{
  "site": "https://pwn.watch",
  "generatedAt": "2026-10-23T18:42:33.457Z",
  "tag": {
    "id": "npm",
    "label": "npm",
    "isStack": true,
    "url": "https://pwn.watch/t/npm",
    "feed": "https://pwn.watch/t/npm/feed.xml"
  },
  "counts": {
    "incidents": 18,
    "live": 3,
    "notFullyPatched": 1,
    "patched": 15
  },
  "incidents": [
    {
      "slug": "x402-sdk-critical-flaws-v12",
      "title": "x402 SDK flaws could let malicious APIs drain AI agents' token balances",
      "url": "https://pwn.watch/i/x402-sdk-critical-flaws-v12",
      "json": "https://pwn.watch/i/x402-sdk-critical-flaws-v12.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "patch",
      "product": "x402 SDKs (TypeScript @x402/*, Python x402, Go)",
      "tags": [
        "node",
        "npm",
        "python",
        "pypi",
        "go",
        "ai",
        "x402",
        "coinbase",
        "solana",
        "crypto",
        "ai-agents",
        "payment-bypass"
      ],
      "cveIds": [],
      "affectedVersions": [
        "@x402/svm 2.0.0 to 2.22.0 (Solana approval accepted as payment)",
        "@x402/fetch and @x402/axios before 2.23.0 (no default spending limit)",
        "@x402/extensions before 2.23.0 (SIWx signs logins for other sites)",
        "Python and Go clients before the August 18, 2026 releases (no spending limit, SIWx check)"
      ],
      "fixedVersions": [
        "@x402/fetch, @x402/axios, @x402/extensions, @x402/svm 2.23.0+ (latest 2.28.0)",
        "x402 (PyPI) 2.25.0 (latest)",
        "Go module v2.28.0 (latest)"
      ],
      "startedAt": "2026-10-22",
      "closedAt": null,
      "updatedAt": "2026-10-23T18:41:32Z",
      "summary": "V12 disclosed 25 flaws in the x402 agent-payment SDKs, three rated critical: the default client had no spending limit (a hostile API could ask for an agent's whole token balance), the TypeScript Solana facilitator accepted token approvals as payments, and the SIWx login helper signed messages for other websites. All three were fixed in the August 18 releases, but no advisory was published, so npm audit and PyPI don't warn. Update @x402/fetch, @x402/axios, @x402/extensions and @x402/svm to 2.23.0 or later.",
      "xPost": {
        "id": "2113569368441590053",
        "postedAt": "2026-10-23T09:53:00.580Z",
        "url": "https://x.com/pwnwatch_app/status/2113569368441590053"
      }
    },
    {
      "slug": "storybook-dev-server-cve-2026-114125",
      "title": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125",
      "json": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "category": "patch",
      "product": "Storybook (dev server)",
      "tags": [
        "node",
        "npm",
        "devtools",
        "storybook",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-114125"
      ],
      "affectedVersions": [
        "storybook / @storybook/core / @storybook/core-server >= 8.0.0 < 8.6.19",
        "storybook >= 9.0.0 < 9.1.21",
        "storybook >= 10.0.0 < 10.6.2",
        "storybook >= 11.0.0-alpha.0 < 11.0.0-alpha.6",
        "@storybook/addon-vitest and @storybook/addon-mcp (matching ranges)"
      ],
      "fixedVersions": [
        "8.6.19",
        "9.1.21",
        "10.6.2",
        "11.0.0-alpha.6"
      ],
      "startedAt": "2026-10-21",
      "closedAt": "2026-10-22",
      "updatedAt": "2026-10-22T12:43:45.000Z",
      "summary": "Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.",
      "xPost": null
    },
    {
      "slug": "signal-ringrtc-cve-2026-113380",
      "title": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380",
      "json": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "patch",
      "product": "Signal (RingRTC calling library, @signalapp/ringrtc)",
      "tags": [
        "rust",
        "npm",
        "ios",
        "android",
        "signal"
      ],
      "cveIds": [
        "CVE-2026-113380"
      ],
      "affectedVersions": [
        "RingRTC before 2.72.0 (Signal Android, iOS and Desktop clients embedding it)"
      ],
      "fixedVersions": [
        "RingRTC 2.72.0 (update Signal on every device)"
      ],
      "startedAt": "2026-10-20",
      "closedAt": "2026-10-22T18:00:43+02:00",
      "updatedAt": "2026-10-22T18:00:43+02:00",
      "summary": "A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.",
      "xPost": null
    },
    {
      "slug": "nextjs-october-2026-rce-security-release",
      "title": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release",
      "json": "https://pwn.watch/i/nextjs-october-2026-rce-security-release.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "patch",
      "product": "Next.js (next on npm), sharp / librsvg",
      "tags": [
        "node",
        "npm",
        "nextjs",
        "vercel",
        "sharp",
        "rce"
      ],
      "cveIds": [
        "CVE-2026-96889"
      ],
      "affectedVersions": [
        "next >= 10.0.0, <= 15.5.27 (Image Optimization SVG RCE, CVE-2026-96889)",
        "next >= 16.0.0, <= 16.4.0",
        "sharp < 0.35.5 (bundles vulnerable librsvg)"
      ],
      "fixedVersions": [
        "next 15.5.28",
        "next 16.4.1",
        "sharp 0.35.5 (librsvg 2.63.2)"
      ],
      "startedAt": "2026-10-14",
      "closedAt": null,
      "updatedAt": "2026-10-23T18:41:32Z",
      "summary": "On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.",
      "xPost": null
    },
    {
      "slug": "tensorlake-npm-shai-hulud-worm",
