{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T12:59:41.857Z",
  "stack": {
    "id": "npm",
    "label": "npm",
    "kind": "ecosystem",
    "url": "https://pwn.watch/s/npm",
    "feed": "https://pwn.watch/s/npm/feed.xml"
  },
  "counts": {
    "incidents": 7,
    "live": 2,
    "notFullyPatched": 1,
    "patched": 4
  },
  "incidents": [
    {
      "slug": "signal-ringrtc-cve-2026-113380",
      "title": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380",
      "json": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "Signal (RingRTC calling library, @signalapp/ringrtc)",
      "stacks": [
        "rust",
        "npm"
      ],
      "cveIds": [
        "CVE-2026-113380"
      ],
      "affectedVersions": [
        "RingRTC before 2.72.0 (Signal Android, iOS and Desktop clients embedding it)"
      ],
      "fixedVersions": [
        "RingRTC 2.72.0 (update Signal on every device)"
      ],
      "startedAt": "2026-10-20",
      "closedAt": null,
      "updatedAt": "2026-10-22T14:44:48+02:00",
      "summary": "A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation."
    },
    {
      "slug": "tensorlake-npm-shai-hulud-worm",
      "title": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm",
      "json": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "tensorlake (npm)",
      "stacks": [
        "node",
        "npm"
      ],
      "cveIds": [
        "GHSA-8g63-53c9-65j2"
      ],
      "affectedVersions": [
        "0.5.144"
      ],
      "fixedVersions": [
        "0.5.143 (safe pin); remove 0.5.144"
      ],
      "startedAt": "2026-10-07",
      "closedAt": null,
      "updatedAt": "2026-10-22T14:58:57+02:00",
      "summary": "On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens."
    },
    {
      "slug": "subql-common-npm-backdoor",
      "title": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor",
      "json": "https://pwn.watch/i/subql-common-npm-backdoor.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "@subql/common (npm) and downstream @subql/* packages",
      "stacks": [
        "node",
        "npm"
      ],
      "cveIds": [
        "GHSA-9333-3c4x-x3h5",
        "MAL-2026-17571"
      ],
      "affectedVersions": [
        "@subql/common 5.8.3",
        "@subql/common 5.8.3-onf-rt1 (attacker canary, no payload found; 'redteam' dist-tag still points to it)",
        "Downstream ranges that resolve to 5.8.3, e.g. @subql/cli 6.6.3, @subql/node-core 19.3.1, @subql/query 2.25.0, @subql/node-ethereum 6.5.0"
      ],
      "fixedVersions": [
        "@subql/common 5.8.2 (npm 'latest')"
      ],
      "startedAt": "2026-10-05T11:56:29Z",
      "closedAt": "2026-10-10",
      "updatedAt": "2026-10-22T12:04:00+02:00",
      "summary": "On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges."
    },
    {
      "slug": "shai-hulud-chaindrop-npm-keyv-august",
      "title": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august",
      "json": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages)",
      "stacks": [
        "node",
        "npm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Compromised patch versions published ~Aug 4 2026 (see Wiz/JFrog package lists)"
      ],
      "fixedVersions": [
        "Pin known-good versions; purge caches; npm CLI 12+ disables preinstall by default"
      ],
      "startedAt": "2026-08-04",
      "closedAt": "2026-08-15",
      "updatedAt": "2026-08-15",
      "summary": "In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses."
    },
    {
      "slug": "tanstack-tanstack-cve-2026-45321",
      "title": "TanStack TanStack: TanStack Unspecified Vulnerability",
      "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321",
      "json": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "TanStack TanStack",
      "stacks": [
        "node",
        "npm"
      ],
      "cveIds": [
        "CVE-2026-45321"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-27",
      "closedAt": "2026-05-27",
      "updatedAt": "2026-05-27",
      "summary": "TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27."
    },
    {
      "slug": "shai-hulud-antv-npm-may",
      "title": "Mini Shai-Hulud hits AntV / timeago.js npm ecosystem",
      "url": "https://pwn.watch/i/shai-hulud-antv-npm-may",
      "json": "https://pwn.watch/i/shai-hulud-antv-npm-may.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "partial",
      "product": "npm @antv/*, timeago.js, related packages under atool",
      "stacks": [
        "node",
        "npm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Malicious versions published during May 2026 campaign window"
      ],
      "fixedVersions": [
        "Remove malicious versions; rotate CI/cloud secrets; pin clean releases"
      ],
      "startedAt": "2026-05-19",
      "closedAt": "2026-06-01",
      "updatedAt": "2026-06-01",
      "summary": "May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread."
    },
    {
      "slug": "openai-employee-devices-tanstack-shai-hulud",
      "title": "OpenAI employee devices hit via TanStack Mini Shai-Hulud wave",
      "url": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud",
      "json": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "TanStack-related npm packages / OpenAI employee endpoints",
      "stacks": [
        "node",
        "npm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Compromised TanStack package versions in the May wave"
      ],
      "fixedVersions": [],
      "startedAt": "2026-05-01",
      "closedAt": "2026-05-31",
      "updatedAt": "2026-05-31",
      "summary": "In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted."
    }
  ],
  "changes": [
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-20",
      "title": "CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0.",
      "body": null,
      "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2026-113380",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-10",
      "title": "SubQuery maintainer: compromised token deleted, security review started.",
      "body": null,
      "sourceUrl": "https://github.com/subquery/subql/issues/3047",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08",
      "title": "0.5.144 published via the project’s release workflow.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08+",
      "title": "StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-07",
      "title": "Malicious commits land on tensorlakeai/tensorlake main.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-06",
      "title": "GMO Flatt Security publishes payload analysis and response guidance.",
      "body": null,
      "sourceUrl": "https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T11:56Z",
      "title": "Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier).",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/subql-ecosystem-compromised",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T12:14Z",
      "title": "StepSecurity opens security issue #3047 in subquery/subql.",
      "body": null,
      "sourceUrl": "https://github.com/subquery/subql/issues/3047",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T12:46Z",
      "title": "GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2.",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-9333-3c4x-x3h5",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-09-04",
      "title": "Signal quietly fixes the bug in RingRTC 2.72.0 (commit \"Ensure calls terminate completely in corner cases\"), about six weeks before disclosure.",
      "body": null,
      "sourceUrl": "https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "shai-hulud-chaindrop-npm-keyv-august",
      "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "partial",
      "date": "2026-08-04",
      "title": "keyv/cacheable malicious releases observed; worm begins propagating.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august"
    },
    {
      "incident": "shai-hulud-chaindrop-npm-keyv-august",
      "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "partial",
      "date": "2026-08-04/06",
      "title": "Microsoft, Elastic, JFrog publish analyses; 400+ packages listed.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august"
    },
    {
      "incident": "tanstack-tanstack-cve-2026-45321",
      "incidentTitle": "TanStack TanStack: TanStack Unspecified Vulnerability",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-27",
      "title": "CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321"
    }
  ]
}