# Threat Watch by Helix — Supply chain

> Live security incidents: actively exploited vulnerabilities, breaches and supply-chain attacks — patch status, fixed versions and what to do, curated by Helix Cyber.

All endpoints are public JSON/XML/text with CORS enabled; no auth. Poll changes.json at most hourly with If-None-Match (every response carries an ETag).

## Categories

Every incident has exactly one `category`.
- Vulnerabilities (`patch`): 1848 incidents, 75 live. Flaws in software you may run — which versions are affected, the fixed release, and what to do first. Page https://helix.ml/threat-watch?c=patch · RSS https://helix.ml/threat-watch/c/patch/feed.xml · JSON Feed https://helix.ml/threat-watch/c/patch/feed.json · changes https://helix.ml/threat-watch/c/patch/changes.json · llms.txt https://helix.ml/threat-watch/c/patch/llms.txt
- Breaches (`breach`): 1041 incidents, 52 live. Attacks on companies and services. Nothing to patch on your side; rotate credentials and watch for follow-on phishing if you are a customer. Page https://helix.ml/threat-watch?c=breach · RSS https://helix.ml/threat-watch/c/breach/feed.xml · JSON Feed https://helix.ml/threat-watch/c/breach/feed.json · changes https://helix.ml/threat-watch/c/breach/changes.json · llms.txt https://helix.ml/threat-watch/c/breach/llms.txt
- Supply chain (`supply-chain`): 109 incidents, 96 live. Compromised packages, releases, build pipelines and certificates. Check what you depend on and what you trust. Page https://helix.ml/threat-watch?c=supply-chain · RSS https://helix.ml/threat-watch/c/supply-chain/feed.xml · JSON Feed https://helix.ml/threat-watch/c/supply-chain/feed.json · changes https://helix.ml/threat-watch/c/supply-chain/changes.json · llms.txt https://helix.ml/threat-watch/c/supply-chain/llms.txt

## Data

- All incidents: https://helix.ml/threat-watch/incidents.json
- One incident: https://helix.ml/threat-watch/i/<slug>.json (timeline, sources, `agentBrief` markdown)
- Update stream: https://helix.ml/threat-watch/changes.json
- Fields: severity (critical|high|medium|low|unknown), patchStatus (patched|partial|unpatched|no-fix-needed|unknown), status (live|closed), exploited, stacks, tags, cveIds, affectedVersions, fixedVersions, actions.
- Incidents marked `auto: true` were generated from an authoritative catalog (CISA KEV, Have I Been Pwned) and not yet reviewed by an editor.

## Use with your AI

Poll changes.json hourly with ETag; for each new change, fetch the incident JSON, compare `stacks`, `product`, `affectedVersions` and `cveIds` against the systems and dependencies you manage, and alert only when one matches. Follow `actions`.

## Live incidents (96)

### [critical] Malicious PyPI packages twitter-request-diagnostics and test-01-rafamarrara-learning-dc backdoor web apps
https://helix.ml/threat-watch/i/malicious-pypi-packages-twitter-request-diagnostics-and-test-01-rafamarrara-learning-dc-backdoor-web-apps · Supply chain · no-fix-needed · since 2026-10-30
Two malicious PyPI packages, twitter-request-diagnostics and test-01-rafamarrara-learning-dc (both version 1.0.0), were published and documented by OpenSSF malicious-packages and the GitHub Advisory Database on 2026-10-30 as part of campaign 2026-10-test-01-rafamarrara-learning-dc. Both pose as web middleware adding a diagnostic endpoint but actually exfiltrate environment variables (stealing secrets such as API keys and credentials) and contain hidden backdoor functionality allowing remote execution of attacker-sent commands. Any developer or application that installs either package is exposed to credential theft and remote code execution. No patched versions exist; the packages are malware and must be removed entirely rather than upgraded.
Do: Immediately remove twitter-request-diagnostics and test-01-rafamarrara-learning-dc from all environments and dependency manifests; Rotate all secrets, API keys, and credentials that could have been exposed via environment variables on affected systems; Audit systems where the packages ran for signs of command execution or unauthorized access; Check CI/CD pipelines and lockfiles for the packages and block them in dependency scanning; Report any installs to your security team and monitor for related campaign packages

### [high] ARTEX AI-driven attacks: ConnectWise Cloud Backup supply-chain compromise and suspected same-actor 123 Reg breach (no CVE)
https://helix.ml/threat-watch/i/storm-0940-artex-ai-driven-supply-chain-attack-connectwise-cloud-backup-china-aligned-actor-compromised-m365-tenants-via · Supply chain · no-fix-needed · since 2026-10-21
Microsoft attributed a supply-chain attack on ConnectWise Cloud Backup customers' Microsoft 365 environments to China-state-aligned Storm-0940, active since 2021. From September 2026 the group used ARTEX, an open-source LLM-driven agentic penetration-testing framework, to automate reconnaissance, password spraying and OAuth abuse. After a four-day campaign (ending Oct 14) against 327 M365/Exchange Online accounts across eight organizations with 151,000+ failed logons peaking at 2,900/minute, Storm-0940 compromised ConnectWise Cloud Backup the next day, reaching 2,250+ tenants; AI agents performed directory reconnaissance, modified application credentials for persistence, and altered identities, groups and privileged roles. ConnectWise shut down services Oct 17 and began phased restoration Oct 21. Separately, UK registrar 123 Reg disclosed a Sept 18 'AI-driven' attack exposing customer contact, VAT and product data, with artifacts (mirrored Anthropic skills, Chinese/Singapore-hosted infrastructure) suggesting the same ARTEX-using China-nexus actor CrowdStrike tracked (CSA-261162) against South Korean financial firms.
Do: Review Microsoft 365 audit logs for anomalous sign-ins, OAuth application consent, and application credential modifications since early September 2026; Rotate credentials and re-authorize or remove suspicious OAuth/enterprise applications, especially those tied to ConnectWise Cloud Backup; Keep ConnectWise Cloud Backup connections disabled per vendor guidance until phased restoration completes and integrity is confirmed; Harden against AI-automated password spraying: enforce MFA/2SV, conditional access, and rate-limit/lockout monitoring at scale; Monitor Microsoft Graph and directory operations for persistence mechanisms, privileged role changes, and backdoor creation; For 123 Reg customers: enable two-step verification and treat unsolicited communications claiming to be from 123 Reg with caution; Track Microsoft Threat Intelligence and CrowdStrike (CSA-261162) guidance on ARTEX-based agentic attack activity

### [critical] npm malware: dowload_ebok_armageddon_by_max_hastings_kv3s4 — malicious package fully compromises installed machines
https://helix.ml/threat-watch/i/npm-malware-dowload-ebok-armageddon-by-max-hastings-kv3s4-malicious-package-fully-compromises-installed-machines · Supply chain · no-fix-needed · since 2026-10-29
GitHub's malware advisory database published GHSA-p6mc-228w-6q75 on 2026-10-29 flagging the npm package dowload_ebok_armageddon_by_max_hastings_kv3s4 as embedded malicious code (CWE-506). The package, apparently a fake ebook-download lure, has no legitimate source code and no patched versions; all versions (>= 0) are affected. GitHub states any computer with the package installed or running should be considered fully compromised, with attackers potentially having full remote control and access to secrets and keys. Downloads are low (~10/month), limiting reach, but any installation is treated as an active compromise. There is no fix; the only remediation is removal plus incident response, since uninstalling may not remove all malicious software.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a different, clean computer; Isolate and reimage/rebuild affected machines rather than relying on uninstalling the package; Audit dependency locks and CI caches for the package name and block it in registries/proxies; Review logs and network traffic for signs of attacker access following installation

### [critical] Malicious npm package dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-reiki-sviluppa-e-usa-lenergia-reiki-by-matt-harvey-9q55p-full-system-compromise · Supply chain · no-fix-needed · since 2026-10-29
GitHub's malware advisory database published GHSA-h86m-7gvf-j79h on 2026-10-29 flagging the npm package dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p as embedded malicious code (CWE-506). The package, apparently a typosquat-style ebook downloader, receives roughly 9 downloads per month and every version (>= 0) is affected with no patched version available. GitHub states any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, harvested secrets and keys, and deployed additional malware that persists after package removal. No fix exists; remediation is removal plus credential rotation.
Do: Treat any machine where the package was installed as fully compromised; rotate all secrets and keys from a clean machine; Remove the package and rebuild/reimage affected systems; Audit npm dependency trees and lockfiles for the package name; Check for persistence mechanisms and follow-up malware on affected hosts; Block the package in internal registries and CI

### [critical] Malicious npm package dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t fully compromises hosts
https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-nur-mal-schnell-das-mammut-retten-by-knut-kruger-eva-schoffmann-davidov-ouz6t-fully-c · Supply chain · no-fix-needed · since 2026-10-29
GitHub published advisory GHSA-5cmc-vx46-22wx on 2026-10-29 flagging the npm package dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t as malware (CWE-506, embedded malicious code). All versions (>=0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to secrets and keys. The package appears to be a fake ebook-download package with very low reach (~7 downloads/month). Removal of the package does not guarantee removal of all malicious software, so affected machines require full remediation. No CVE is assigned; the package should be treated as compromised infrastructure rather than a vulnerable dependency.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, from a clean computer; Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software; Audit dependency trees and lockfiles for the package name and block it in registry proxies/allowlists; Review access logs and network activity from affected hosts for signs of attacker control; Report any related compromise indicators to your security team and GitHub/npm

### [critical] Malicious npm package dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-el-piso-mil-el-piso-mil-1-by-katharine-mcgee-h1llc-full-system-compromise · Supply chain · no-fix-needed · since 2026-10-29
GitHub's malware advisory database published GHSA-j272-m9j4-g3v9 on 2026-10-29 flagging the npm package dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. All versions (>= 0) are affected and no patched version exists. The package appears to be a fake ebook-download package with very low usage (~2 downloads/month), typical of typosquat or SEO-lure malware. No CVE is assigned; the advisory is reviewed malware classification.
Do: If the package is installed, treat the machine as fully compromised and rotate all secrets and keys immediately from a clean computer; Remove the package and rebuild/reimage affected machines rather than relying on uninstall; Audit npm lockfiles and CI caches for the package name and block it in dependency firewalls/allowlists; Review systems for persistence and unauthorized access following exposure