      "title": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm",
      "json": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm.json",
      "status": "live",
      "severity": "critical",
      "patchStatus": "partial",
      "category": "supply-chain",
      "product": "tensorlake (npm)",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [
        "GHSA-8g63-53c9-65j2"
      ],
      "affectedVersions": [
        "0.5.144"
      ],
      "fixedVersions": [
        "0.5.143 (safe pin); remove 0.5.144"
      ],
      "startedAt": "2026-10-07",
      "closedAt": null,
      "updatedAt": "2026-10-23T18:41:32Z",
      "summary": "On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.",
      "xPost": null
    },
    {
      "slug": "subql-common-npm-backdoor",
      "title": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor",
      "json": "https://pwn.watch/i/subql-common-npm-backdoor.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "@subql/common (npm) and downstream @subql/* packages",
      "tags": [
        "node",
        "npm",
        "github",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [
        "GHSA-9333-3c4x-x3h5",
        "MAL-2026-17571"
      ],
      "affectedVersions": [
        "@subql/common 5.8.3",
        "@subql/common 5.8.3-onf-rt1 (attacker canary, no payload found; 'redteam' dist-tag still points to it)",
        "Downstream ranges that resolve to 5.8.3, e.g. @subql/cli 6.6.3, @subql/node-core 19.3.1, @subql/query 2.25.0, @subql/node-ethereum 6.5.0"
      ],
      "fixedVersions": [
        "@subql/common 5.8.2 (npm 'latest')"
      ],
      "startedAt": "2026-10-05T11:56:29Z",
      "closedAt": "2026-10-10",
      "updatedAt": "2026-10-22T12:04:00+02:00",
      "summary": "On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-chaindrop-npm-keyv-august",
      "title": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august",
      "json": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "partial",
      "category": "supply-chain",
      "product": "npm ecosystem (keyv, cacheable, flat-cache, cache-manager, and 400+ packages)",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Compromised patch versions published ~Aug 4 2026 (see Wiz/JFrog package lists)"
      ],
      "fixedVersions": [
        "Pin known-good versions; purge caches; npm CLI 12+ disables preinstall by default"
      ],
      "startedAt": "2026-08-04",
      "closedAt": "2026-08-15",
      "updatedAt": "2026-08-15",
      "summary": "In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.",
      "xPost": null
    },
    {
      "slug": "tanstack-tanstack-cve-2026-45321",
      "title": "TanStack TanStack: TanStack Unspecified Vulnerability",
      "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321",
      "json": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "category": "patch",
      "product": "TanStack TanStack",
      "tags": [
        "node",
        "npm",
        "tanstack",
        "ransomware",
        "cisa-kev"
      ],
      "cveIds": [
        "CVE-2026-45321"
      ],
      "affectedVersions": [
        "See vendor advisory / CISA notes (versions not always listed in KEV feed)"
      ],
      "fixedVersions": [
        "See vendor advisory linked in sources"
      ],
      "startedAt": "2026-05-27",
      "closedAt": "2026-05-27",
      "updatedAt": "2026-05-27",
      "summary": "TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-antv-npm-may",
      "title": "Mini Shai-Hulud hits AntV / timeago.js npm ecosystem",
      "url": "https://pwn.watch/i/shai-hulud-antv-npm-may",
      "json": "https://pwn.watch/i/shai-hulud-antv-npm-may.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "partial",
      "category": "supply-chain",
      "product": "npm @antv/*, timeago.js, related packages under atool",
      "tags": [
        "node",
        "npm",
        "github",
        "shai-hulud",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Malicious versions published during May 2026 campaign window"
      ],
      "fixedVersions": [
        "Remove malicious versions; rotate CI/cloud secrets; pin clean releases"
      ],
      "startedAt": "2026-05-19",
      "closedAt": "2026-06-01",
      "updatedAt": "2026-06-01",
      "summary": "May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.",
      "xPost": null
    },
    {
      "slug": "openai-employee-devices-tanstack-shai-hulud",
      "title": "OpenAI employee devices hit via TanStack Mini Shai-Hulud wave",
      "url": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud",
      "json": "https://pwn.watch/i/openai-employee-devices-tanstack-shai-hulud.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "TanStack-related npm packages / OpenAI employee endpoints",
      "tags": [
        "node",
        "npm",
        "openai",
        "tanstack",
        "shai-hulud",
        "supply-chain",
        "data-breach"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Compromised TanStack package versions in the May wave"
      ],
      "fixedVersions": [],
      "startedAt": "2026-05-01",
      "closedAt": "2026-05-31",
      "updatedAt": "2026-05-31",
      "summary": "In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-2-npm-worm-november-2025",
      "title": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025",
      "json": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "npm packages (posthog-js, posthog-node, @postman/*, Zapier, ENS Domains, AsyncAPI and others)",
