Cybersecurity News Everyday
@TweetThreatNews
CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.
// tag
npm
Malicious or hijacked packages on the npm registry. Newest first.
- incidents
- 16
- live
- 2
- patched
- 13
## 9 npm incidents in the last 12 months
crit 4 · high 3 · med 2 · low 1 · upd ½severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½lessmore
- criticalclosedpatchedclosed Oct 22, 2026
Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
› Signal (RingRTC calling library, @signalapp/ringrtc)
A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.
CVE-2026-113380 - criticallivepatchedsince Oct 14, 2026
Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)
› Next.js (next on npm), sharp / librsvg
On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.
CVE-2026-96889 - criticallivepartial fixsince Oct 7, 2026
tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token
› tensorlake (npm)
On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.
GHSA-8g63-53c9-65j2 - criticalclosedpatchedclosed Oct 10, 2026
SubQuery @subql/common 5.8.3 published with credential stealer + backdoor
› @subql/common (npm) and downstream @subql/* packages
On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.
GHSA-9333-3c4x-x3h5MAL-2026-17571
show 12 older incidents12 older incidents
August 2026 1
criticalCHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)partial fix
› npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages) partial fix
In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.
May 2026 3
highTanStack TanStack: TanStack Unspecified Vulnerabilitypatched
› TanStack TanStack patched
TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27.
open incident →CVE-2026-45321criticalMini Shai-Hulud hits AntV / timeago.js npm ecosystempartial fix
› npm @antv/*, timeago.js, related packages under atool partial fix
May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.
highOpenAI employee devices hit via TanStack Mini Shai-Hulud wavepatched
› TanStack-related npm packages / OpenAI employee endpoints patched
In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.
November 2025 1
- criticalclosedpatchedclosed Nov 26, 2025
Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS
› npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)
A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.
September 2025 2
- criticalclosedpatchedclosed Sep 23, 2025
Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike
› npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)
A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.
- criticalclosedpatchedclosed Sep 13, 2025
chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email
› npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 more
Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.
August 2025 1
- criticalclosedpatchedclosed Aug 29, 2025
s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed
› nx and @nx/* npm packages
Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.
July 2025 1
higheslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)patched
› npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, is patched
A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.
open incident →CVE-2025-54313
December 2024 1
high@solana/web3.js npm package backdoored to steal private keyspatched
› @solana/web3.js (npm) patched
A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.
open incident →CVE-2024-54134
October 2024 1
high@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainerpatched
› @lottiefiles/lottie-player (npm) patched
A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.
December 2023 1
- criticalclosedpatchedclosed Dec 14, 2023
Ledger Connect Kit npm package hijacked to drain crypto wallets
› @ledgerhq/connect-kit (npm)
Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.
## posts 8
- › Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
- › Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)
tsn_hub@tsnmediahub📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation. Source: CVE-2026-113380 record
- › Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)
The Hacker News@TheHackersNews‼️ ALERT - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS. RCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889). 🔗 Read - t.co/ndnN46ysGv
- › Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)
ThreatWire@ThreatWire_🚨 CRITICAL: CVE-2026-96889 — Next.js Image Optimization RCE via SVG (librsvg/sharp) Score 9.5 (CVSS 4.0, Next.js advisory). Unauthenticated. Glibc Linux. Affects Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0. Fixed in 15.5.28 and 16.4.1. Check npm ls sharp → 0.35.5+. Not in CISA
- › tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token
Bhavesh Verma@xbhaveshvermaTensorlake npm Package Poisoned by the Shai-Hulud Worm, Credential-Stealing Payload Targeted AI Agent Infrastructure and Carried a “Hostage Token” That Triggers Destruction if Revoked On October 8, 2026, a malicious release of the tensorlake npm package, version 0.5.144, was
- › tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token
sunil kumawat@Sunil_kumawat171/ npm: tensorlake@0.5.144 (Oct 8) shipped a Shai-Hulud-style worm in a preinstall hook. It hunts npm, GitHub and cloud creds plus .claude/.cursor configs. Treat the host as compromised. Socket: remove gh-token-monitor before revoking tokens, or it can wipe your home dir.
+2 more on the incident pages above.
