{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-22T21:47:37.879Z",
  "tag": {
    "id": "infostealer",
    "label": "Infostealer",
    "isStack": false,
    "url": "https://pwn.watch/t/infostealer",
    "feed": "https://pwn.watch/t/infostealer/feed.xml"
  },
  "counts": {
    "incidents": 7,
    "live": 0,
    "notFullyPatched": 0,
    "patched": 7
  },
  "incidents": [
    {
      "slug": "subql-common-npm-backdoor",
      "title": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor",
      "json": "https://pwn.watch/i/subql-common-npm-backdoor.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "@subql/common (npm) and downstream @subql/* packages",
      "tags": [
        "node",
        "npm",
        "github",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [
        "GHSA-9333-3c4x-x3h5",
        "MAL-2026-17571"
      ],
      "affectedVersions": [
        "@subql/common 5.8.3",
        "@subql/common 5.8.3-onf-rt1 (attacker canary, no payload found; 'redteam' dist-tag still points to it)",
        "Downstream ranges that resolve to 5.8.3, e.g. @subql/cli 6.6.3, @subql/node-core 19.3.1, @subql/query 2.25.0, @subql/node-ethereum 6.5.0"
      ],
      "fixedVersions": [
        "@subql/common 5.8.2 (npm 'latest')"
      ],
      "startedAt": "2026-10-05T11:56:29Z",
      "closedAt": "2026-10-10",
      "updatedAt": "2026-10-22T12:04:00+02:00",
      "summary": "On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-2-npm-worm-november-2025",
      "title": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025",
      "json": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)",
      "tags": [
        "npm",
        "node",
        "shai-hulud",
        "posthog",
        "postman",
        "zapier",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "e.g. posthog-node 4.18.1, 5.13.3, 5.11.3; posthog-js 1.297.3; posthog-react-native 4.11.1; @postman/tunnel-agent 0.6.5-0.6.7 (full lists in sources)"
      ],
      "fixedVersions": [
        "Malicious versions unpublished; use versions published after 2025-11-24 per each vendor"
      ],
      "startedAt": "2025-11-24",
      "closedAt": "2025-11-26",
      "updatedAt": "2025-11-26",
      "summary": "A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-npm-worm-september-2025",
      "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025",
      "json": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)",
      "tags": [
        "npm",
        "node",
        "github-actions",
        "shai-hulud",
        "crowdstrike",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Specific malicious versions of 500+ npm packages (see Socket / CISA lists)"
      ],
      "fixedVersions": [
        "Malicious versions removed from npm; upgrade to versions published after the incident"
      ],
      "startedAt": "2025-09-14",
      "closedAt": "2025-09-23",
      "updatedAt": "2025-09-23",
      "summary": "A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.",
      "xPost": null
    },
    {
      "slug": "nx-s1ngularity-npm-supply-chain-august-2025",
      "title": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025",
      "json": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "product": "nx and @nx/* npm packages",
      "tags": [
        "npm",
        "node",
        "github-actions",
        "ai",
        "nx",
        "s1ngularity",
        "github",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [],
      "affectedVersions": [
        "nx 20.9.0-20.12.0, 21.5.0-21.8.0",
        "@nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0",
        "@nx/eslint 21.5.0",
        "@nx/key, @nx/enterprise-cloud 3.2.0"
      ],
      "fixedVersions": [
        "Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c)"
      ],
      "startedAt": "2025-08-26",
      "closedAt": "2025-08-29",
      "updatedAt": "2025-08-29",
      "summary": "Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.",
      "xPost": null
    },
    {
      "slug": "eslint-config-prettier-npm-phishing-cve-2025-54313",
      "title": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)",
      "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313",
      "json": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "product": "npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, is",
      "tags": [
        "npm",
        "node",
        "eslint",
        "phishing",
        "windows",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [
        "CVE-2025-54313"
      ],
      "affectedVersions": [
        "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7",
        "is 3.3.1, 5.0.0"
      ],
      "fixedVersions": [
        "Malicious versions removed; use other eslint-config-prettier versions (see CVE record)"
      ],
      "startedAt": "2025-07-18",
      "closedAt": "2025-07-22",
      "updatedAt": "2025-07-22",
      "summary": "A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.",
      "xPost": null
    },
    {
      "slug": "snowflake-customer-data-theft-unc5537",
      "title": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537",
      "json": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "Snowflake customer instances",
      "tags": [
        "snowflake",
        "ticketmaster",
        "att",
        "infostealer",
        "data-breach",
        "extortion",
        "mfa"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2024-04-14",
      "closedAt": "2024-07-12",
      "updatedAt": "2024-07-12",
      "summary": "A financially motivated group Mandiant tracks as UNC5537 logged into Snowflake customer accounts using credentials stolen by infostealer malware, some dating back to 2020, on accounts without MFA or network allow lists. It then stole data and extorted the victims. Mandiant and Snowflake notified about 165 potentially exposed organizations. Victims included Ticketmaster/Live Nation and AT&T, which said call and text records of nearly all its cellular customers were taken. Mandiant found no breach of Snowflake's own enterprise environment.",
      "xPost": null
    },
    {
      "slug": "circleci-security-incident-rotate-all-secrets-2023",
      "title": "CircleCI breach: rotate every secret",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023",
      "json": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "no-fix-needed",
      "product": "CircleCI",
      "tags": [
        "devtools",
        "circleci",
        "ci-cd",
        "secrets",
        "infostealer",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [],
      "fixedVersions": [],
      "startedAt": "2023-01-04",
      "closedAt": "2023-01-13",
      "updatedAt": "2023-01-13",
      "summary": "Malware on a CircleCI engineer's laptop stole a 2FA-backed SSO session. The attacker then exfiltrated customer environment variables, tokens and keys along with the encryption keys, so CircleCI told every customer to rotate all secrets stored in the platform.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "GMO Flatt Security Inc.",
      "handle": "flatt_sec_en",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1403333053322121218/K05KKmYR_bigger.jpg",