      "tags": [
        "npm",
        "node",
        "shai-hulud",
        "posthog",
        "postman",
        "zapier",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "e.g. posthog-node 4.18.1, 5.13.3, 5.11.3; posthog-js 1.297.3; posthog-react-native 4.11.1; @postman/tunnel-agent 0.6.5-0.6.7 (full lists in sources)"
      ],
      "fixedVersions": [
        "Malicious versions unpublished; use versions published after 2025-11-24 per each vendor"
      ],
      "startedAt": "2025-11-24",
      "closedAt": "2025-11-26",
      "updatedAt": "2025-11-26",
      "summary": "A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.",
      "xPost": null
    },
    {
      "slug": "shai-hulud-npm-worm-september-2025",
      "title": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025",
      "json": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "npm packages (@ctrl/tinycolor, @crowdstrike/*, 500+ others)",
      "tags": [
        "npm",
        "node",
        "github-actions",
        "shai-hulud",
        "crowdstrike",
        "github",
        "supply-chain",
        "infostealer",
        "worm"
      ],
      "cveIds": [],
      "affectedVersions": [
        "Specific malicious versions of 500+ npm packages (see Socket / CISA lists)"
      ],
      "fixedVersions": [
        "Malicious versions removed from npm; upgrade to versions published after the incident"
      ],
      "startedAt": "2025-09-14",
      "closedAt": "2025-09-23",
      "updatedAt": "2025-09-23",
      "summary": "A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.",
      "xPost": null
    },
    {
      "slug": "chalk-debug-npm-hijack-september-2025",
      "title": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025",
      "json": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "npm: chalk, debug, ansi-styles, strip-ansi, supports-color and 13 more",
      "tags": [
        "npm",
        "node",
        "chalk",
        "phishing",
        "supply-chain",
        "crypto"
      ],
      "cveIds": [],
      "affectedVersions": [
        "chalk 5.6.1",
        "debug 4.4.2",
        "ansi-styles 6.2.2",
        "strip-ansi 7.1.1",
        "supports-color 10.2.1",
        "ansi-regex 6.2.1",
        "wrap-ansi 9.0.1",
        "slice-ansi 7.1.1",
        "has-ansi 6.0.1",
        "chalk-template 1.1.1",
        "supports-hyperlinks 4.1.1",
        "others: see debug-js/debug#1005"
      ],
      "fixedVersions": [
        "chalk 5.6.2",
        "ansi-styles 6.2.3",
        "strip-ansi 7.1.2",
        "supports-color 10.2.2",
        "ansi-regex 6.2.2",
        "wrap-ansi 9.0.2",
        "slice-ansi 7.1.2",
        "has-ansi 6.0.2",
        "chalk-template 1.1.2",
        "supports-hyperlinks 4.1.2",
        "debug and others: republished by the maintainer on 2025-09-13"
      ],
      "startedAt": "2025-09-08",
      "closedAt": "2025-09-13",
      "updatedAt": "2025-09-15",
      "summary": "Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.",
      "xPost": null
    },
    {
      "slug": "nx-s1ngularity-npm-supply-chain-august-2025",
      "title": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025",
      "json": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "nx and @nx/* npm packages",
      "tags": [
        "npm",
        "node",
        "github-actions",
        "ai",
        "nx",
        "s1ngularity",
        "github",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [],
      "affectedVersions": [
        "nx 20.9.0-20.12.0, 21.5.0-21.8.0",
        "@nx/devkit, @nx/js, @nx/workspace, @nx/node 20.9.0 / 21.5.0",
        "@nx/eslint 21.5.0",
        "@nx/key, @nx/enterprise-cloud 3.2.0"
      ],
      "fixedVersions": [
        "Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c)"
      ],
      "startedAt": "2025-08-26",
      "closedAt": "2025-08-29",
      "updatedAt": "2025-08-29",
      "summary": "Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.",
      "xPost": null
    },
    {
      "slug": "eslint-config-prettier-npm-phishing-cve-2025-54313",
      "title": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)",
      "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313",
      "json": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "npm: eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall, is",
      "tags": [
        "npm",
        "node",
        "eslint",
        "phishing",
        "windows",
        "supply-chain",
        "infostealer"
      ],
      "cveIds": [
        "CVE-2025-54313"
      ],
      "affectedVersions": [
        "eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, 10.1.7",
        "is 3.3.1, 5.0.0"
      ],
      "fixedVersions": [
        "Malicious versions removed; use other eslint-config-prettier versions (see CVE record)"
      ],
      "startedAt": "2025-07-18",
      "closedAt": "2025-07-22",
      "updatedAt": "2025-07-22",
      "summary": "A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.",
      "xPost": null
    },
    {
      "slug": "solana-web3-js-npm-compromise-cve-2024-54134",
      "title": "@solana/web3.js npm package backdoored to steal private keys",
      "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134",
      "json": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "@solana/web3.js (npm)",
      "tags": [
        "node",
        "npm",
        "solana",
        "crypto",
        "supply-chain"
      ],
      "cveIds": [