### [critical] Malicious npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-dowload-ebok-lolita-by-vladimir-nabokov-oy1gy-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub's advisory database published a malware advisory (GHSA-cjmr-6xg2-vf8h) for the npm package dowload_ebok_lolita_by_vladimir_nabokov_oy1gy, an ebook-download-themed package containing embedded malicious code (CWE-506). All versions (>= 0) are affected and there are no patched versions; the package will not be fixed. GitHub states that any computer with the package installed or running should be considered fully compromised, with attacker control of the machine, so secrets and keys stored on it must be treated as stolen. Reach appears limited (~7 downloads/month), but any installation grants full control to an outside entity. Removal of the package does not guarantee removal of the malicious software it installed. Affected users should treat the host as breached and rotate all credentials from a clean machine.
Do: Immediately isolate and rebuild any machine where the package was installed or run; Rotate all secrets, keys, tokens and credentials stored on affected machines, from a clean computer; Remove the package and audit for persistence mechanisms and additional malware it may have deployed; Review npm dependency trees and lockfiles for the package and block it in registries/proxies; Check access and CI logs for signs of attacker activity following installation

### [critical] 2026-10-bq-helix-recon: bq-helix-build-hook-6ade983e / bq-helix-recon-6ade983e PyPI packages — infostealer executes on install and every Python startup, exfiltrating credentials and cloud tokens
https://helix.ml/threat-watch/i/2026-10-bq-helix-recon-bq-helix-build-hook-6ade983e-bq-helix-recon-6ade983e-pypi-packages-infostealer-executes-on-instal · Supply chain · no-fix-needed · since 2026-10-29
Two malicious PyPI packages, bq-helix-build-hook-6ade983e and bq-helix-recon-6ade983e, were published to the GitHub Advisory Database on 2026-10-29 as part of the 2026-10-bq-helix-recon campaign. bq-helix-build-hook-6ade983e (0.1.0) runs an infostealer during installation, collecting credential files, environment variables and cloud metadata endpoint data before exfiltrating it. bq-helix-recon-6ade983e (0.1.0, 0.1.2) additionally drops PTH/sitecustomize files that trigger the malicious code on every Python startup, giving persistence beyond the initial install. Both abuse the .pth mechanism and exfiltrate cloud tokens, generic data, environment variables and credentials. No patched versions exist; any installation of these packages constitutes compromise of the build or runtime environment.
Do: Immediately uninstall and purge bq-helix-build-hook-6ade983e and bq-helix-recon-6ade983e from all environments and CI caches; Rotate all credentials, cloud tokens and API keys present on affected machines, including cloud metadata-issued tokens; Rebuild affected environments from clean images; remove any .pth or sitecustomize files the packages dropped; Audit pip install logs and dependency lockfiles for these package names; Block the package names in PyPI proxies/mirrors and dependency-scanning tooling

### [critical] Malicious npm package react-native-drago-callkit — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-react-native-drago-callkit-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub's malware advisory database published GHSA-jp74-4rg3-7ppj on 2026-10-29 flagging the npm package react-native-drago-callkit as containing embedded malicious code (CWE-506). Affected versions are 0.0.0-stage, 1.0.0, 1.0.1, 1.0.2, 1.0.15 and 1.0.16, with no patched versions available. The advisory states that any computer with the package installed or running should be considered fully compromised, implying the code grants outside parties full control of the machine. All secrets and keys on affected machines should be treated as stolen. No source code repository is known for the package. Any developer or CI environment that installed the package is affected; removal of the package alone cannot be assumed to remove the malicious software.
Do: Immediately remove react-native-drago-callkit from all projects, lockfiles and CI pipelines; Treat every machine that installed or ran the package as fully compromised; rotate all secrets, keys and credentials from a clean machine; Rebuild affected machines and audit for persistence mechanisms and residual malware; Audit npm dependency trees and lockfiles for the package and block it in registry/proxy allowlists; Review access logs and network egress for signs of exfiltration since installation

### [critical] Malware in orderbook-volt-plugin npm package — full machine compromise
https://helix.ml/threat-watch/i/malware-in-orderbook-volt-plugin-npm-package-full-machine-compromise · Supply chain · no-fix-needed · since 2026-10-29
GitHub published a malware advisory (GHSA-w9pq-6r9f-pj96) for the npm package orderbook-volt-plugin, flagged as CWE-506 embedded malicious code. Versions 0.0.0-stage, 0.0.1 and 0.0.2 are affected, with no patched versions available and no known source code. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers gained full control and can access secrets, keys and data. All users of the package are affected; the only remediation is removal plus credential rotation from a clean machine, since removal cannot guarantee elimination of all malicious software.
Do: Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different clean computer; Remove the package and audit affected machines for persistence; consider rebuilding from trusted images; Check npm lockfiles and CI/CD environments for the package and any versions of it; Review logs and network traffic for signs of exfiltration or attacker access

### [critical] Malicious npm package @chatunitycenter/baileys — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-chatunitycenter-baileys-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub published advisory GHSA-g6j7-j669-23g6 on 2026-10-29 flagging the npm package @chatunitycenter/baileys as malware (CWE-506, embedded malicious code). Every published version (>= 0) is affected and there are no patched versions, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. Anyone who installed this package — likely developers seeking the Baileys WhatsApp automation library — is affected. No fix exists; remediation requires removal, secret rotation from a clean machine, and system rebuild.
Do: Treat any machine with @chatunitycenter/baileys installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and rebuild/reimage affected systems rather than trusting cleanup; Audit npm lockfiles and CI environments for the package and block it in dependency firewalls; Review access logs and monitor for follow-on attacker activity

### [critical] black-spindle-2 (npm): malicious postinstall beacon exfiltrates host data on install (no CVE)
https://helix.ml/threat-watch/i/black-spindle-2-npm-malicious-postinstall-beacon-exfiltrates-host-data-on-install-no-cve · Supply chain · no-fix-needed · since 2026-10-29
The npm package black-spindle-2 (versions 100.0.0 and 301.0.0) contains malicious code flagged by Amazon Inspector and reported via OpenSSF/GitHub Advisory GHSA-qcg8-4xw5-5ccq. Its package.json declares a postinstall script that runs curl over plain HTTP against an anonymous ngrok-free.app tunnel (http://778e-181-63-25-28.ngrok-free.app), embedding a shell command-substitution expression in the URL path. The script fires automatically on npm install, confirming installation and providing a channel to exfiltrate host or environment values via the expanded shell expression; the shipped index.js is an empty stub, so the beacon is the package's entire effect. No patched versions exist; the fix is to remove the package. Anyone who installed these versions is affected.
Do: Search dependency trees and lockfiles for black-spindle-2 and remove it; do not install; If installed, treat the build machine as compromised: rotate secrets, tokens, and environment credentials exposed during install; Block ngrok-free.app tunnels in CI/build egress and disable install lifecycle scripts (npm config set ignore-scripts true); Audit npm install logs for connections to the ngrok host; Prefer pinned dependencies and provenance-verified packages

### [critical] poc-revshell (PyPI): malicious package ships reverse-shell backdoor triggered on pip install or import (no CVE)
https://helix.ml/threat-watch/i/poc-revshell-pypi-malicious-package-ships-reverse-shell-backdoor-triggered-on-pip-install-or-import-no-cve · Supply chain · no-fix-needed · since 2026-10-29
The PyPI package poc-revshell 0.1.0 contains an embedded reverse-shell backdoor (CWE-506), flagged by Amazon Inspector and catalogued by OpenSSF/GitHub as malware. setup.py registers a PostInstall cmdclass that spawns a daemon thread during pip install: it connects a TCP socket to hardcoded 127.0.0.1:4444, dup2s the descriptor onto stdin/stdout/stderr, and execs /bin/sh -i (or cmd.exe on Windows). The same thread launch sits at module top level in __init__.py, so every import poc_revshell repeats the handoff. Any co-resident listener on port 4444 receives a full interactive shell under the installing user's identity. The loopback destination limits the attack to a local attacker on the installer's host. No fixed version exists; the package is malware and should be removed, not upgraded.
Do: Search environments for poc-revshell in dependency manifests, lockfiles, and installed site-packages and remove it; Audit hosts where it was installed or imported for signs of a local listener on port 4444 and for unexpected shells or persistence; Rotate credentials and review activity of accounts used for the install, assuming user-level compromise if exposure is suspected; Block the package name in internal PyPI mirrors/proxies and alert on any future install attempts; Review install-time execution policies (e.g. pip hooks, setup.py execution) in CI and developer images

### [critical] @dmangal/curse-dependent-ecto (npm): malicious install-time script exfiltrates env secrets and files via webhook.site
https://helix.ml/threat-watch/i/dmangal-curse-dependent-ecto-npm-malicious-install-time-script-exfiltrates-env-secrets-and-files-via-webhook-site · Supply chain · no-fix-needed · since 2026-10-29
The npm package @dmangal/curse-dependent-ecto (versions 99999.0.0–99999.0.2) contains malicious code in its binding.gyp, which node-gyp executes automatically during npm install. The embedded node -e script greps /workspace/, /root/, /tmp/, /opt/, /var/ and /etc/ for files containing the 'HTB{' marker, reads /tmp/scent-trail.jsonl and /workspace/repo/package.json, enumerates all process.env keys, and POSTs the results (GREP:, FILE:, ALLENV: payloads) to a hardcoded webhook.site endpoint. The package has no native source files — binding.gyp exists solely to run the exfiltration command — and the implausible 99999.x version string suggests a dependency-confusion lure. Any developer or CI environment installing it leaks CI secrets, API tokens, environment-injected credentials and workspace file contents. No patched versions exist; the only fix is removal/blocking.
Do: Remove and uninstall @dmangal/curse-dependent-ecto from all projects and lockfiles; audit installs since exposure; Rotate all CI secrets, API tokens and environment-injected credentials on any machine or runner that installed it; Search logs and filesystems for files containing 'HTB{' and for outbound requests to webhook.site/89bd8fe7-328c-4e6d-970c-4d567b5a48a0; Block the webhook.site endpoint and pin dependency versions; enable npm audit/registry malware scanning in CI; Guard against dependency confusion by scoping internal package names in a private registry

