Nov 26, 2025
0 new incidents, 2 with updates.
Updated
- ClosedPatched
Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS
A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.
npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)Closed Nov 26, 2025
- ClosedMediumNo fix needed
Mixpanel smishing breach exposes OpenAI API users' names and emails
Mixpanel detected a smishing campaign on November 8, 2025 that led to an export of some customers' analytics data. OpenAI said limited API-platform user data was exposed (names, emails, coarse location, browser/OS, org and user IDs), but no chats, prompts, API keys, passwords or payment data. OpenAI removed Mixpanel from production.
Mixpanel (analytics vendor); OpenAI API platform usersClosed Nov 27, 2025