        "CVE-2024-54134"
      ],
      "affectedVersions": [
        "1.95.6",
        "1.95.7"
      ],
      "fixedVersions": [
        "1.95.8"
      ],
      "startedAt": "2024-12-03",
      "closedAt": "2024-12-04",
      "updatedAt": "2024-12-04",
      "summary": "A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.",
      "xPost": null
    },
    {
      "slug": "lottiefiles-lottie-player-npm-compromise",
      "title": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer",
      "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise",
      "json": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise.json",
      "status": "closed",
      "severity": "high",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "@lottiefiles/lottie-player (npm)",
      "tags": [
        "node",
        "npm",
        "lottiefiles",
        "crypto",
        "supply-chain"
      ],
      "cveIds": [],
      "affectedVersions": [
        "2.0.5",
        "2.0.6",
        "2.0.7"
      ],
      "fixedVersions": [
        "2.0.8"
      ],
      "startedAt": "2024-10-30",
      "closedAt": "2024-10-31",
      "updatedAt": "2024-10-31",
      "summary": "A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.",
      "xPost": null
    },
    {
      "slug": "ledger-connect-kit-npm-supply-chain-2023",
      "title": "Ledger Connect Kit npm package hijacked to drain crypto wallets",
      "url": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023",
      "json": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023.json",
      "status": "closed",
      "severity": "critical",
      "patchStatus": "patched",
      "category": "supply-chain",
      "product": "@ledgerhq/connect-kit (npm)",
      "tags": [
        "npm",
        "node",
        "ledger",
        "supply-chain",
        "crypto",
        "wallet-drainer",
        "phishing"
      ],
      "cveIds": [],
      "affectedVersions": [
        "@ledgerhq/connect-kit 1.1.5, 1.1.6, 1.1.7"
      ],
      "fixedVersions": [
        "1.1.8"
      ],
      "startedAt": "2023-12-14",
      "closedAt": "2023-12-14",
      "updatedAt": "2023-12-14",
      "summary": "Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.",
      "xPost": null
    }
  ],
  "posts": [
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "🚨 A malicious API could drain an AI agent's token balance via an x402 SDK flaw.\n\nV12 rated 3 bugs critical:\n— No default spending cap\n— Solana approvals passed as payments\n— Logins signed for other sites\n\nAll patched. No advisory, so npm audit &amp; PyPI miss them.\n\nRead more ↓ https://t.co/b455EukyKw",
      "date": "2026-10-23T08:39:34.000Z",
      "url": "https://x.com/TheHackersNews/status/2113550887901675675",
      "media": [],
      "incident": "x402-sdk-critical-flaws-v12"
    },
    {
      "authorName": "V12",
      "handle": "v12sec",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2081104436383076352/iuNwv_W3_bigger.jpg",
      "text": "V12 found 25 vulnerabilities in the x402 protocol.\n\nCritical findings included: \n- Requests approved without any payment \n- Maliciously high requests being paid by default \n- Session takeover from relayed login signatures\n\nHere's how. 🧵 https://t.co/0jIv7VpET7",
      "date": "2026-10-22T17:00:37.000Z",
      "url": "https://x.com/v12sec/status/2113314594924163141",
      "media": [],
      "incident": "x402-sdk-critical-flaws-v12"
    },
    {
      "authorName": "YorkDev",
      "handle": "YoDevp",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2108041001340112897/pVqNB6Ej_bigger.jpg",
      "text": "🚨 Si usas Storybook, actualiza antes de volver a correr el dev server: publicaron una vulnerabilidad crítica (CVSS v4 9.4), CVE-2026-114125.\n\nAfecta a Storybook 8, 9, 10 y 11 alpha.\nCorregidas: 8.6.19, 9.1.21, 10.6.2 y 11.0.0-alpha.6.\n\nQué puede hacer un atacante 👇 https://t.co/fPN9ReSVRH",
      "date": "2026-10-22T12:43:45.000Z",
      "url": "https://x.com/YoDevp/status/2113249953879593338",
      "media": [],
      "incident": "storybook-dev-server-cve-2026-114125"
    },
    {
      "authorName": "Tim Notes",
      "handle": "timwork_notes",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2107197400041340928/TMXhl773_bigger.jpg",
      "text": "localhost isn't a security boundary, it's a port any tab can knock on... storybook dev servers v8 through 11 alpha, new mcp addon included, let a malicious website change files in your project while running. critical, GHSA-f2ph-cmg5-wxc8. upgrade before the next run",
      "date": "2026-10-22T09:30:20.000Z",
      "url": "https://x.com/timwork_notes/status/2113201277933109352",
      "media": [],
      "incident": "storybook-dev-server-cve-2026-114125"
    },
    {
      "authorName": "Cybersecurity News Everyday",
      "handle": "TweetThreatNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2043130207125848064/YaxtN2hq_bigger.jpg",
      "text": "CVE-2026-113380 affects RingRTC versions before 2.72.0 and could let a call participant keep hearing audio after hang-up. No in-the-wild exploitation is known; users are advised to update Signal.",
      "date": "2026-10-21T22:48:16.000Z",
      "url": "https://x.com/TweetThreatNews/status/2113039694753636745",
      "media": [],
      "incident": "signal-ringrtc-cve-2026-113380"
    },
    {
      "authorName": "tsn_hub",
      "handle": "tsnmediahub",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1892172141111496704/d_EnIiZO_bigger.jpg",