### [critical] spectral-core (npm) typosquat: install-time script steals env secrets and AWS metadata
https://helix.ml/threat-watch/i/spectral-core-npm-typosquat-install-time-script-steals-env-secrets-and-aws-metadata · Supply chain · no-fix-needed · since 2026-10-29
The npm package spectral-core, a typosquat resembling the legitimate @stoplight/spectral-core, was published with malicious install-time code. Versions 3.0.2–3.0.7 and 3.0.9–3.0.12 ship only package.json and a binding.gyp with gypfile:true, so npm runs node-gyp rebuild on install; a 'none'-type target executes an embedded node -e script. The script reads /proc/1/environ and /proc/self/environ (container/CI secrets and cloud credentials), gathers DNS/socket/ARP/route reconnaissance, queries the AWS EC2 metadata service at 169.254.169.254 for user-data and meta-data, and POSTs everything to a hardcoded webhook.site collector. The package ships no library functionality (declared index.js is absent), so its sole purpose is credential exfiltration. No patched versions exist; the fix is to not use the package.
Do: Check lockfiles and CI logs for any install of spectral-core versions 3.0.2–3.0.12 and remove it; treat any machine or CI runner that installed it as compromised; Rotate all credentials present in environment variables on affected hosts, especially CI/CD secrets and AWS keys; invalidate EC2 instance roles and session tokens; Audit AWS CloudTrail and webhook.site-related egress for exfiltration; block webhook.site and the metadata endpoint abuse patterns; Pin dependencies and use the scoped @stoplight/spectral-core instead; Enable npm install scripts restrictions (e.g. --ignore-scripts) and registry allowlists in CI

### [critical] Malicious npm packages m98th, m98bet, 789bet, m98vip — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-packages-m98th-m98bet-789bet-m98vip-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub's advisory database published four critical malware advisories on 2026-10-29 for npm packages m98th, m98bet, 789bet, and m98vip, flagged under CWE-506 (Embedded Malicious Code). Every version of each package is affected and no patched versions exist, so the packages cannot be safely used at all. The advisories state that any computer with these packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. The package names suggest a gambling/brand-impersonation typosquat campaign. Reach appears low (m98vip shows ~17 downloads/month), but any developer or CI machine that installed them is at risk of secret and key theft. No fix exists; remediation is removal plus credential rotation and system rebuild.
Do: Remove m98th, m98bet, 789bet and m98vip from all machines, CI runners and lockfiles immediately; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected machines; removal of the package does not guarantee malware removal; Audit install logs and dependency trees for these packages and any related suspicious packages; Block these package names in npm registry proxies/internal mirrors and alert developers

### [critical] Node2Shell: Brotli decoder OOB write across Node.js, Python, Bun, .NET, Java, Envoy/Istio and Perl IO::Compress::Brotli enables RCE, memory disclosure or CPU pinning via crafted compressed streams (CVE-2026-111497)
https://helix.ml/threat-watch/i/io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe · Supply chain · partial · since 2026-10-23 · CVE-2026-111497, CVE-2026-115936
CVE-2026-111497 is an out-of-bounds write in the upstream Google Brotli C library decoder (1.0.3–1.2.0), dubbed Node2Shell. A crafted brotli stream confuses 'malformed' with 'need more input' in DecodeBlockTypeAndLength(), causing an unbounded copy into adjacent decoder state (memory disclosure, crash, potential RCE — Imperva demonstrated code execution on Node.js 24.22.0 ARM64) or an infinite loop pinning a CPU. Because most runtimes bundle the library, patching system libbrotli does not help. Fixes shipped 2026-10-21 onward for Node.js 22.23.4/24.22.1/26.12.1, Brotli 1.0.10/1.1.1/1.2.1, Python 1.2.1, Bun 1.4.4, brotli4j 1.24.0, .NET 8.0.33/9.0.22/10.0.14, Envoy and Istio branch fixes, and IO-Compress-Brotli 0.023; EOL Node.js lines remain unpatched. A public PoC appeared 2026-10-22; in-the-wild exploitation is confirmed and the CVE is on CISA's KEV. Both inbound (Express 5/body-parser 2.x accept br bodies) and outbound (fetch/axios/got auto-decode br) paths are exposed, and corruption is largely invisible to WAFs and monitoring.
Fixed: Brotli 1.0.10, 1.1.1, 1.2.1; Node.js 22.23.4, 24.22.1, 26.12.1; Python Brotli 1.2.1 / brotlicffi 1.2.1.0; Bun 1.4.4; brotli4j 1.24.0; .NET 8.0.33, 9.0.22, 10.0.14; Envoy 1.36.12, 1.37.8, 1.38.6, 1.39.3, 1.40.0; Istio 1.29.9, 1.30.6, 1.31.2; IO-Compress-Brotli 0.023
Do: Patch immediately: upgrade Node.js to 22.23.4/24.22.1/26.12.1, Python Brotli/brotlicffi to 1.2.1, Bun to 1.4.4 (rebuild bun build --compile binaries), brotli4j to 1.24.0, .NET to 8.0.33/9.0.22/10.0.14, Envoy/Istio to fixed branch releases, and IO-Compress-Brotli to 0.023; rebuild/redeploy dependent applications; Treat as actively exploited per CISA KEV; prioritize internet-facing services that decompress attacker-controlled brotli data, including parsers mounted before authentication; Audit both inbound and outbound paths: Express 5/body-parser 2.x accept br request bodies by default, and fetch/axios/got/node-fetch auto-decode br responses (e.g. webhooks, link previews, feed readers); If you cannot patch now, set inflate: false on Express 5/body-parser 2.x parsers or reject Content-Encoding: br at the reverse proxy — mitigations only, they do not cover the outbound path and may break legitimate clients; Do not trust process.versions.brotli (still reports 1.2.0 on patched Node.js 24.22.1); verify fixed process.version from official nodejs.org distributions; Monitor for unexplained CPU spikes or hung threads during brotli decoding; note corruption completes with HTTP 200 and no exception

### [critical] npm typosquat malware: bcxhdh1kjlopsde & cjlowuxbnexkhgpzq — full machine compromise on install
https://helix.ml/threat-watch/i/npm-typosquat-malware-bcxhdh1kjlopsde-cjlowuxbnexkhgpzq-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-29
GitHub added two malware advisories on 2026-10-29 for npm packages bcxhdh1kjlopsde (GHSA-v78q-7787-v9rq) and cjlowuxbnexkhgpzq (GHSA-pr23-gvcv-c422). Both are flagged CWE-506 embedded malicious code, with every version (>=0) affected and no patched versions available. GitHub's standard malware warning states any machine with the packages installed or running should be considered fully compromised, with attacker control implying secrets and keys must be rotated. One package shows ~51 downloads/month; the other's popularity is unstated. The packages have no known source code repositories, consistent with throwaway malicious publishes. Removal of the package alone is not guaranteed to remove the malicious software. No CVEs; no fix will be issued — remediation is removal plus host forensics and credential rotation.
Do: Remove bcxhdh1kjlopsde and cjlowuxbnexkhgpzq from all dependency manifests, lockfiles and caches; block them in registry proxies; Rotate all secrets, keys, tokens and credentials stored on any machine where the packages were installed, from a clean machine; Rebuild affected machines from trusted images; do not assume uninstalling the package removes the malware; Audit CI/CD runners and developer workstations for exposure and review npm install logs for these package names; Add these packages to denylists and alert on any future install attempts

### [critical] Tailwind npm malware wave: seven more malicious Tailwind/PostCSS animation packages fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/npm-malware-wave-tailwindcss-theme-kit-noelc-css-blender-tailwind-base-buttons-malicious-packages-fully-compromise-insta · Supply chain · no-fix-needed · since 2026-10-24
GitHub's advisory database published malware advisories between 2026-10-24 and 2026-10-29 covering seven npm packages: tailwindcss-theme-kit (GHSA-v5xr-xjx7-ggwf), noelc-css-blender (GHSA-cj2x-975v-jmwf), tailwind-base-buttons (GHSA-5j43-343m-gggg), tailwindcss-keyframe-kit (GHSA-282x-w96h-wv7f, ~902 downloads/month), tailwindcss-animate-catalog (GHSA-4mf5-57pc-vj85, ~869 downloads/month), tailwind-animationlab (GHSA-7cm4-74gj-gfp2, ~616 downloads/month) and tailwind-keyframes (GHSA-vh6h-8m24-j9mj, ~444 downloads/month). All versions (>= 0) are affected, no patched versions exist, and each is rated critical under CWE-506 (embedded malicious code). The advisories state any computer with these packages installed or running should be considered fully compromised, implying attacker control of the host and access to stored secrets and keys. Removal of the package does not guarantee removal of the malicious software. No common name or CVE is assigned; no known source code is available. Any developer or CI environment that installed these packages is affected.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine that installed these packages, using a clean computer; Remove the packages from all projects, lockfiles and CI caches, and audit for persistence mechanisms left behind; Rebuild or wipe affected developer machines and CI runners; review logs for outbound connections or exfiltration; Check dependency trees and lockfiles for the seven package names and block them in registry proxies/allowlists; Audit npm install history and monitor accounts for suspicious activity

### [high] GitHub Actions issue-injection supply chain campaign — 61 public repos (incl. Trivy, MLflow, Brave, LangExtract) hit via hidden HTML-comment payloads in issues/PRs to steal CI/CD credentials
https://helix.ml/threat-watch/i/github-actions-issue-injection-supply-chain-campaign-61-public-repos-incl-trivy-mlflow-brave-langextract-hit-via-hidden · Supply chain · no-fix-needed · since 2026-10-29
Radware researchers identified a coordinated campaign in which an attacker used 74 GitHub accounts (many likely compromised) to file issues, pull requests and comments containing malicious commands hidden in HTML comments across 61 popular public repositories, including Trivy, MLflow, Brave browser, Google LangExtract, ToolJet, Cilium and Podman. Most of the 83 payload items were posted within a 43-minute window on September 1, 2026. Repos with workflows triggered by these events that interpolate attacker-controlled content into shell code executed the hidden commands, which harvested environment variables and exfiltrated them to attacker servers; two runs showed evidence of execution. The goal was likely stealing repo credentials for a downstream supply-chain attack. Most affected repos were notified and fixed; researchers advise least-privilege workflows and treating external content as untrusted.
Do: Audit GitHub Actions workflows triggered by issues, pull requests or comments for injection of attacker-controlled content (issue titles/bodies, PR titles, comments) into shell commands; fix with proper quoting/intermediate variables; Apply least-privilege GITHUB_TOKEN permissions and restrict secrets/environment variables available to externally triggered workflows; Separate untrusted-event-triggered workflows from jobs with elevated permissions; Review CI logs since 2026-09-01 for signs of execution and credential exfiltration; rotate exposed tokens and secrets; Treat all external issue/PR content as untrusted in CI automation

