https://pwn.watch/t/worm Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Wed, 26 Nov 2025 00:00:00 GMT https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 https://pwn.watch/i/shai-hulud-2-npm-worm-november-2025 Wed, 26 Nov 2025 00:00:00 GMT critical <p>A second wave of the Shai-Hulud worm ran in npm preinstall scripts (setup_bun.js), stole credentials with TruffleHog and pushed them to public GitHub repos, then republished packages with any npm tokens it found. Datadog counted 796 backdoored packages with 20M+ weekly downloads; Wiz saw 25,000+ attacker repos.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Malicious versions unpublished; use versions published after 2025-11-24 per each vendor</p> <p><strong>Latest updates:</strong></p><ul><li>2025-11-26: GitHub privatizes malicious repos; public count drops to ~300 (<a href="https://www.wiz.io/blog/shai-hulud-2-0-ongoing-supply-chain-attack">source</a>)</li><li>2025-11-26: PostHog publishes its post-mortem (<a href="https://posthog.com/blog/nov-24-shai-hulud-attack-post-mortem">source</a>)</li><li>2025-11-24: First compromised package published (03:10 UTC) (<a href="https://panther.com/blog/a-data-driven-analysis-of-the-sha1-hulud-2-0-campaign">source</a>)</li></ul> https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025 https://pwn.watch/i/glassworm-vscode-openvsx-worm-october-2025 Fri, 31 Oct 2025 00:00:00 GMT high <p>Koi Security found extensions on OpenVSX (and one on Microsoft's marketplace) carrying JavaScript hidden in invisible Unicode variation selectors. The malware stole npm, GitHub, Git and OpenVSX credentials to infect more extensions, went after crypto wallets, and set up SOCKS proxies and hidden VNC.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Malicious releases removed from the marketplaces</p> <p><strong>Latest updates:</strong></p><ul><li>2025-10-20: Wider coverage; Microsoft marketplace extension also affected (<a href="https://www.bleepingcomputer.com/news/security/self-spreading-glassworm-malware-hits-openvsx-vs-code-registries/">source</a>)</li><li>2025-10-17: Koi Security discloses GlassWorm on OpenVSX (<a href="https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace">source</a>)</li></ul> https://pwn.watch/i/shai-hulud-npm-worm-september-2025 https://pwn.watch/i/shai-hulud-npm-worm-september-2025 Tue, 23 Sep 2025 00:00:00 GMT critical <p>A worm spread through npm by stealing maintainers' npm and GitHub tokens with TruffleHog, then republishing their packages with a malicious bundle.js postinstall. It created shai-hulud GitHub workflows to exfiltrate secrets and made private repos public. CISA counted more than 500 affected packages, including @ctrl/tinycolor and several @crowdstrike packages.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> Malicious versions removed from npm; upgrade to versions published after the incident</p> <p><strong>Latest updates:</strong></p><ul><li>2025-09-23: CISA alert: widespread supply chain compromise impacting npm (500+ packages) (<a href="https://www.cisa.gov/news-events/alerts/2025/09/23/widespread-supply-chain-compromise-impacting-npm-ecosystem">source</a>)</li><li>2025-09-16: Largest burst, nearly 100 packages, including @crowdstrike scope (<a href="https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages">source</a>)</li><li>2025-09-15: Worm discovered; @ctrl/tinycolor and ~40 packages found compromised (<a href="https://www.sysdig.com/blog/shai-hulud-the-novel-self-replicating-worm-infecting-hundreds-of-npm-packages">source</a>)</li></ul>