      "text": "📵 Update Signal. A critical flaw in its RingRTC calling library could stop a call ending when you hang up, leaving audio and perhaps video running, per its CVE record. RingRTC 2.72.0 fixes it. There's no report of exploitation.\n\nSource: CVE-2026-113380 record",
      "date": "2026-10-21T18:52:01.000Z",
      "url": "https://x.com/tsnmediahub/status/2112980243162026149",
      "media": [],
      "incident": "signal-ringrtc-cve-2026-113380"
    },
    {
      "authorName": "The Hacker News",
      "handle": "TheHackersNews",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1597647879811657728/FLgHrLHy_bigger.jpg",
      "text": "‼️ ALERT  - Next.js just shipped an out-of-band security update for TWO critical unauthenticated RCE flaws (both CVSS 9.5) + a high-severity DoS.\n\nRCEs: RSC use cache (GHSA-673q-mjm6-r5xr) and librsvg via sharp (CVE-2026-96889).\n\n🔗 Read - https://t.co/ndnN46ysGv",
      "date": "2026-10-15T12:35:50.000Z",
      "url": "https://x.com/TheHackersNews/status/2110711243942330566",
      "media": [],
      "incident": "nextjs-october-2026-rce-security-release"
    },
    {
      "authorName": "ThreatWire",
      "handle": "ThreatWire_",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2074748840775688192/LvaBIlOK_bigger.jpg",
      "text": "🚨 CRITICAL: CVE-2026-96889 — Next.js Image Optimization RCE via SVG (librsvg/sharp)\n\nScore 9.5 (CVSS 4.0, Next.js advisory). Unauthenticated. Glibc Linux.\nAffects Next.js 10.0.0–15.5.27 and 16.0.0–16.4.0.\nFixed in 15.5.28 and 16.4.1. Check npm ls sharp → 0.35.5+.\nNot in CISA",
      "date": "2026-10-15T05:37:11.000Z",
      "url": "https://x.com/ThreatWire_/status/2110605887907713139",
      "media": [],
      "incident": "nextjs-october-2026-rce-security-release"
    },
    {
      "authorName": "Bhavesh Verma",
      "handle": "xbhaveshverma",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2102764953153474560/GdTC_kqB_bigger.jpg",
      "text": "Tensorlake npm Package Poisoned by the Shai-Hulud Worm, Credential-Stealing Payload Targeted AI Agent Infrastructure and Carried a “Hostage Token” That Triggers Destruction if Revoked\n \nOn October 8, 2026, a malicious release of the tensorlake npm package, version 0.5.144, was",
      "date": "2026-10-14T07:30:00.000Z",
      "url": "https://x.com/xbhaveshverma/status/2110271890346623049",
      "media": [],
      "incident": "tensorlake-npm-shai-hulud-worm"
    },
    {
      "authorName": "sunil kumawat",
      "handle": "Sunil_kumawat17",
      "avatarUrl": "https://pbs.twimg.com/profile_images/2098057965584732161/FSLSFQ4M_bigger.jpg",
      "text": "1/ npm: tensorlake@0.5.144 (Oct 8) shipped a Shai-Hulud-style worm in a preinstall hook. It hunts npm, GitHub and cloud creds plus .claude/.cursor configs.\n\nTreat the host as compromised. Socket: remove gh-token-monitor before revoking tokens, or it can wipe your home dir.",
      "date": "2026-10-12T03:42:11.000Z",
      "url": "https://x.com/Sunil_kumawat17/status/2109489785181991309",
      "media": [],
      "incident": "tensorlake-npm-shai-hulud-worm"
    },
    {
      "authorName": "Techzine",
      "handle": "techzine",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1240303566201511936/gHRGR8Fs_bigger.png",
      "text": "The Shai-Hulud worm infected the npm SDK of the AI platform Tensorlake. The malware steals credentials and can wipe home directories when tokens are revoked. dlvr.​it/TVrLFR #Security #npm #ShaiHulud #Socket #Tensorlake - Follow for more https://t.co/mLg7PlLPhr",
      "date": "2026-10-09T07:37:16.000Z",
      "url": "https://x.com/techzine/status/2108461779328332283",
      "media": [
        {
          "type": "image",
          "url": "https://pbs.twimg.com/media/HULCz6Ga8AE7wrg.jpg"
        }
      ],
      "incident": "tensorlake-npm-shai-hulud-worm"
    },
    {
      "authorName": "GMO Flatt Security Inc.",
      "handle": "flatt_sec_en",
      "avatarUrl": "https://pbs.twimg.com/profile_images/1403333053322121218/K05KKmYR_bigger.jpg",
      "text": "We have published a new blog post covering a recent software supply chain attack on the @subql/common npm package.\n\nIt covers technical details of the compromised package, as well as guidance on response if affected, as well as recommendations for users to protect against supply",
      "date": "2026-10-06T12:09:04.000Z",
      "url": "https://x.com/flatt_sec_en/status/2107443017829519848",
      "media": [],
      "incident": "subql-common-npm-backdoor"
    }
  ],
  "changes": [
    {
      "incident": "x402-sdk-critical-flaws-v12",
      "incidentTitle": "x402 SDK flaws could let malicious APIs drain AI agents' token balances",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-23",
      "title": "The Hacker News found the foundation published no security advisory for the three flaws, so npm audit and PyPI report nothing for the last vulnerable releases. Patched clients now cap each payment at $1 and allow only recognized USD stablecoins unless the app sets its own spend controls.",
      "body": null,
      "sourceUrl": "https://thehackernews.com/2026/10/critical-x402-sdk-flaw-could-let.html",
      "url": "https://pwn.watch/i/x402-sdk-critical-flaws-v12"
    },
    {
      "incident": "x402-sdk-critical-flaws-v12",
