pwn.watch: npm incident updates

[critical] tensorlake@0.5.144 npm Shai-Hulud worm with hostage GitHub token

Thu, 22 Oct 2026 17:39:46 GMT

On Oct 8 2026, tensorlake@0.5.144 was published from the real GitHub repo (with npm provenance) carrying a preinstall hook that installs a Shai-Hulud-style credential-stealing worm. It harvests npm/GitHub/cloud/SSH/AI-tool secrets, spreads to other packages, and installs a “gh-token-monitor” that wipes the home directory if the stolen GitHub token is revoked. Pin 0.5.143; remove the monitor before rotating tokens.

Status: live · Patch: partial · Fixed in: 0.5.143 (safe pin); remove 0.5.144

Latest updates:

2026-10-08: 0.5.144 published via the project’s release workflow.
2026-10-08+: StepSecurity / Socket detections and public write-ups; remediation guidance emphasizes removing gh-token-monitor before revoke.
2026-10-07: Malicious commits land on tensorlakeai/tensorlake main.

CVEs: GHSA-8g63-53c9-65j2

[critical] Next.js out-of-band release fixes two unauthenticated RCEs (SVG image optimization CVE-2026-96889, use cache)

Thu, 22 Oct 2026 16:00:43 GMT

On Oct 14 2026 Vercel shipped Next.js 16.4.1 and 15.5.28 with two critical unauthenticated remote code execution fixes held back from the September release: CVE-2026-96889 / GHSA-2464-fhr4-w9xw, a use-after-free in librsvg (via sharp) reachable through the Image Optimization API when SVGs are processed on glibc-based Linux, and GHSA-673q-mjm6-r5xr, RCE in App Router apps with Cache Components when a `use cache` function returns multiple typed arrays. A high-severity Server Actions DoS (GHSA-p3m5-59mp-jv5r) is fixed too. GitHub added the SVG advisory to its global database on Oct 22. No known exploitation.

Status: live · Patch: patched · Fixed in: next 15.5.28, next 16.4.1, sharp 0.35.5 (librsvg 2.63.2)

Latest updates:

2026-10-22: GitHub publishes GHSA-2464-fhr4-w9xw to the global Advisory Database (critical), so Dependabot and npm audit start flagging affected next versions. (source)
2026-10-14: Vercel releases Next.js 16.4.1 and 15.5.28 as an out-of-band security update: two critical unauthenticated RCEs (SVG Image Optimization, `use cache` typed arrays) and a high-severity Server Actions DoS. No workaround for the `use cache` bug; upgrade even if you don't use those features. (source)
2026-10-14: Netlify: the SVG flaw is also reachable through `next/og` ImageResponse; on Netlify the next/image path runs on its Image CDN, and impact there is a crashed function, not code execution. (source)

CVEs: CVE-2026-96889

[critical] Signal calls can stay live after hang-up (RingRTC CVE-2026-113380)

Thu, 22 Oct 2026 16:00:43 GMT

A bug in RingRTC, the open-source library behind Signal's voice and video calls, lets the other party on a call flood the call's state-machine event queue so a local hang-up gets stuck behind the backlog, and audio (possibly video) keeps flowing to them after the victim thinks the call ended. Affects every Signal client (Android, iOS, Desktop) embedding RingRTC before 2.72.0. Fixed in RingRTC 2.72.0 (released Sep 4 2026, disclosed Oct 20); a conceptual PoC is public, no known exploitation.

Status: closed · Patch: patched · Fixed in: RingRTC 2.72.0 (update Signal on every device)

Latest updates:

2026-10-22: No known exploitation; CISA has not added it to KEV and NVD lists it as awaiting analysis. (source)
2026-10-22: SecurityWeek: the hang-up was queued behind peer events with no rate limit or priority; the fix makes call termination bypass the queue. Users should update Signal and check the call indicator after hanging up. (source)
2026-10-22: Closed on pwn.watch: the fix shipped Sep 4 (RingRTC 2.72.0), there is still no known exploitation and no new developments, so this is now a patch-and-move-on item. Make sure Signal is updated on every device. (source)

CVEs: CVE-2026-113380

[high] Storybook dev server: malicious websites can inject code into your project (CVE-2026-114125)

Thu, 22 Oct 2026 12:43:45 GMT

Storybook disclosed CVE-2026-114125 on Oct 21 2026: the dev server's preview iframe could be embedded by any website and accepted postMessage events from any origin. A malicious site open in the same browser could, with some user interaction, make a running `storybook dev` server change story files in your project, and a changed file could then be executed by a local runtime with your privileges. Storybook 8, 9, 10 and 11 alpha are affected (including @storybook/addon-mcp and @storybook/addon-vitest). Fixed versions shipped Oct 12; Storybook says it is not aware of exploitation. Built (static) Storybooks are not affected.