### [critical] Dependency-confusion malware: @zmtcdn/components and @zmtcdn/ui npm packages exfiltrate host data via postinstall script
https://helix.ml/threat-watch/i/dependency-confusion-malware-zmtcdn-components-and-zmtcdn-ui-npm-packages-exfiltrate-host-data-via-postinstall-script · Supply chain · no-fix-needed · since 2026-10-29
Two dependency-confusion packages published by npm account kill_shs — @zmtcdn/components@9999.0.0 and @zmtcdn/ui@9999.0.0 and 9999.0.7 — contain empty index.js files described as 'Security research PoC' but run node postinstall.js on npm install. The postinstall script POSTs the hostname, username, platform, working directory and the names of all environment variables to attacker-controlled endpoints (webhook.site for @zmtcdn/components, www.hinny.shop/api for @zmtcdn/ui). Any developer or CI system that installs these packages leaks host metadata and environment variable names, which can guide follow-on attacks. Flagged by OpenSSF and published to the GitHub Advisory Database on 2026-10-29 as malware (CWE-506). No patched versions exist; the only fix is to never install these packages and remove them if present.
Do: Search lockfiles, CI caches and installed node_modules for @zmtcdn/components and @zmtcdn/ui and remove them; treat any machine that installed them as potentially compromised; Rotate secrets and review environment variables on affected build machines, since env var names were exfiltrated; Block the packages and the exfiltration endpoints (webhook.site/f52af355-4783-4acb-9de1-5e44b5963025, www.hinny.shop) at proxy/firewall level; Configure npm scoped-registry mappings and internal registry placeholders to prevent dependency confusion for internal @zmtcdn scope; Audit npm install logs and enable ignore-scripts or allowlisted postinstall policies in CI

### [critical] Dependency-confusion beacon packages: mw-communication-client, mw-test-utils, mui-wrapper-x-date-pickers exfiltrate user/host/cwd on install
https://helix.ml/threat-watch/i/dependency-confusion-beacon-packages-mw-communication-client-mw-test-utils-mui-wrapper-x-date-pickers-exfiltrate-user-ho · Supply chain · no-fix-needed · since 2026-10-29
On 2026-10-27 the npm account amahrou1w published three near-identical packages — mw-communication-client, mw-test-utils and mui-wrapper-x-date-pickers — within eight minutes, each a dependency-confusion candidate for internal packages of the same company. Each tarball contains only an empty index.js, README and package.json, but declares preinstall and postinstall scripts that send the installing user's name, hostname and working directory over plain HTTP to IP 38.242.235.206. The README claims it is a bug-bounty dependency-confusion proof of concept, and static analysis (OpenSSF) confirms nothing beyond the two beacons executes. Anyone whose dependency resolution pulls these versions (1.0.x/10.0.x chosen to win loose ranges) leaks machine details. No patched versions exist; the packages are flagged malware in the GitHub Advisory Database.
Do: Search lockfiles and dependency trees for mw-communication-client, mw-test-utils and mui-wrapper-x-date-pickers and remove them; Check proxy/egress logs for connections to 38.242.235.206 since 2026-10-27 and identify affected hosts and users; Pin internal package names in private registries and configure scope/registry mapping to block dependency confusion; Disable or audit install lifecycle scripts (npm config with ignore-scripts, --ignore-scripts in CI)

### [critical] spectral-net-probe (npm): malicious package exfiltrates local file contents via install-time and load-time callbacks
https://helix.ml/threat-watch/i/spectral-net-probe-npm-malicious-package-exfiltrates-local-file-contents-via-install-time-and-load-time-callbacks · Supply chain · no-fix-needed · since 2026-10-29
GitHub Advisory Database (via OpenSSF) reports malicious code in the npm package spectral-net-probe, which contains no functional code. Versions 1.0.1 and 1.0.4 run a postinstall script that beacons to Cloudflare quick tunnels; version 1.0.10 executes on package load, fetching instructions from http://154.57.164.64:30664 and http://127.0.0.1:3000, reading up to ten local files whose paths are returned in data.cargo_hold, and uploading the first 400 characters of each file to the same hosts. The package was published by npm account kristol07, which also published phantom-chartwinds and phantom-powder-keg the same day. No patched versions exist; affected users must remove the package and investigate for file exfiltration.
Do: Remove spectral-net-probe from all projects and lockfiles; block versions 1.0.1, 1.0.4 and 1.0.10; Audit systems where it was installed for exfiltration of local file contents; block network access to 154.57.164.64:30664 and the listed trycloudflare.com hosts; Check whether phantom-chartwinds or phantom-powder-keg are in dependency trees and remove them; Review npm install logs and CI caches for the package; rotate any secrets readable from files on affected machines

### [critical] Dependency-confusion beacon package identity-two-factor targets Coinbase on npm
https://helix.ml/threat-watch/i/dependency-confusion-beacon-package-identity-two-factor-targets-coinbase-on-npm · Supply chain · no-fix-needed · since 2026-10-29
OpenSSF reported a dependency-confusion package, identity-two-factor@999.0.0 on npm, explicitly aimed at Coinbase (README and postinstall.js reference it; beacon path 'cbhq-canary'). The package has no functional code; its postinstall script runs node postinstall.js on npm install, writes a marker file to the temp directory, and POSTs hostname, username, working-directory name, CI flag and Node version to a webhook.site endpoint. It was published by the npm account hologrammmm0x, which has no other packages. Any developer or CI environment that installs the package leaks host details to the attacker. GitHub advisory GHSA-2hrq-h3vj-5wxm (CWE-506, critical) lists affected version 999.0.0 with no patched versions; the package should be removed/uninstalled, not upgraded.
Do: Search dependency locks, caches and install logs for identity-two-factor@999.0.0 and remove it; treat any machine or CI runner that installed it as potentially probed; Check temp directories for the marker file and review egress/proxy logs for requests to webhook.site/e0981a8e-081e-49a0-8b4a-235109e13045/cbhq-canary; Block the webhook.site endpoint and audit internal package names for dependency-confusion exposure; reserve internal names on public registries; Enforce npm install scripts restrictions (e.g. --ignore-scripts, allowlists) and pin trusted registry sources in CI

### [critical] dsh-* npm malware campaign: dsh-vm-tester, dsh-redteam-mode and dsh-volcengine-provider fully compromise installed machines; rotate secrets (no CVE)
https://helix.ml/threat-watch/i/malware-in-dsh-vm-tester-npm-package-full-machine-compromise-rotate-secrets-no-cve · Supply chain · no-fix-needed · since 2026-10-27
GitHub's advisory database published malware advisories for three related npm packages: dsh-vm-tester (GHSA-84fw-gj66-p5v3, versions 0.1.2–0.1.4), dsh-redteam-mode (GHSA-r4m9-8735-g966, version 0.15.2, ~4,077 downloads/month) and dsh-volcengine-provider (GHSA-8hr2-m7vq-fhpg, versions 0.2.5 and 0.2.8, ~1,860 downloads/month). All contain embedded malicious code (CWE-506) and GitHub states any computer with a package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No fixed versions exist and none of the packages have known source code, so removal is the only option and does not guarantee the machine is clean. Any developer or CI environment that installed any of these packages is affected; secrets and keys on those machines should be treated as stolen.
Do: Immediately rotate all secrets, keys, tokens and credentials stored on any machine where dsh-vm-tester, dsh-redteam-mode or dsh-volcengine-provider was installed, using a clean machine; Remove dsh-vm-tester, dsh-redteam-mode and dsh-volcengine-provider from all systems, dependencies and lockfiles; Rebuild or wipe affected machines; do not assume removal fully cleans them; Audit for signs of compromise and review CI/CD pipelines that may have run the packages; Block all three packages in internal registries and dependency scanning

### [medium] Searchjacked: 319 malicious Chrome extensions hijack searches of 13.4M users, monetize via Yahoo/Bing referral fraud
https://helix.ml/threat-watch/i/searchjacked-319-malicious-chrome-extensions-hijack-searches-of-13-4m-users-monetize-via-yahoo-bing-referral-fraud · Supply chain · no-fix-needed · since 2026-10-29
Socket researchers identified 319 Chrome browser extensions, installed by roughly 13.4 million users, whose sole purpose is to hijack the browser's default search engine. Using only the chrome_settings_overrides manifest key, the extensions route all search queries through operator-controlled proxy servers, capture complete search histories tied to unique identifiers, and collect referral payments from Yahoo and Bing syndication programs (hspart/hsimp and PC/PTAG partner IDs). The extensions are deliberately hidden from Chrome Web Store indexing and promoted via paid advertising, with new domains and lures appearing quickly after takedowns; the technique has run continuously for about a decade. Because the operator controls per-request redirects, searches could selectively be sent to phishing or malware pages. No CVE applies; mitigation is removal of the extensions and blocking associated domains.
Do: Audit managed and user browsers for extensions matching search-hijacker names/brands and remove them; Reset default search provider settings and clear associated identifiers; Block known hijacker search/proxy domains at the network perimeter; Restrict Chrome Web Store extension installs via enterprise allowlists; Monitor for extensions requesting chrome_settings_overrides search-provider changes