      "text": "We have published a new blog post covering a recent software supply chain attack on the @subql/common npm package.\n\nIt covers technical details of the compromised package, as well as guidance on response if affected, as well as recommendations for users to protect against supply",
      "date": "2026-10-06T12:09:04.000Z",
      "url": "https://x.com/flatt_sec_en/status/2107443017829519848",
      "media": [],
      "incident": "subql-common-npm-backdoor"
    }
  ],
  "changes": [
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-10",
      "title": "SubQuery maintainer: compromised token deleted, security review started.",
      "body": null,
      "sourceUrl": "https://github.com/subquery/subql/issues/3047",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-06",
      "title": "GMO Flatt Security publishes payload analysis and response guidance.",
      "body": null,
      "sourceUrl": "https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T11:56Z",
      "title": "Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier).",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/subql-ecosystem-compromised",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T12:14Z",
      "title": "StepSecurity opens security issue #3047 in subquery/subql.",
      "body": null,
      "sourceUrl": "https://github.com/subquery/subql/issues/3047",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T12:46Z",
      "title": "GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2.",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-9333-3c4x-x3h5",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "GitHub privatizes malicious repos; public count drops to ~300",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "PostHog publishes its post-mortem",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "First compromised package published (03:10 UTC)",
      "body": null,
      "sourceUrl": "https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Postman unpublishes 17 infected packages (51 versions)",
      "body": null,
      "sourceUrl": "https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Last compromised package seen (~17:00-18:00 UTC)",
      "body": null,
      "sourceUrl": "https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-23",
      "title": "CISA alert: widespread supply chain compromise impacting npm (500+ packages)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-16",
      "title": "Largest burst, nearly 100 packages, including @crowdstrike scope",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-15",
      "title": "Worm discovered; @ctrl/tinycolor and ~40 packages found compromised",
      "body": null,
      "sourceUrl": "https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-14",
      "title": "First compromised versions published (17:58 UTC)",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-28/29",
      "title": "Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-27",
      "title": "GitHub disables attacker-created s1ngularity repositories (09:00 UTC)",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-26",
      "title": "Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-24",
      "title": "Attacker exploits the workflow and exfiltrates the npm token",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-21",
      "title": "A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "eslint-config-prettier-npm-phishing-cve-2025-54313",
      "incidentTitle": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-22",
      "title": "Malicious 'is' package versions found in the same campaign",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack",
      "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313"
    },
    {
      "incident": "eslint-config-prettier-npm-phishing-cve-2025-54313",
      "incidentTitle": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-18",
      "title": "Malicious eslint-config-prettier versions published after maintainer phishing",
      "body": null,
      "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2025-54313",
      "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-07-12",
      "title": "AT&T says call and text records of nearly all cellular customers were stolen from its Snowflake workspace",
      "body": null,
      "sourceUrl": "https://arstechnica.com/tech-policy/2024/07/nearly-all-att-subscribers-call-records-stolen-in-snowflake-cloud-hack/",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-06-10",
      "title": "Mandiant publishes its UNC5537 report: about 165 organizations notified",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-31",
      "title": "Live Nation 8-K confirms the Ticketmaster data theft; the database was hosted on Snowflake",
      "body": null,
      "sourceUrl": "https://techcrunch.com/2024/05/31/live-nation-confirms-ticketmaster-was-hacked-says-personal-information-stolen-in-data-breach/",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-30",
      "title": "Snowflake publishes detection and hardening guidance",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-22",
      "title": "Mandiant alerts Snowflake to a broader campaign and starts notifying victims",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-05-20",
      "title": "Live Nation identifies unauthorized activity in a third-party cloud database",
      "body": null,
      "sourceUrl": "https://investors.livenationentertainment.com/sec-filings/all-sec-filings/content/0001335258-24-000081/0001335258-24-000081.pdf",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "snowflake-customer-data-theft-unc5537",
      "incidentTitle": "Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2024-04-14",
      "title": "Earliest attacker DBeaver login shown in Mandiant's sample logs; AT&T later said its data was downloaded in April",
      "body": null,
      "sourceUrl": "https://cloud.google.com/blog/topics/threat-intelligence/unc5537-snowflake-data-theft-extortion",
      "url": "https://pwn.watch/i/snowflake-customer-data-theft-unc5537"
    },
    {
      "incident": "circleci-security-incident-rotate-all-secrets-2023",
      "incidentTitle": "CircleCI breach: rotate every secret",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-01-13",
      "title": "Incident report: malware stole an engineer's SSO session in December 2022; customer data and encryption keys were exfiltrated",
      "body": null,
      "sourceUrl": "https://circleci.com/blog/jan-4-2023-incident-report/",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023"
    },
    {
      "incident": "circleci-security-incident-rotate-all-secrets-2023",
      "incidentTitle": "CircleCI breach: rotate every secret",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "no-fix-needed",
      "date": "2023-01-04",
      "title": "CircleCI tells all customers to rotate every secret stored in CircleCI",
      "body": null,
      "sourceUrl": "https://circleci.com/blog/january-4-2023-security-alert/",
      "url": "https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023"
    }
  ]
}