Status: closed · Patch: patched · Fixed in: 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6

Latest updates:

2026-10-22: Closed on pwn.watch: fixes are out for every affected major and there is no known exploitation. Upgrade Storybook (and the Visual Tests addon to 5.5.1+ if you use it) and don't run an old dev server meanwhile. (source)
2026-10-21: Advisory GHSA-f2ph-cmg5-wxc8 / CVE-2026-114125 published. Storybook says it is not aware of exploitation in the wild; upgrade before running storybook dev again. (source)
2026-10-12: Patched releases 8.6.19, 9.1.21, 10.6.2 and 11.0.0-alpha.6 ship. They block cross-host iframe embedding of the dev server, reject postMessage from unknown origins and rework the highlight event (new feature flags can re-enable the old behaviour). (source)

CVEs: CVE-2026-114125

[critical] SubQuery @subql/common 5.8.3 published with credential stealer + backdoor

Thu, 22 Oct 2026 10:04:00 GMT

On Oct 5 2026 @subql/common 5.8.3 was published to npm through SubQuery's own GitHub Actions trusted publisher, after a short-lived branch changed the release step to swap the built package for a tarball downloaded from ci-artifacts.dev. The payload ran on install (postinstall) and on import, stole CI/cloud/GitHub/npm/Kubernetes/Vault/SSH and AI-tool credentials, offered a reverse shell, and with a workflow-scoped token tried to push a secret-dumping workflow. It was live about 50 minutes; 5.8.2 is the safe version. Many @subql packages accept 5.8.3 through their version ranges.

Status: closed · Patch: patched · Fixed in: @subql/common 5.8.2 (npm 'latest')

Latest updates:

2026-10-10: SubQuery maintainer: compromised token deleted, security review started. (source)
2026-10-06: GMO Flatt Security publishes payload analysis and response guidance. (source)
2026-10-05T11:56Z: Malicious @subql/common 5.8.3 published via the repo's GitHub Actions trusted publisher (canary 5.8.3-onf-rt1 published ~32 min earlier). (source)

CVEs: GHSA-9333-3c4x-x3h5, MAL-2026-17571

[critical] CHAINDROP / Mini Shai-Hulud npm worm (keyv + 400+ packages)

Sat, 15 Aug 2026 00:00:00 GMT

In early August 2026 a Mini Shai-Hulud / CHAINDROP worm compromised keyv and related cache packages, then self-propagated via stolen npm tokens to 400+ packages (1B+ monthly downloads across the graph). Payload runs via preinstall (disabled by default on npm 12+), steals npm/GitHub/cloud/CI secrets, and republishes backdoored versions. Microsoft, Elastic, JFrog and Wiz published analyses.

Status: closed · Patch: partial · Fixed in: Pin known-good versions; purge caches; npm CLI 12+ disables preinstall by default

Latest updates:

2026-08-04: keyv/cacheable malicious releases observed; worm begins propagating.
2026-08-04/06: Microsoft, Elastic, JFrog publish analyses; 400+ packages listed.

[critical] Mini Shai-Hulud hits AntV / timeago.js npm ecosystem

Mon, 01 Jun 2026 00:00:00 GMT

May 2026 wave of Mini Shai-Hulud compromised packages across Alibaba’s AntV visualization ecosystem and timeago.js (via npm account atool). Payload harvested CI secrets from GitHub Actions runner memory and dumped credentials to public GitHub repos. StepSecurity documented the ongoing spread.

Status: closed · Patch: partial · Fixed in: Remove malicious versions; rotate CI/cloud secrets; pin clean releases

[high] OpenAI employee devices hit via TanStack Mini Shai-Hulud wave

Sun, 31 May 2026 00:00:00 GMT

In May 2026 OpenAI confirmed two employee devices were breached as part of the broader TanStack Mini Shai-Hulud npm supply-chain campaign. OpenAI said customer data, production systems, IP and deployed software were not impacted.

Status: closed · Patch: patched

[high] TanStack TanStack: TanStack Unspecified Vulnerability

Wed, 27 May 2026 00:00:00 GMT

TanStack contains an unspecified vulnerability that allowed malicious versions of the product to be published to the npm registry to publish credential-stealing malware under a trusted identity. Added to CISA KEV on 2026-05-27.

Status: closed · Patch: patched · Fixed in: See vendor advisory linked in sources

Latest updates:

2026-05-27: CISA added CVE-2026-45321 to the KEV catalog (due 2026-06-10).

CVEs: CVE-2026-45321

[critical] Shai-Hulud 2.0: worm backdoors ~800 npm packages incl. Zapier, PostHog, Postman, ENS

Wed, 26 Nov 2025 00:00:00 GMT

A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.

Status: closed · Patch: patched · Fixed in: Malicious versions unpublished; use versions published after 2025-11-24 per each vendor

Latest updates:

2025-11-26: GitHub privatizes malicious repos; public count drops to ~300 (source)
2025-11-26: PostHog publishes its post-mortem (source)
2025-11-24: First compromised package published (03:10 UTC) (source)

[critical] Shai-Hulud: first self-replicating npm worm hits 500+ packages incl. @ctrl/tinycolor and CrowdStrike

Tue, 23 Sep 2025 00:00:00 GMT

A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.