### [high] Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)
https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570 · Supply chain · patched · since 2026-10-22 · CVE-2026-111943, CVE-2026-113470, CVE-2026-115557, CVE-2026-115570
A set of eMudhra intermediate CA certificates was compromised and is being blocked by browsers and other TLS clients. Electron releases before the patched versions did not block these intermediates in either Chromium networking or Node.js tls/https/fetch, so an attacker holding a certificate issued via the compromised intermediates and able to intercept network traffic (e.g. on-path/MitM) could impersonate a TLS server to an Electron app. Only apps making TLS network connections are affected; offline apps are not. Go (CVE-2026-111943) and Firefox (CVE-2026-113470) shipped the same mitigation. There are no app-side workarounds; fixed releases are 45.0.0-beta.6, 44.9.1, 43.8.1 and 42.11.16, published 2026-10-22/23.
Fixed: 45.0.0-beta.6; 44.9.1; 43.8.1; 42.11.16
Do: Upgrade Electron to 45.0.0-beta.6, 44.9.1, 43.8.1 or 42.11.16 (or later) and rebuild/redistribute apps, prioritising apps that make TLS connections over untrusted networks; Audit which Electron apps in your estate make network connections and prioritise those handling sensitive data; Verify no pinned or custom certificate logic bypasses the new block; confirm updated builds ship the mitigation in both Chromium and Node.js TLS paths; Monitor for any further eMudhra-related revocations or advisories affecting other TLS clients in your stack

### [critical] b20miner npm package: malicious cryptominer backdoor fully compromises installed hosts (no CVE)
https://helix.ml/threat-watch/i/b20miner-npm-package-malicious-cryptominer-backdoor-fully-compromises-installed-hosts-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub's malware advisory database published GHSA-fw7x-6chc-4244 on 2026-10-28 flagging npm package b20miner version 0.3.1 as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected hosts are at risk and must be rotated from a clean machine. No patched version exists; the package has no known source code repository. Removal of the package alone cannot be guaranteed to remove all malicious software it deployed. Affected users are any developers or CI systems that installed b20miner 0.3.1.
Do: Treat any host with b20miner 0.3.1 installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected hosts, from a clean machine; Remove the package and rebuild/reimage affected systems; do not assume removal is sufficient; Audit install logs, CI caches, and lockfiles for b20miner and block the package in registries/proxies; Review for persistence mechanisms and unauthorized access following compromise

### [high] GhostAction: GitHub supply-chain campaign steals developer secrets and pivots to cloud access
https://helix.ml/threat-watch/i/ghostaction-github-supply-chain-campaign-steals-developer-secrets-and-pivots-to-cloud-access · Supply chain · no-fix-needed · since 2026-10-28
The GhostAction campaign, a supply-chain attack wave targeting GitHub, saw attackers compromise repositories and inject malicious workflows to steal developer secrets such as CI/CD credentials. While the initial hacking wave largely fizzled, researchers warn the attackers remain active on GitHub and have shifted focus toward developer endpoints and cloud access, signaling an evolution in tactics. Affected parties are open-source projects and organisations whose repositories or developer machines were compromised, with stolen credentials potentially granting access to cloud infrastructure. There is no vendor patch; mitigation relies on credential rotation, secret scanning, and workflow hardening. Organisations should audit GitHub Actions workflows, rotate exposed secrets, and monitor cloud environments for anomalous access.
Do: Rotate all GitHub tokens, CI/CD secrets, and cloud credentials that may have been exposed; Audit GitHub Actions workflows and repository commit history for unauthorised changes; Review cloud access logs for anomalous use of stolen credentials; Enable GitHub secret scanning and push protection; Harden developer endpoints and enforce MFA on GitHub and cloud accounts

### [critical] @zaip-ai/cli npm package is malware — full machine compromise, no patched versions (GHSA-ffq4-h5jm-8pqr)
https://helix.ml/threat-watch/i/zaip-ai-cli-npm-package-is-malware-full-machine-compromise-no-patched-versions-ghsa-ffq4-h5jm-8pqr · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published GHSA-ffq4-h5jm-8pqr on 2026-10-28 flagging the npm package @zaip-ai/cli as embedded malicious code (CWE-506). Affected versions are 6.4.0, 6.5.0 and 7.0.0 through 7.4.0; no patched versions exist and the package has no known source code. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package reportedly sees ~5,244 downloads per month, so any developer or CI environment that installed it is at risk of secret and credential theft. Removal of the package does not guarantee removal of all malicious software it may have deployed. There is no fix; remediation is incident response, not upgrading.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine that installed or ran @zaip-ai/cli, doing so from a clean computer; Isolate and rebuild any affected machines or CI runners from trusted images; do not trust removal of the package alone; Audit systems for persistence, unexpected processes and outbound connections indicating attacker access; Check dependency lockfiles and install history to determine exposure scope and block/reinstall from a clean state; Harden CI/CD and developer endpoints against npm supply-chain installs (allowlists, provenance checks)

### [critical] itsa-utils / itsa-react-checkbox npm packages trojanized with malware (no CVE)
https://helix.ml/threat-watch/i/itsa-utils-itsa-react-checkbox-npm-packages-trojanized-with-malware-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published malware advisories on 2026-10-28 for two npm packages from the itsa ecosystem: itsa-utils version 1.4.2 and itsa-react-checkbox version 16.0.5, both flagged as embedded malicious code (CWE-506). Any machine with these packages installed or running should be considered fully compromised, with attacker control of the host implying potential theft of secrets, keys, and credentials. No patched versions exist; the packages have no known source code for remediation. itsa-utils has roughly 2,735 weekly downloads and 32 dependent repositories, so downstream projects may be exposed transitively. Removal of the packages alone cannot guarantee removal of all malicious software deployed during compromise.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine that installed these packages, using a clean machine; Remove itsa-utils@1.4.2 and itsa-react-checkbox@16.0.5 from all projects and lockfiles, pinning to known-clean versions; Rebuild/reimage affected machines and audit for persistence mechanisms, as removal may not eliminate implanted malware; Check transitive dependencies (32 dependent repos for itsa-utils) and audit CI/CD systems for exposure; Block these package versions in registries/proxies and monitor for related itsa packages being trojanized

### [critical] Malicious npm package dsh-plugin-blender-3d — full machine compromise for installers (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-dsh-plugin-blender-3d-full-machine-compromise-for-installers-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub's malware advisory database published GHSA-hw9g-f63g-4c8x on 2026-10-28 flagging the npm package dsh-plugin-blender-3d version 0.2.1 as embedded malicious code (CWE-506). Any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. There is no patched version and no known source code; the only remediation is removal, which may not eliminate all malicious software. Roughly 163 downloads per month are recorded. Anyone who installed version 0.2.1 should treat secrets and keys on the affected machine as stolen and rotate them from a clean computer.
Do: Rotate all secrets, keys, and credentials stored on any machine that installed the package, using a different clean computer; Remove dsh-plugin-blender-3d 0.2.1 from all systems and CI environments; Rebuild or reimage affected machines; removal may not eliminate all malicious software; Audit npm lockfiles and dependency trees for the package and block it in registries/proxies; Review logs and network traffic for signs of attacker access following installation

### [critical] @walknpm/todo-cli npm package is malware — full machine compromise for installers of v2.0.1 (no CVE)
https://helix.ml/threat-watch/i/walknpm-todo-cli-npm-package-is-malware-full-machine-compromise-for-installers-of-v2-0-1-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published a malware advisory (GHSA-p6gj-69gx-r376) for the npm package @walknpm/todo-cli, version 2.0.1, classified under CWE-506 (embedded malicious code). GitHub states any computer with the package installed or running should be considered fully compromised, implying attacker-controlled code execution and potential theft of secrets and keys; no patched version exists and the package has no known source code. The package sees roughly 551 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software, since full control of the machine may have been handed to an outside entity. Affected users must rotate all secrets from a clean machine and rebuild/reimage compromised systems.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a different, clean computer; Remove @walknpm/todo-cli@2.0.1 from all projects and lockfiles; Reimage or fully rebuild affected machines; do not assume removal of the package eliminates the malware; Audit systems for signs of compromise and unexpected outbound connections; Block/flag the package in internal registries and CI to prevent reinstalls

### [critical] my-empty-package (npm): malicious package compromises machines that install it
https://helix.ml/threat-watch/i/my-empty-package-npm-malicious-package-compromises-machines-that-install-it · Supply chain · no-fix-needed · since 2026-10-28
GitHub's malware advisory database flagged the npm package my-empty-package version 1.0.0 as embedded malicious code (CWE-506). Any machine where the package is installed or running should be considered fully compromised, with attackers potentially gaining full control and access to secrets and keys. No patched version exists; the advisory recommends removal but warns removal may not eliminate all malicious software. The package sees roughly 189 downloads per month, so exposure is limited but real. Users who installed it should rotate all secrets from a clean machine and rebuild compromised systems.
Do: Remove my-empty-package from all projects and machines; Rotate all secrets, keys, and credentials stored on affected machines, using a different clean computer; Rebuild or reimage affected machines, as removal may not eliminate all malicious software; Audit dependency trees and CI environments for the package; Block the package in internal registries and dependency review

### [critical] Malicious npm package transaction-info-generate-sdk — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-transaction-info-generate-sdk-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub published a malware advisory (GHSA-23j5-jj88-v9f3) for the npm package transaction-info-generate-sdk, which contains embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity; secrets and keys stored on the machine are at risk. The package sees roughly 482 downloads per month. Removal of the package alone cannot guarantee removal of all malicious software it may have installed. There is no fix; remediation is removal plus credential rotation and system rebuild.
Do: Immediately remove transaction-info-generate-sdk from all projects and machines; Rotate all secrets, keys, and credentials stored on affected machines, using a clean computer; Rebuild/reimage affected systems; do not assume removal of the package removes the malware; Audit systems and CI for signs of compromise and unexpected persistence; Block the package in dependency policies and scan lockfiles for it

### [critical] Malicious npm package mock-transactions-sdk — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-mock-transactions-sdk-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-28
GitHub's malware advisory database published GHSA-357r-x5jp-3p8f flagging the npm package mock-transactions-sdk as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and no patched version exists, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with full control potentially handed to an outside entity, enabling theft of secrets and keys and persistence beyond simple package removal. The package sees roughly 631 downloads per month. There is no fix; remediation is removal plus credential rotation and system rebuild.
Do: Remove mock-transactions-sdk from all systems and dependencies immediately; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit dependency lockfiles and CI caches for the package and block it in registries/proxies; Review logs for signs of exfiltration or attacker access

