Tuesday read after a long weekend that wasn’t long for everyone. Anthropic is reportedly closing a round this week that flips the AI valuation pecking order, a fresh supply-chain attack is live across npm, PyPI, and Crates.io, a Washington county is in the dark, and Jensen Huang is about to walk a Taipei stage with PC RAM prices still up 50%+ year over year. Let’s go.
🪤 TrapDoor lights up npm, PyPI, and Crates.io at the same time
Socket disclosed Sunday that a credential-stealing campaign it’s calling TrapDoor has pushed 34+ malicious packages across 384 versions to npm, PyPI, and Crates.io, with new variants still landing as researchers chase them down. Per Socket and The Hacker News, the campaign started May 22 and is squarely aimed at crypto, DeFi, Solana, Sui, and AI developers — typosquats like crypto-credential-scanner, defi-env-auditor, wallet-security-checker, and Move tooling packages designed to look like the boring utilities your engineers grab without thinking.
Why it matters to your stack: this isn’t a “tell your crypto bro friends” story. If you have any client doing internal Node, Python, or Rust development — fintech, data analytics, internal AI tooling, you name it — your build pipelines are the attack surface. The interesting bit is the cadence: attackers re-published after takedowns, which means a one-time scan isn’t enough. Two action items for the week: turn on package pinning and lockfile enforcement in your client CI/CD, and run a 7-day diff on every dev workstation against the published IOCs. If you sell a managed dev-environment or DevSecOps service, this is a real QBR slide, not theater.
💸 Anthropic is about to eclipse OpenAI on paper at $900B
Bloomberg reported Friday that Anthropic’s next round — $30B+ led by GIC and Coatue — is set to close as soon as this week at a valuation north of $900B, leapfrogging OpenAI’s $852B mark. This is on top of the $30B Series G it just closed in February. The company has now raised more in 90 days than most cloud platforms have raised in their lifetimes.
Why it matters to your channel business: the money isn’t the headline — what they spend it on is. Anthropic has already gone channel-first this year, tightened Claude rate limits (RIP the all-you-can-eat era), and is racing OpenAI on consulting-style services. A $900B paper valuation puts pressure on every line item below it: enterprise pricing, compute commitments, partner program economics, and the “AI services” pitch you’ve been workshopping. Translation: the AI add-on margins you priced last quarter are already stale. If you’re reselling Claude through Bedrock, AWS Marketplace, or a direct partner agreement, lock in your enterprise tiers and prepay credits now, before pricing tiers get re-cut to feed the burn rate. And start segmenting clients into “lock in flat-rate Copilot bundles while you still can” vs. “usage-based, pass-through the volatility.” Hedge accordingly.
🖥️ Computex opens with Jensen, AMD, and RAM prices still cooking
Computex 2026 kicks off in Taipei this week with Jensen Huang headlining and the long-teased Nvidia N1/N1X laptop SoC reveal expected — and arrives against the backdrop of what Tom’s Hardware and the industry have been calling “RAMageddon.” DDR5 kit pricing is still running roughly 2x where it sat last October, and Dell, HP, Lenovo, Acer, and ASUS have been telegraphing 15-30% PC price hikes for months.
Why it matters to your business: every hardware quote you sit on for two weeks costs you margin. If you’re a VAR or solution provider quoting workstation refreshes, AI workstations, or server builds, the math has been moving against you since Q4 — and Computex is going to set the next baseline for the rest of 2026. Three moves: stop quoting hardware with 30-day validity (shrink it to 7-10), get your distis on the phone about allocation commitments for Q3, and bake a clear “memory pricing volatility” clause into every proposal. On the upside, an N1X-class Arm laptop SKU finally landing means a credible Copilot+ PC story for clients who want to refresh off Windows 10 ESU before the second-year fee hits in October. Plan the pitch now; don’t wait for the keynote.
🏛️ Chelan County goes dark over the long weekend
Chelan County, Washington shut down all government computers, networks, and phone lines Monday morning after IT discovered malware on the network at 10 a.m. Sunday. Per MyNorthwest and FOX 13 Seattle, every department is offline as of this writing, with no public attribution or restoration timeline.
Why it matters to your channel business: stop reading this like a state-and-local-only problem. Chelan is roughly 80,000 residents — that’s the population profile of a mid-size school district, a regional hospital network, or a county-government MSP customer that you very likely have on the books. Local government is one of the most-targeted verticals heading into Memorial Day weekend, and the playbook is unchanged: phishing or VPN brute force, then weekend dwell time, then Monday-morning encryption. If you support any public-sector or critical-services client, do two things this week. One: walk the weekend on-call coverage gap with your team — most muni breaches are discovered by IT on a Sunday because nobody was paying attention Friday night. Two: dust off the IR retainer language and the BCDR test runbook with named contacts, and turn this story into a five-minute Tuesday call with your top three at-risk clients. The ones that say “we’re fine” are the ones to worry about.
⚡ Quick hits
🕵️ First VPN, the bulletproof VPN service the FBI says was used by at least 25 ransomware crews, was dismantled last week with a US-Canada-Europe enforcement push and an administrator arrest (Jacob Butler, 23, picked up in Canada). Not a get-out-of-jail card for the underlying victims, but a real seizure of infrastructure — expect short-term displacement, not retirement.
🪟 Microsoft retired Windows 365 Hybrid Benefit pricing on May 1 — if you bundled Windows 365 Business at the discounted W365 + Win Pro Primary User SKU into client plans, the renewal math is now different. Check your CSP price sheets before next quarter’s true-up; don’t get caught explaining the bump to a client mid-call.
🟦 Cisco’s Gold/Premier/Select tiers are officially gone as of January, replaced by the Cisco 360 designations with payout-program changes that kicked in over the spring. If you haven’t reviewed where your shop landed under the new “value index” tiering, your back-end rebates may already be off-plan for the quarter.
That’s it. Patch the dev boxes, lock the AI margins, shrink your quote validity, and call your county clients today. See you Thursday.