      "incidentTitle": "x402 SDK flaws could let malicious APIs drain AI agents' token balances",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "V12 published 25 x402 findings with three critical ones detailed: no default spend limit, Solana ApproveChecked accepted as TransferChecked in the TypeScript facilitator (a complete payment bypass in local tests), and SIWx signing relayed login messages for other domains. The x402 Foundation had fixed all three in the August 18 releases.",
      "body": null,
      "sourceUrl": "https://v12.sh/blog/x402",
      "url": "https://pwn.watch/i/x402-sdk-critical-flaws-v12"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "category": "patch",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile.",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "category": "patch",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis.",
      "body": null,
      "sourceUrl": "https://www.helpnetsecurity.com/2026/10/22/signal-ringrtc-vulnerability-cve-2026-113380/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "category": "patch",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "category": "patch",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device.",
      "body": null,
      "sourceUrl": "https://www.securityweek.com/signal-vulnerability-lets-malicious-callers-block-hang-ups/",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "nextjs-october-2026-rce-security-release",
      "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-22",
      "title": "GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions.",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-2464-fhr4-w9xw",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "category": "patch",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again.",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "category": "patch",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-21",
      "title": "Researcher Imahian's write-up and conceptual PoC circulate; press coverage begins.",
      "body": null,
      "sourceUrl": "https://www.theregister.com/security/2026/10/21/signal-bug-could-keep-your-mic-and-camera-on-after-hangup/5304528",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "category": "patch",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-20",
      "title": "CVE-2026-113380 published by MITRE (CVSS 4.0 9.3); fix is RingRTC 2.72.0.",
      "body": null,
      "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2026-113380",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "nextjs-october-2026-rce-security-release",
      "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-14",
      "title": "Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features.",
      "body": null,
      "sourceUrl": "https://nextjs.org/blog/nextjs-security-update-october-14-2026",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release"
    },
    {
      "incident": "nextjs-october-2026-rce-security-release",
      "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-10-14",
      "title": "Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution.",
      "body": null,
      "sourceUrl": "https://www.netlify.com/changelog/2026-10-14-nextjs-react-security-vulnerabilities/",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "category": "patch",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-12",
      "title": "Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour).",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/releases/tag/v10.6.2",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-10",
      "title": "SubQuery maintainer: compromised token deleted, security review started.",
      "body": null,
      "sourceUrl": "https://github.com/subquery/subql/issues/3047",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "category": "supply-chain",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08",
      "title": "0.5.144 published via the project’s release workflow.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "category": "supply-chain",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-08+",
      "title": "StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "tensorlake-npm-shai-hulud-worm",
      "incidentTitle": "tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token",
      "category": "supply-chain",
      "severity": "critical",
      "status": "live",
      "patchStatus": "partial",
      "date": "2026-10-07",
      "title": "Malicious commits land on tensorlakeai/tensorlake main.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tensorlake-npm-shai-hulud-worm"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-06",
      "title": "GMO Flatt Security publishes payload analysis and response guidance.",
      "body": null,
      "sourceUrl": "https://flatt.tech/research/posts/subql-common-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T11:56Z",
      "title": "Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier).",
      "body": null,
      "sourceUrl": "https://www.stepsecurity.io/blog/subql-ecosystem-compromised",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T12:14Z",
      "title": "StepSecurity opens security issue #3047 in subquery/subql.",
      "body": null,
      "sourceUrl": "https://github.com/subquery/subql/issues/3047",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "subql-common-npm-backdoor",
      "incidentTitle": "SubQuery @subql/common 5.8.3 published with credential stealer + backdoor",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-10-05T12:46Z",