### [critical] camelotlabs npm packages (core, config, sdk, worker) published as malware — full machine compromise
https://helix.ml/threat-watch/i/camelotlabs-npm-packages-core-config-sdk-worker-published-as-malware-full-machine-compromise · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published four malware advisories on 2026-10-28 covering the npm packages camelotlabs-core, camelotlabs-config, camelotlabs-sdk and camelotlabs-worker. Every published version (>= 0) is flagged as embedded malicious code (CWE-506) with no patched versions, meaning the packages were malicious from the start rather than hijacked later. GitHub's standard malware guidance states that any computer with these packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. Downloads of roughly 250-258/month on some packages indicate limited but real exposure. No CVEs are assigned; remediation is removal plus credential rotation and host rebuild.
Do: Remove all four camelotlabs-* packages from every machine and CI/CD environment immediately; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected hosts; removal of the package does not guarantee removal of malicious software; Audit logs and network traffic for signs of exfiltration or attacker access since installation; Block the packages in dependency policies and check lockfiles for transitive dependencies

### [critical] @atlisp/mcp npm package 1.12.14 is malware — full machine compromise, rotate all secrets
https://helix.ml/threat-watch/i/atlisp-mcp-npm-package-1-12-14-is-malware-full-machine-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-10-28
GitHub's advisory database published a malware advisory for the npm package @atlisp/mcp, flagging version 1.12.14 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines are at risk and must be rotated from a clean computer. No patched version exists; the package should be removed, but removal does not guarantee elimination of all malicious software it may have installed. The advisory was published, reviewed, and last updated on 2026-10-28. The package sees roughly 2,337 downloads per month, so exposure is limited but real.
Do: Immediately rotate all secrets, keys, and credentials stored on any machine where @atlisp/mcp 1.12.14 was installed, using a different, uncompromised computer; Remove the package and audit affected machines for persistence mechanisms, as removal may not eliminate all malicious software; Check dependency lockfiles and CI/CD environments for the package and rebuild from clean images; Block @atlisp/mcp in npm installs and internal registries; Review logs for signs of exfiltration or unauthorized access

### [critical] glyphmatrix-fixture (npm): malicious package versions 1.0.0 and 1.0.1 fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/glyphmatrix-fixture-npm-malicious-package-versions-1-0-0-and-1-0-1-fully-compromise-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-28
GitHub published advisory GHSA-vc33-3x34-x6jm on 2026-10-28 flagging the npm package glyphmatrix-fixture as malware (CWE-506, embedded malicious code). Versions 1.0.0 and 1.0.1 are affected and there are no patched versions; the advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines should be treated as stolen. The package has no known source code repository. Removal of the package alone is not guaranteed to eliminate malicious software installed by it. Any developer or CI environment that installed these versions is affected.
Do: Rotate all secrets, keys, and credentials stored on or accessible from machines where glyphmatrix-fixture was installed, using a clean computer; Remove glyphmatrix-fixture from all projects, lockfiles, and CI caches and rebuild affected environments from trusted images; Audit affected machines for persistence and other malicious software; reimage if compromise is suspected; Check dependency histories and CI logs for any installation of the package; Block the package name in internal registries and dependency firewalls

### [critical] trajmetrics PyPI malware: system-wide file scanning and exfiltration via background job
https://helix.ml/threat-watch/i/trajmetrics-pypi-malware-system-wide-file-scanning-and-exfiltration-via-background-job · Supply chain · no-fix-needed · since 2026-10-28
The PyPI package trajmetrics version 0.5.3 has been identified as malicious code (GHSA-rm9p-x4m7-hxmp, MAL-2026-18354). When run as a module, it scans the entire system and exfiltrates selected files by type; following the README's instructions starts a persistent background job that continuously monitors the system and exfiltrates files as they change. The campaign, tracked as 2026-10-trajmetrics, uses a native extension and is classified as an infostealer with clear malicious intent (CWE-506). No patched versions exist — the package itself is malware and should be removed. Anyone who installed trajmetrics 0.5.3 should treat exfiltrated files as compromised.
Do: Remove trajmetrics 0.5.3 from all environments and purge caches/virtualenvs; Audit systems where it ran for exfiltrated sensitive files (documents, credentials, keys) and rotate exposed secrets; Check for and kill any persistent background jobs or scheduled tasks it installed; Review logs and network egress for signs of exfiltration; Block the package and its referenced repositories in dependency policies

### [critical] Dependency-confusion beacon: @webapp-shared/login-vmok (npm) exfiltrates hostname and paths on install
https://helix.ml/threat-watch/i/dependency-confusion-beacon-webapp-shared-login-vmok-npm-exfiltrates-hostname-and-paths-on-install · Supply chain · no-fix-needed · since 2026-10-28
A dependency-confusion package, @webapp-shared/login-vmok, was published to npm on 2026-10-27 in versions 1.0.0, 1.0.1, 1.1.0, 2.0.1, 3.0.0 and 99.0.1, squatting on a private internal scope so builds resolving the internal name from the public registry install the malicious copy. Its postinstall script runs node beacon.cjs, which POSTs the package name, machine hostname, install directory, working directory and Node.js version in cleartext to http://13.140.137.222:8787/_ah/dc; index.js repeats the beacon on load and the package has no other functionality. The beacon code matches other dependency-confusion packages sending to 185.158.107.175:8787 (e.g. MAL-2026-18276). Inert placeholder versions 0.0.0-stage and 0.1.0 are unaffected. Any machine that installed an affected version has disclosed its hostname and filesystem layout to a third party; there are no patched versions — removal and registry scoping are the remediation.
Do: Remove @webapp-shared/login-vmok from all projects and lockfiles; audit installs since 2026-10-27; Block 13.140.137.222 (and 185.158.107.175) on build hosts and check egress/proxy logs for POSTs to :8787/_ah/dc; Treat affected build machines' hostname and directory layout as disclosed; review for follow-on targeting; Pin internal-scoped packages to the internal registry or claim/reserve the @webapp-shared scope to prevent confusion; Enforce install-script allowlists and dependency-confusion protections (e.g. --no-postinstall policies, registry scoping) in CI

### [critical] csvflow-schema (npm): malicious postinstall beacon package removed from registry
https://helix.ml/threat-watch/i/csvflow-schema-npm-malicious-postinstall-beacon-package-removed-from-registry · Supply chain · no-fix-needed · since 2026-10-28
The npm package csvflow-schema, published as version 1.0.0 on 2026-10-26 by account f0x_mulder, contained malicious code flagged by OpenSSF and recorded in the GitHub Advisory Database (GHSA-mhx4-6f72-5vf7, CWE-506). While posing as a lightweight CSV column-schema validation helper, its postinstall script ran on npm install, wrote host details (username, hostname, working directory, parent PID, install path) to a marker file in the temp directory, launched calc.exe, and sent an HTTPS GET install beacon to cdn-status.mulderitsme.net. Only version 1.0.0 is affected; npm removed the package 17 minutes after publication. There is no patched version — anyone who installed it should treat the machine as compromised.
Do: Check lockfiles and installed node_modules for csvflow-schema@1.0.0 and remove it; If installed, rebuild/reimage the affected machine and rotate credentials accessible from it; Inspect temp directory for csvflow_schema/pi_2c75177b.ok and review network logs for cdn-status.mulderitsme.net; Block the beacon domain cdn-status.mulderitsme.net at egress; Audit recent npm installs and CI caches for the package

### [critical] Shai-Hulud worm wave 2: @testsecuiitytestme/cache-helper npm package — malicious native-addon loader steals credentials (no CVE)
https://helix.ml/threat-watch/i/shai-hulud-worm-wave-2-testsecuiitytestme-cache-helper-npm-package-malicious-native-addon-loader-steals-credentials-no-c · Supply chain · no-fix-needed · since 2026-10-28
A malicious npm package, @testsecuiitytestme/cache-helper, published 2026-10-27 under the account testsecuiitytestme, ships versions 1.0.1–1.0.3 containing a native-addon loader matching the second wave of the Shai-Hulud npm worm. The postinstall-loaded ELF/PE addon evades CI, sandbox, container and debugger environments, then decodes an embedded .napi_cache payload (XOR, brotli) and runs it via the Bun runtime (downloaded if absent). The obfuscated payload collects npm, GitHub, GitLab, PyPI, RubyGems, JFrog, Docker Hub, GHCR, AWS, GCP, Azure, Vault and Kubernetes credentials, plus SSH keys, .env files, browser logins, macOS keychain, 1Password and Bitwarden, and propagates via npm/PyPI/RubyGems publishing, CI workflow injection and AI assistant config writes. No patched versions exist; the package should be considered fully malicious.
Do: Remove and deny-list @testsecuiitytestme/cache-helper versions 1.0.1–1.0.3 from all environments and lockfiles; Audit machines that installed it for the detached loader/Bun processes and hidden temp files; Rotate all credentials accessible from affected machines: npm, GitHub, GitLab, PyPI, RubyGems, cloud (AWS/GCP/Azure), Vault, Kubernetes, Docker Hub, GHCR; Check for tampering with GitHub/GitLab CI workflows, composite actions and AI assistant configs (.claude/settings.json, .cursor rules, .mcp.json, CLAUDE.md); Review browser login databases, SSH keys, .env files and password-manager exposure; invalidate sessions and tokens

### [critical] Malicious npm package ccl-global-shopping — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-ccl-global-shopping-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-10-20
The npm package ccl-global-shopping was published with a malicious 99.9.1 on 2026-10-20 and was flagged by GitHub on 2026-10-27. Its only registry history is that version, so it reads as a squatted name, not a takeover. OSV's amazon-inspector analysis says its sole dependency is a bare HTTPS tarball URL on a Google Cloud Storage host rather than a registry range. npm therefore fetches whatever the URL serves at install time and runs its lifecycle scripts, which means the payload runs during install. OpenSSF Package Analysis separately flagged 99.9.1 for communicating with a malicious domain. npm replaced the name with a security placeholder on 2026-10-27. No safe version exists. Any host that ran npm install on it should be treated as compromised, and secrets on it rotated from a clean machine.
Do: Treat every machine where ccl-global-shopping was installed as fully compromised; rebuild from a clean image and rotate all secrets from a different computer; Remove the package from projects, lockfiles and CI; search lockfiles for the name and for bare HTTPS tarball dependency specs (the pattern OSV describes, with host ltidi.storage.googleapis.com); Block the name and that tarball host in the internal proxy and dependency scanning; Review install logs from 2026-10-20 onward for npm lifecycle scripts that ran for this package

