downloads.

Trusted publishing did not stop it. The worm ran at install, not at publish. Your lockfile hash matches. Your provenance check passes. The package is "trusted."

The acquisition matters more than the price

Stainless is not going to weaponize its OpenAI SDK next Tuesday. That is not the failure mode. The failure mode is drift — a deprecation here, a slower release cadence there, a subtle change in retry semantics or streaming parser behavior that shows up as a regression in someone's eval harness and gets attributed to model quality. Six months from now, OpenAI and Google will bring SDK generation in-house. In the intervening window, teams whose agentic workflows silently depend on Stainless conventions will spend a quarter debugging what looks like model degradation and is actually generator divergence.

Yes, but — the counter-reading is that most teams use a narrow slice of the SDK surface (auth, retries, typed requests, streaming) and could replace the hot path with about 200 lines of httpx in an afternoon. That is genuinely true. It is also why the defensive move is cheap enough to just do, rather than argue about.

The deeper signal: the layer between models and developers is no longer commodity plumbing. Anthropic paid platform pricing for a tools company because agents like Claude Code are becoming first-class API consumers, and whoever owns the interface layer shapes how the agent ecosystem forms. The "best model for each task" posture was subsidized by neutral infrastructure. That subsidy just expired.

The build pipeline is the target now

The npm worm and the Jenkins backdoor share an attack surface: CI runner environment variables. NPM_TOKEN, AWS_*, GITHUB_TOKEN, OIDC credentials, mounted .env files. In CI, that is everything. The payloads need no sophistication. They need one green build.

What separates this week from last quarter is that both campaigns bypass the controls the industry put in place after the previous round. Marketplace publisher verification did not stop TeamPCP. Trusted publishing did not stop the worm — the abused workflows minted valid tokens on demand. TeamPCP has now run the same play against three developer-tool distribution channels in three months, and there is no reason the fourth doesn't land in July.

While you're auditing, also inventory Ollama. CVE-2026-7482 is a pre-auth heap leak on the GGUF tensor path — three unauthenticated API calls and a malformed model file stream heap contents back over HTTP. Roughly 300,000 instances are exposed on the public internet. Ollama was written as a local developer tool and ended up bound to 0.0.0.0 on production hosts. The heap holds prompts, API keys, and environment variables. Assume the ones you can see externally have already been scraped.

What actually changes this week

Three moves, in this order, before Friday.

Rotate first, investigate second. Every GitHub PAT, npm token, cloud IAM key, and CI secret that touched a build runner in the last 30 days. Not the ones you think were exposed — all of them. Rotation is cheaper than the forensics required to prove non-exposure. Cross-reference lockfiles against the published TanStack and Bun worm IOC lists while the tokens are cycling. If you run Jenkins, verify the Checkmarx AST Scanner plugin is not at 2026.5.09 and roll back to 2.0.13-829 if it is.

Pin the SDK, then wrap it. Version-pin every Stainless-generated client — openai, anthropic, google-genai — with SHA-level lockfile entries, and set up changelog alerts on the upstream repos. Then, for your two highest-volume inference calls, spend an afternoon writing the thin adapter that lets you swap providers as a config change rather than a refactor. Not a full LiteLLM abstraction — that is over-engineering for a risk that resolves in 12 months. Just enough that when OpenAI forks their SDK, your migration is a diff, not a project.

Bind Ollama to localhost and front it with an authenticated reverse proxy. Tonight. Then rotate every secret that lived in the process environment of any instance that was ever externally reachable. The 300,000 number will come down slowly, the way misconfigured Elasticsearch and MongoDB did five years ago. Same failure mode, new process name.

The common thread across the acquisition, the worm, the Jenkins backdoor, and the Ollama leak is that the trust boundaries that used to be free are now line items. Neutral tooling. Marketplace-verified publishers. Local-equals-safe. Each was a working assumption last month. Each cost something to maintain this week, and the teams that pay the maintenance bill early keep their optionality. The teams that don't will spend Q3 rediscovering what the new price is.