      "title": "GitHub publishes malware advisory GHSA-9333-3c4x-x3h5; version removed from npm (~50 minutes live); 'latest' back to 5.8.2.",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-9333-3c4x-x3h5",
      "url": "https://pwn.watch/i/subql-common-npm-backdoor"
    },
    {
      "incident": "storybook-dev-server-cve-2026-114125",
      "incidentTitle": "Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)",
      "category": "patch",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-30",
      "title": "Storybook receives a responsible disclosure showing a malicious website can embed a dev server's preview iframe and send events to the dev server.",
      "body": null,
      "sourceUrl": "https://github.com/storybookjs/storybook/security/advisories/GHSA-f2ph-cmg5-wxc8",
      "url": "https://pwn.watch/i/storybook-dev-server-cve-2026-114125"
    },
    {
      "incident": "nextjs-october-2026-rce-security-release",
      "incidentTitle": "Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)",
      "category": "patch",
      "severity": "critical",
      "status": "live",
      "patchStatus": "patched",
      "date": "2026-09-27",
      "title": "sharp 0.35.5 ships with librsvg 2.63.2; sharp's advisory GHSA-wq5f-xc86-pv6w later covers CVE-2026-96889 (use-after-free in librsvg).",
      "body": null,
      "sourceUrl": "https://github.com/advisories/GHSA-wq5f-xc86-pv6w",
      "url": "https://pwn.watch/i/nextjs-october-2026-rce-security-release"
    },
    {
      "incident": "signal-ringrtc-cve-2026-113380",
      "incidentTitle": "Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)",
      "category": "patch",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-09-04",
      "title": "Signal quietly fixes the bug in RingRTC 2.72.0 (commit \"Ensure calls terminate completely in corner cases\"), about six weeks before disclosure.",
      "body": null,
      "sourceUrl": "https://github.com/signalapp/ringrtc/commit/4b1b6fa53c9f30c87c8ea78e44675d4a13e1e4d3",
      "url": "https://pwn.watch/i/signal-ringrtc-cve-2026-113380"
    },
    {
      "incident": "shai-hulud-chaindrop-npm-keyv-august",
      "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "partial",
      "date": "2026-08-04",
      "title": "keyv/cacheable malicious releases observed; worm begins propagating.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august"
    },
    {
      "incident": "shai-hulud-chaindrop-npm-keyv-august",
      "incidentTitle": "CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "partial",
      "date": "2026-08-04/06",
      "title": "Microsoft, Elastic, JFrog publish analyses; 400+ packages listed.",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/shai-hulud-chaindrop-npm-keyv-august"
    },
    {
      "incident": "tanstack-tanstack-cve-2026-45321",
      "incidentTitle": "TanStack TanStack: TanStack Unspecified Vulnerability",
      "category": "patch",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2026-05-27",
      "title": "CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10).",
      "body": null,
      "sourceUrl": null,
      "url": "https://pwn.watch/i/tanstack-tanstack-cve-2026-45321"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "GitHub privatizes malicious repos; public count drops to ~300",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-26",
      "title": "PostHog publishes its post-mortem",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "First compromised package published (03:10 UTC)",
      "body": null,
      "sourceUrl": "https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "PostHog SDKs compromised (04:11 UTC); removed and tokens revoked by 09:30 UTC",
      "body": null,
      "sourceUrl": "https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Postman unpublishes 17 infected packages (51 versions)",
      "body": null,
      "sourceUrl": "https://blog.postman.com/engineering/shai-hulud-2-0-npm-supply-chain-attack/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-2-npm-worm-november-2025",
      "incidentTitle": "Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-11-24",
      "title": "Last compromised package seen (~17:00-18:00 UTC)",
      "body": null,
      "sourceUrl": "https://securitylabs.datadoghq.com/articles/shai-hulud-2.0-npm-worm/",
      "url": "https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-23",
      "title": "CISA alert: widespread supply chain compromise impacting npm (500+ packages)",
      "body": null,
      "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-16",
      "title": "Largest burst, nearly 100 packages, including @crowdstrike scope",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-15",
      "title": "Worm discovered; @ctrl/tinycolor and ~40 packages found compromised",
      "body": null,
      "sourceUrl": "https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-15",
      "title": "Initial CVEs posted",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "shai-hulud-npm-worm-september-2025",
      "incidentTitle": "Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-14",
      "title": "First compromised versions published (17:58 UTC)",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages",
      "url": "https://pwn.watch/i/shai-hulud-npm-worm-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-13",
      "title": "All remaining affected packages republished by the maintainer",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "Malicious versions start appearing on npm (13:16 UTC)",