### [critical] sc-announcer (npm) 99.9.1: stub fetches off-registry tarball on install; full compromise, no safe version
https://helix.ml/threat-watch/i/malware-in-sc-announcer-npm-package-full-system-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-10-20
sc-announcer is a name-impersonation or dependency-confusion stub, not a hijack. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. That version ships an empty module and one dependency, ltidisafe, declared as a raw HTTPS tarball on storage.googleapis.com (path depenconf) instead of a registry range. npm therefore installs whatever that URL serves, with no pin or integrity check, and runs any install scripts in it. OSV record MAL-2026-18064 (sources: OpenSSF Package Analysis and Amazon Inspector) calls the version number implausibly high, reads the stub as a resolution-hijack lure for an internal name, and says the package contacts a domain tied to malicious activity. GitHub's advisory GHSA-fxw2-4j5q-6hwg rates it critical and says any host that installed or ran it should be treated as fully compromised, with secrets rotated from a clean machine. npm replaced the package with its own security placeholder on 2026-10-27, so the malicious version was public for about a week before the advisory. No patched version exists. Last-month downloads to 2026-10-26 were 312.
Do: Search lockfiles, CI logs and node_modules for sc-announcer and for any dependency whose version is an https:// tarball on ltidi.storage.googleapis.com (ltidisafe is the payload dependency); Treat any host or CI runner that installed or ran sc-announcer as fully compromised: rotate every secret it could read from a clean machine, then rebuild from a trusted image rather than trusting uninstall; Block sc-announcer and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency allowlists; Review build and developer host logs for outbound connections in the window from 2026-10-20 onward; Ask any internal team that owns a package with a similar name to confirm their internal registry scope is reserved, since the advisory describes this as a dependency-confusion shape

### [critical] paychex-pdftron (npm): impersonation stub pulls an unpinned remote tarball on install; no safe version
https://helix.ml/threat-watch/i/paychex-pdftron-npm-package-is-malware-full-machine-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-10-20
paychex-pdftron is not a hijacked release and not a copy of a real product; it is a name-impersonation package. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. That version ships an empty module and one dependency, ltidisafe, declared as a raw HTTPS tarball on a storage.googleapis.com bucket path named depenconf instead of a registry version range. npm therefore fetches whatever that bucket serves, with no pin or integrity hash, and any install scripts inside it run on the installing machine. The OSV record MAL-2026-18289 (sourced from Amazon Inspector) reads the implausibly high version and the URL path as a dependency-confusion pattern. GitHub's malware advisory GHSA-9mgv-25w8-jwhf rates it critical and says any host where it was installed or run should be treated as fully compromised, with secrets rotated from a clean machine. npm removed the malicious version and replaced the package name with its own security placeholder on 2026-10-27. No patched version exists. The public PDFTron package on npm is @pdftron/webviewer, maintained by pdftron-dev, so the lookalike name is not a legitimate source. Last-month downloads to 2026-10-26 were 165.
Do: Search lockfiles, CI logs and node_modules for paychex-pdftron and for any dependency whose version is an https:// tarball URL on ltidi.storage.googleapis.com (ltidisafe is the known payload dependency); Treat any host or CI runner that installed paychex-pdftron as fully compromised: rotate every secret it could read from a clean machine, then rebuild or reimage it rather than trusting uninstall; Block paychex-pdftron and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency firewalls; Check install logs for outbound connections to storage.googleapis.com from build hosts in the window after 2026-10-20; Before adopting any replacement, confirm the publisher on the registry page; do not pick a package by name similarity

### [critical] @camera.ui/camera-ui-nvr-windows-amd64 1.6.1: malicious release in a real package line; full host compromise
https://helix.ml/threat-watch/i/malicious-npm-package-camera-ui-camera-ui-nvr-windows-amd64-1-6-1-fully-compromises-hosts · Supply chain · no-fix-needed · since 2026-10-25
This is most likely a malicious release inside a real package, not a typosquat. The @camera.ui/camera-ui-nvr-windows-amd64 package is owned by npm maintainer seydx, who also owns the camera.ui project on npm (created 2021-10-30; repository github.com/cameraui/camera.ui). The scoped package has 56 published versions dating from 2026-06-22. The advisory GHSA-2w7v-jwxh-w7wc and OSV record MAL-2026-18337 name only version 1.6.1 as malicious. The registry time map dates 1.6.1 to 2026-10-25, and it is no longer listed. No source we could read says how the release was published (account takeover, stolen token or a compromised pipeline), so that is unknown. GitHub rates it critical and says any host where it was installed or run should be considered fully compromised, with secrets rotated from a clean machine. Version 1.6.2 was published 2026-10-27 and is now the latest tag. No source we could read says 1.6.2 is safe, so it must not be treated as a verified fix. Last-month downloads to 2026-10-26 were 908.
Do: Treat any Windows host that installed or ran @camera.ui/camera-ui-nvr-windows-amd64 1.6.1 as fully compromised: isolate it, then rotate secrets from a different clean computer; Rebuild or reimage affected hosts rather than trusting removal; the advisory says removal does not prove the malware is gone; Do not install 1.6.2 or any later version until its publisher and contents are verified against the upstream project; no source confirms it is safe; Pin the scope to a version you have verified, and block 1.6.1 in registry proxies and CI; Check install logs and persistence on NVR and camera.ui hosts for outside access in the window from 2026-10-25

### [critical] sc-hydrate-carousel-price (npm) 99.9.1: stub fetches an off-registry tarball on install; no safe version
https://helix.ml/threat-watch/i/malicious-npm-package-sc-hydrate-carousel-price-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-10-20
sc-hydrate-carousel-price is a name-impersonation or dependency-confusion stub, not a hijack. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. Its shipped index file is an empty export, and its one dependency, ltidisafe 4.0.3, is declared as a raw HTTPS tarball on storage.googleapis.com (path depenconf) rather than a registry range. npm therefore installs whatever bytes that URL serves, with no pin or integrity check, and runs any lifecycle scripts inside them. OSV record MAL-2026-18291, published 2026-10-25 from an Amazon Inspector import, describes the package as a loader for externally hosted code and reads the version and name as a dependency-confusion shape. GitHub's advisory GHSA-9gcx-88qx-rxch rates it critical, with all versions affected and no patched version, and says any host that installed or ran it should be considered fully compromised, with secrets rotated from a clean machine. npm replaced the package with its own security placeholder on 2026-10-27. Last-month downloads to 2026-10-26 were 170.
Do: Search lockfiles, CI logs and node_modules for sc-hydrate-carousel-price and for any dependency whose version is an https:// tarball on ltidi.storage.googleapis.com (ltidisafe is the payload dependency); Treat any host or CI runner that installed or ran the package as fully compromised: rotate every secret it could read from a clean machine, then rebuild from a trusted image rather than trusting uninstall; Block the package and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency allowlists; Review build and developer host logs for outbound connections in the window from 2026-10-20 onward; Confirm that internal package names are reserved in your private registry scope, since the OSV record reads this as a dependency-confusion attempt

### [critical] h13t0ry-hello-demo (PyPI): malicious package spawns reverse shell on import, giving attackers full command execution
https://helix.ml/threat-watch/i/h13t0ry-hello-demo-pypi-malicious-package-spawns-reverse-shell-on-import-giving-attackers-full-command-execution · Supply chain · no-fix-needed · since 2026-10-27
The PyPI package h13t0ry-hello-demo version 0.1.0 contains malicious code that launches a reverse shell when the package is imported, allowing an attacker to execute arbitrary commands on the victim's machine. It was identified by researcher kam193 and documented in the OpenSSF malicious-packages database (MAL-2026-18336) and GitHub Advisory Database (GHSA-5crq-52j9-fc74) on 2026-10-27 as part of the 2026-10-h13t0ry-hello-demo campaign. There is no patched version; the package is malware and should be removed entirely. Any developer or CI environment that installed or imported the package should be treated as compromised.
Do: Remove h13t0ry-hello-demo from all environments and dependency files; do not upgrade, delete it; Audit machines and CI runners that imported the package for compromise and rotate credentials/secrets accessible there; Check dependency caches, lockfiles, and build artifacts for the package; Block the package name in internal PyPI mirrors/proxies and monitor for similar typosquat-style packages

### [critical] adyen-web-v6 (npm): lookalike of Adyen's checkout SDK ships malware; full machine compromise
https://helix.ml/threat-watch/i/adyen-web-v6-npm-package-is-malware-full-machine-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-10-27
adyen-web-v6 is an unscoped name lookalike of Adyen's real SDK, which is published on npm as @adyen/adyen-web and maintained by Adyen (registry maintainers include adyencom; latest 6.47.0, modified 2026-10-15). It is not a hijack of Adyen's package. The registry now holds only npm's security placeholder (0.0.1-security, 2026-10-27), and its history lists one earlier version, 99.1.0, dated 2026-04-27. No source we could read confirms that 99.1.0 was the malicious release. GitHub's malware advisory GHSA-r77r-rw3m-rjh5 classifies the package as embedded malicious code (CWE-506). It says any host where the package was installed or run should be considered fully compromised, with secrets rotated from a different machine. OSV's MAL-2026-18344 does not list specific versions, so the all-versions range is the only scope source. No patched version exists, and the fix is removal, host rebuild and credential rotation. Last-month downloads to 2026-10-26 were 34.
Do: Search lockfiles, CI logs and node_modules for adyen-web-v6; remove it from every project; Treat any host or CI runner that installed adyen-web-v6 as fully compromised: rotate every secret it could read from a clean machine, then rebuild or reimage rather than trusting uninstall; Confirm your checkout code imports @adyen/adyen-web (the real package), not adyen-web-v6, and pin it to a version you have verified; Block adyen-web-v6 in registry proxies and dependency firewalls; Review logs for outbound traffic from build and developer hosts that had the package installed

