// day
Oct 10, 2026
0 new incidents, 2 with updates.
## updated
- criticalclosedpatchedclosed Oct 10, 2026
SubQuery @subql/common 5.8.3 published with credential stealer + backdoor
› @subql/common (npm) and downstream @subql/* packages
On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.
GHSA-9333-3c4x-x3h5MAL-2026-17571 - criticalliveunpatchedsince Feb 19, 2025
Fearless Wallet browser extension leaked private keys for ~20 months
› Fearless Wallet browser extension (Chrome; Firefox build delisted)
The Polkadot Community Foundation warned that Fearless Wallet browser-extension versions 3.0.1, 3.0.3, 3.0.4 and 3.0.5 contained code, added Feb 19 2025 inside a large 'TON ecosystem' change, that sent private keys/recovery data to an attacker server when the wallet was unlocked. The code was active at different times until Oct 10 2026. Eight users have reported losses totalling 17,286 DOT. Anyone who used the extension since Feb 2025 must create a new keypair in another wallet and move funds.
