Package Registry
Security incidents tagged Package Registry. Newest first.
1 Package Registry incident in the last 12 months
Critical 4 · High 3 · Med 2 · Low 1 · Update ½Severity-weighted: critical 4 · high 3 · medium 2 · low 1 · update ½LessMore
- Incidents
- 1
- Live
- 1
- Patched
- 0
- Days without an incident
- 0
- Longest quiet run: 3 days (Oct 23–Oct 25)
- MediumPartly patched
Luanti ContentDB breached: attacker had server access Oct 22-26, emails, password hashes and uploads exposed
Luanti (formerly Minetest) says an attacker broke into ContentDB, its mod and game package site, by exploiting two vulnerabilities, one in a third-party component. From Oct 22 the attacker had the internal configuration and signed into a staff account, and from Oct 26 they could run commands inside the server container with full access to the database, secrets and uploads. Luanti took ContentDB offline on Oct 26, revoked all sessions, API tokens and GitHub OAuth tokens, and found no tampered uploads in backups but has not ruled it out. ContentDB stays offline for a week or more.
Luanti ContentDB (content.luanti.org)Since Oct 22, 2026
