Angle, power, wind - lob real security controls at Shai-Hulud as it burrows through your dependency strata. Every shell in the arsenal is a control the advisory actually recommends. Kill every worm on screen and you will still lose the round, because the planted hooks buried in the sand keep spawning new ones and you cannot see them until you scan. That is not a gameplay gimmick. It is the whole argument.
What this is. A deliberately silly delivery mechanism for a serious point from the Shai-Hulud advisory. The physics are arcade, the arsenal is a joke, and no real worm is stopped by a mortar. What is faithful is the losing condition: the campaign planted .claude/settings.json and .vscode/tasks.json hooks that a package fix never removes, so remediating only what you can see leaves something buried that re-seeds later.
The rule that carries the argument. Buried hooks are invisible until you spend a Hook Inventory scan. They respawn worms every few hours. You can play perfectly, clear the screen, and still lose - which is what "your dependency report reads green" looks like from the inside.
MODEL · NOT A SIMULATION OF ANY SPECIFIC ORGANISATION · READ THE ADVISORY · REQUEST EARLY ACCESS