Status: closed · Patch: patched · Fixed in: Malicious versions removed from npm; upgrade to versions published after the incident

Latest updates:

2025-09-23: CISA alert: widespread supply chain compromise impacting npm (500+ packages) (source)
2025-09-16: Largest burst, nearly 100 packages, including @crowdstrike scope (source)
2025-09-15: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised (source)

[critical] chalk, debug and 16 other npm packages (2B+ weekly downloads) hijacked via fake 2FA email

Mon, 15 Sep 2025 00:00:00 GMT

Maintainer Josh Junon (qix) was phished by a fake npm 2FA-reset email from npmjs.help. The attacker published malicious versions of 18 packages, including chalk, debug, ansi-styles and strip-ansi, with code that hijacked crypto wallet transactions in browsers. They were live for about two hours.

Status: closed · Patch: patched · Fixed in: chalk 5.6.2, ansi-styles 6.2.3, strip-ansi 7.1.2, supports-color 10.2.2, ansi-regex 6.2.2, wrap-ansi 9.0.2, slice-ansi 7.1.2, has-ansi 6.0.2, chalk-template 1.1.2, supports-hyperlinks 4.1.2, debug and others: republished by the maintainer on 2025-09-13

Latest updates:

2025-09-15: Initial CVEs posted (source)
2025-09-13: All remaining affected packages republished by the maintainer (source)
2025-09-08: Malicious versions start appearing on npm (13:16 UTC) (source)

[critical] s1ngularity: malicious Nx releases used AI CLIs to hunt secrets, 5,500+ private repos exposed

Fri, 29 Aug 2025 00:00:00 GMT

Attackers abused a GitHub Actions injection bug in nrwl/nx to steal its npm token and published malicious nx and @nx/* versions for about four hours. The postinstall script used local AI CLIs (Claude, Gemini, Q) to find secrets and pushed them to public s1ngularity-repository repos. A second phase used stolen GitHub tokens to make 5,500+ private repos public.

Status: closed · Patch: patched · Fixed in: Malicious versions removed from npm (see GHSA-cxm3-wv7p-598c)

Latest updates:

2025-08-28/29: Second phase: 5,500+ private repos of 400+ users/orgs made public with stolen tokens (source)
2025-08-27: GitHub disables attacker-created s1ngularity repositories (09:00 UTC) (source)
2025-08-26: Malicious nx 21.5.0 and others published; npm removes them and revokes tokens that evening (source)

[high] eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)

Tue, 22 Jul 2025 00:00:00 GMT

A maintainer was phished through the typosquat domain npnjs.com. The attacker published malicious eslint-config-prettier versions whose install script ran node-gyp.dll on Windows, dropping the Scavenger infostealer. eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall and later the 'is' package were also hit.

Status: closed · Patch: patched · Fixed in: Malicious versions removed; use other eslint-config-prettier versions (see CVE record)

Latest updates:

2025-07-22: Malicious 'is' package versions found in the same campaign (source)
2025-07-18: Malicious eslint-config-prettier versions published after maintainer phishing (source)

CVEs: CVE-2025-54313

[high] @solana/web3.js npm package backdoored to steal private keys

Wed, 04 Dec 2024 00:00:00 GMT

A publish-access account for @solana/web3.js was compromised. Malicious versions 1.95.6 and 1.95.7, live on npm from 15:20 to 20:25 UTC on 2024-12-03, exfiltrated private key material from apps and bots that handle keys directly. Non-custodial wallets were generally not affected. Fixed in 1.95.8.

Status: closed · Patch: patched · Fixed in: 1.95.8

Latest updates:

2024-12-04: GitHub advisory GHSA-jcxm-7wvp-g6p5 published; upgrade to 1.95.8 (source)
2024-12-03: Malicious 1.95.6 and 1.95.7 published to npm (15:20-20:25 UTC), then unpublished (source)

CVEs: CVE-2024-54134

[high] @lottiefiles/lottie-player npm package hijacked with a crypto wallet drainer

Thu, 31 Oct 2024 00:00:00 GMT

A LottieFiles developer's npm access was abused to publish @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 on 2024-10-30. Sites loading the 'latest' build from CDNs like unpkg and jsDelivr showed a wallet-connect popup that tried to drain visitors' crypto wallets. LottieFiles unpublished the versions and released 2.0.8, a copy of 2.0.4.

Status: closed · Patch: patched · Fixed in: 2.0.8

Latest updates:

2024-10-30: Malicious 2.0.5, 2.0.6 and 2.0.7 pushed to npm; users report a wallet popup (source)
2024-10-30: LottieFiles removes the compromised access, unpublishes the versions and publishes 2.0.8 (source)

[critical] Ledger Connect Kit npm package hijacked to drain crypto wallets

Thu, 14 Dec 2023 00:00:00 GMT

Attackers phished a former Ledger employee's npm account and published malicious @ledgerhq/connect-kit versions 1.1.5 to 1.1.7. Because many dApps load it from a CDN without pinning a version, their users were shown wallet-drainer prompts. Ledger shipped a clean 1.1.8 within about 40 minutes of finding out.

Status: closed · Patch: patched · Fixed in: 1.1.8

Latest updates:

2023-12-14: Malicious connect-kit versions published to npm via a phished ex-employee account; Ledger ships 1.1.8 and the npm versions are removed (source)