      "body": null,
      "sourceUrl": "https://www.aikido.dev/blog/npm-debug-and-chalk-packages-compromised",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "Sindre Sorhus publishes clean chalk-family versions over the compromised ones",
      "body": null,
      "sourceUrl": "https://github.com/chalk/chalk/issues/656",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "chalk-debug-npm-hijack-september-2025",
      "incidentTitle": "chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-09-08",
      "title": "npm takes down all impacted versions (21:59 CEST); maintainer account restored (23:48 CEST)",
      "body": null,
      "sourceUrl": "https://github.com/debug-js/debug/issues/1005",
      "url": "https://pwn.watch/i/chalk-debug-npm-hijack-september-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-28/29",
      "title": "Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-27",
      "title": "GitHub disables attacker-created s1ngularity repositories (09:00 UTC)",
      "body": null,
      "sourceUrl": "https://www.wiz.io/blog/s1ngularity-supply-chain-attack",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-26",
      "title": "Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-24",
      "title": "Attacker exploits the workflow and exfiltrates the npm token",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "nx-s1ngularity-npm-supply-chain-august-2025",
      "incidentTitle": "s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-08-21",
      "title": "A PR adds a GitHub Actions workflow with an injection bug to nrwl/nx",
      "body": null,
      "sourceUrl": "https://github.com/nrwl/nx/security/advisories/GHSA-cxm3-wv7p-598c",
      "url": "https://pwn.watch/i/nx-s1ngularity-npm-supply-chain-august-2025"
    },
    {
      "incident": "eslint-config-prettier-npm-phishing-cve-2025-54313",
      "incidentTitle": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)",
      "category": "supply-chain",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-22",
      "title": "Malicious 'is' package versions found in the same campaign",
      "body": null,
      "sourceUrl": "https://socket.dev/blog/npm-is-package-hijacked-in-expanding-supply-chain-attack",
      "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313"
    },
    {
      "incident": "eslint-config-prettier-npm-phishing-cve-2025-54313",
      "incidentTitle": "eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)",
      "category": "supply-chain",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2025-07-18",
      "title": "Malicious eslint-config-prettier versions published after maintainer phishing",
      "body": null,
      "sourceUrl": "https://www.cve.org/CVERecord?id=CVE-2025-54313",
      "url": "https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313"
    },
    {
      "incident": "solana-web3-js-npm-compromise-cve-2024-54134",
      "incidentTitle": "@solana/web3.js npm package backdoored to steal private keys",
      "category": "supply-chain",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-04",
      "title": "GitHub advisory GHSA-jcxm-7wvp-g6p5 published; upgrade to 1.95.8",
      "body": null,
      "sourceUrl": "https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5",
      "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134"
    },
    {
      "incident": "solana-web3-js-npm-compromise-cve-2024-54134",
      "incidentTitle": "@solana/web3.js npm package backdoored to steal private keys",
      "category": "supply-chain",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-12-03",
      "title": "Malicious 1.95.6 and 1.95.7 published to npm (15:20-20:25 UTC), then unpublished",
      "body": null,
      "sourceUrl": "https://github.com/solana-labs/solana-web3.js/security/advisories/GHSA-jcxm-7wvp-g6p5",
      "url": "https://pwn.watch/i/solana-web3-js-npm-compromise-cve-2024-54134"
    },
    {
      "incident": "lottiefiles-lottie-player-npm-compromise",
      "incidentTitle": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer",
      "category": "supply-chain",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-30",
      "title": "Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup",
      "body": null,
      "sourceUrl": "https://github.com/LottieFiles/lottie-player/issues/254",
      "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise"
    },
    {
      "incident": "lottiefiles-lottie-player-npm-compromise",
      "incidentTitle": "@lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer",
      "category": "supply-chain",
      "severity": "high",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2024-10-30",
      "title": "LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8",
      "body": null,
      "sourceUrl": "https://github.com/LottieFiles/lottie-player/issues/254",
      "url": "https://pwn.watch/i/lottiefiles-lottie-player-npm-compromise"
    },
    {
      "incident": "ledger-connect-kit-npm-supply-chain-2023",
      "incidentTitle": "Ledger Connect Kit npm package hijacked to drain crypto wallets",
      "category": "supply-chain",
      "severity": "critical",
      "status": "closed",
      "patchStatus": "patched",
      "date": "2023-12-14",
      "title": "Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed",
      "body": null,
      "sourceUrl": "https://www.ledger.com/blog/security-incident-report",
      "url": "https://pwn.watch/i/ledger-connect-kit-npm-supply-chain-2023"
    }
  ]
}