# Infostealer security incidents · pwn.watch

> Security incidents tagged Infostealer (vendor, product, platform or attack type).

Page: https://pwn.watch/t/infostealer · generated 2026-10-22T16:42:00.965Z

## Status (as of 2026-10-22)
- Incidents: 7 (0 live, 0 live and not fully patched, 7 patched)
- Days without a Infostealer security incident: 12
- Newest incident started: 2026-10-05

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/infostealer.json
- RSS (every update): https://pwn.watch/t/infostealer/feed.xml
- This file: https://pwn.watch/t/infostealer/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [SubQuery @subql/common 5.8.3 published with credential stealer + backdoor](https://pwn.watch/i/subql-common-npm-backdoor) ([json](https://pwn.watch/i/subql-common-npm-backdoor.json)): critical, closed, patched, started 2026-10-05, GHSA-9333-3c4x-x3h5, MAL-2026-17571
- [Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS](https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025) ([json](https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025.json)): critical, closed, patched, started 2025-11-24
- [Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike](https://pwn.watch/i/shai-hulud-npm-worm-september-2025) ([json](https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json)): critical, closed, patched, started 2025-09-14
- [s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed](https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025) ([json](https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json)): critical, closed, patched, started 2025-08-26
- [eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)](https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313) ([json](https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313.json)): high, closed, patched, started 2025-07-18, CVE-2025-54313
- [Snowflake customer accounts raided with infostealer credentials (Ticketmaster, AT&T and others)](https://pwn.watch/i/snowflake-customer-data-theft-unc5537) ([json](https://pwn.watch/i/snowflake-customer-data-theft-unc5537.json)): critical, closed, no-fix-needed, started 2024-04-14
- [CircleCI breach: rotate every secret](https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023) ([json](https://pwn.watch/i/circleci-security-incident-rotate-all-secrets-2023.json)): critical, closed, no-fix-needed, started 2023-01-04