### [critical] 2026-10-numprint: PyPI package numprint — malicious install-time RAT executing attacker commands via GitHub Gist C2
https://helix.ml/threat-watch/i/2026-10-numprint-pypi-package-numprint-malicious-install-time-rat-executing-attacker-commands-via-github-gist-c2 · Supply chain · no-fix-needed · since 2026-10-27
The PyPI package numprint version 1.2.0 was identified as malware in the 2026-10-numprint campaign. The package overrides the install command in setup.py to execute malicious code during installation, starting a background process that executes attacker-provided commands. C2 communication occurs through a GitHub Gist. The package contains RAT-like functionality to run remote commands (likely a limited set) on victims' machines. Anyone who installed numprint 1.2.0 from PyPI is affected. There are no patched versions; the package is malware and should not be used. Identified by kam193 and catalogued via OpenSSF malicious-packages (MAL-2026-18343) and GitHub Advisory GHSA-g9fj-q87h-6h4c.
Do: Immediately uninstall numprint 1.2.0 from all environments; Audit systems where numprint was installed for compromise, persistence, and C2 traffic to GitHub Gist endpoints; Rotate credentials and secrets on affected machines; Block/remove the package from internal PyPI mirrors and dependency allowlists; Review CI/CD and developer workstations for install-time execution of this package

### [high] Malicious Firefox wallet impersonators (Phantom/Jupiter/Bitget) — steal recovery phrases and private keys via bonto[.]io C2
https://helix.ml/threat-watch/i/malicious-firefox-wallet-impersonators-phantom-jupiter-bitget-steal-recovery-phrases-and-private-keys-via-bonto-io-c2 · Supply chain · no-fix-needed · since 2026-10-27
Socket's Threat Research Team identified malicious Firefox extensions impersonating Phantom, Jupiter, and Bitget crypto wallets using Unicode homoglyph names and genuine branding. The signed packages contain always-on stealers that exfiltrate recovery phrases and private keys to brand-named subdomains of bonto[.]io (at least five provisioned, including coinbase and exodus). The Phantom impersonator additionally bundles a loader that fetches a second-stage stealer from phantom[.]bonto[.]io/config and executes it in the main world of every page, allowing payload swapping after review. All three listings were live on Firefox Add-ons during analysis and removed as of publication. Users who installed the extensions and entered wallet secrets are affected; no CVE applies.
Do: Remove any of these extensions from Firefox immediately and treat all crypto wallet secrets entered while installed as compromised; Transfer affected wallet funds to new wallets with fresh recovery phrases and rotate private keys; Audit installed Firefox extensions for homoglyph-named wallet impersonators and review extension permissions; Block bonto[.]io and its subdomains at network egress; Monitor for drainer-related transactions from affected wallets

### [critical] MLflow third-party scorer deserialization RCE — unauthenticated code execution on MLflow servers (CVE-2026-116692)
https://helix.ml/threat-watch/i/mlflow-third-party-scorer-deserialization-rce-unauthenticated-code-execution-on-mlflow-servers-cve-2026-116692 · Supply chain · patched · since 2026-10-27 · CVE-2026-116692
MLflow 3.12.0 introduced deserialization of third-party scorers that imports a request-controlled Python module under one of four allowed package prefixes (mlflow.genai.scorers.ragas/deepeval/trulens/phoenix) and instantiates a request-controlled class. An unauthenticated HTTP caller can chain this with MLflow's experiment, run, and artifact-upload endpoints: create an experiment whose artifact location points inside the installed MLflow package tree, upload a Python module as a run artifact, then trigger import and constructor execution via /ajax-api/3.0/mlflow/scorer/invoke. On the default no-auth server using the official v3.14.0 image (running as uid 0), this yields arbitrary Python code execution with server-process privileges. A harmless public PoC writes a marker file. Fixed in MLflow 3.17.0.
Fixed: mlflow 3.17.0
Do: Upgrade MLflow to 3.17.0 or later immediately; If upgrade is delayed, require authentication on MLflow servers and restrict network exposure; Restrict write permissions on the installed Python package tree and run MLflow as a non-root user; Audit servers for unexpected modules or artifacts under mlflow/genai/scorers/ package directories; Review artifact-location settings and block experiments pointing into site-packages

### [critical] agentenact (npm): malicious package 0.2.0 fully compromises machines that install it (no CVE)
https://helix.ml/threat-watch/i/agentenact-npm-malicious-package-0-2-0-fully-compromises-machines-that-install-it-no-cve · Supply chain · no-fix-needed · since 2026-10-27
GitHub published a malware advisory (GHSA-7p7m-8jmq-qp93) for the npm package agentenact, version 0.2.0, on 2026-10-27. The package contains embedded malicious code (CWE-506) and any computer where it is installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists; the advisory recommends removal but warns removal may not eliminate all malicious software. All secrets and keys stored on affected machines should be rotated immediately from a different, uncompromised computer. No source code repository is known for the package.
Do: Treat any machine with agentenact 0.2.0 installed as fully compromised; Rotate all secrets and keys stored on affected machines immediately, from a different computer; Remove the package and rebuild/reimage affected systems, as removal may not eliminate all malicious software; Audit dependency trees and CI environments for the package

### [critical] Malicious npm packages csec-form-validator, csec-crypto-toolkit (and ccsec- typosquat variants) — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-csec-form-validator-csec-crypto-toolkit-and-ccsec-typosquat-variants-full-system-compromise · Supply chain · no-fix-needed · since 2026-10-27
On 2026-10-27 GitHub published four malware advisories (GHSA-wh86-6qm8-xgw2, GHSA-v383-2358-576w, GHSA-r889-j2qv-2jv6, GHSA-2732-c6cp-rx5v) covering four npm packages: csec-form-validator, csec-crypto-toolkit, and the near-identical typosquat-style names ccsec-form-validator and ccsec-crypto-toolkit. All versions (>= 0) are flagged as embedded malicious code (CWE-506) with no patched versions and no known source code, indicating the packages were published maliciously rather than hijacked. The advisories state any machine with these packages installed or running should be considered fully compromised, implying credential and secret theft with attacker control of the host. The ccsec- variants suggest a coordinated typosquatting campaign against the csec- names. Removal alone is not guaranteed to eliminate the malware.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the packages and rebuild/reimage affected systems; do not assume removal fully cleans the host; Audit dependency lockfiles, CI/CD environments and developer workstations for any of the four package names and block them in registries/proxies; Review access and network logs for signs of exfiltration or attacker activity since installation; Notify incident response and consider the affected hosts untrusted until rebuilt

### [critical] OVHcloud CLI: GitHub release binaries swapped with GlassWorm credential stealer (no CVE)
https://helix.ml/threat-watch/i/ovhcloud-cli-github-release-binaries-swapped-with-glassworm-credential-stealer-no-cve · Supply chain · no-fix-needed · since 2026-10-19
On 2026-10-19 (12:47–14:21 UTC), an attacker using contributor account HassenBF replaced release binaries on ovh/ovhcloud-cli v0.11.0–v0.15.0 with a locally built credential stealer (GlassWorm loader), also replacing checksums.txt; no tags, CI, or source were touched. Initial access traced to a malicious VS Code extension (color-picker-universal) installed on a developer's personal MacBook in Oct 2025, with stolen keys used for uploads. The stealer targets AI-agent credential stores, cloud CLIs, Docker/Kubernetes configs, SSH keys, and more, staging in /tmp/envchecker-*. A customer's pinned-SHA256 CI check detected it within 94 minutes. OVHcloud deleted the assets and shipped clean, attested v0.16.0 (advisory GHSA-862f-55f5-vmvw). Homebrew, go install, and source builds were not exposed.
Fixed: v0.16.0
Do: If you downloaded or ran any ovhcloud binary from GitHub releases between 12:47–14:21 UTC on 2026-10-19, treat the host as fully compromised and assume exfiltration succeeded; Rotate every secret the machine could read (cloud CLIs, AI-agent credentials, Docker/K8s configs, SSH keys, NPM, .netrc, .gitconfig) from a different machine; Check for /tmp/envchecker-* staging directories on potentially affected hosts; Reinstall from the clean v0.16.0 and verify with gh release verify-asset v0.16.0 ovhcloud-cli_Linux_x86_64.tar.gz; Note that updating or reinstalling the CLI alone revokes nothing; secret rotation is required

### [critical] npm malware wave: @eforms/forms-api, jshelperdependenceny, @iobandamwer/cache-helper — malicious packages fully compromise hosts
https://helix.ml/threat-watch/i/npm-malware-wave-eforms-forms-api-jshelperdependenceny-iobandamwer-cache-helper-malicious-packages-fully-compromise-host · Supply chain · no-fix-needed · since 2026-10-19
GitHub published three malware advisories on 2026-10-26 (GHSA-39p9-96vf-fxjh, GHSA-2gxp-q3vq-594r, GHSA-j83w-xhgf-7m58) for npm packages @eforms/forms-api, jshelperdependenceny and @iobandamwer/cache-helper, all now replaced by npm security placeholders. The malicious versions named by OSV are @eforms/forms-api 1.99.0, 1.99.1, 2.0.0-SNAPSHOT, 2.0.99, 2.99.0, 2.99.1 and 99.0.0 (all published 2026-10-25); jshelperdependenceny 0.0.0-stage, 1.0.0 (published 2026-10-19, the earliest publish in this set) and 99.0.0 (2026-10-24); and @iobandamwer/cache-helper 1.0.2 through 1.1.3 (published 2026-10-24 to 2026-10-26). GitHub classes every version as affected and no safe version exists. Any machine that installed or ran these packages should be treated as fully compromised: rotate secrets and keys from a clean machine, and do not rely on uninstalling to remove what the package left behind. Nothing in the sources reports a fix or a CVE. The @iobandamwer npm scope also appears in a separate Threat Watch record (native-helper), so the two should be read together, though they are not the same advisory set.
Do: Check lockfiles and installed node_modules for the three packages and remove them from all machines and CI runners; Treat affected machines as fully compromised: rotate all secrets, keys, tokens and credentials stored there, from a clean computer; Rebuild affected environments from trusted images and audit for persistence beyond the npm package; Block the package names in npm/registry policy and review dependency install history for exposure

### [critical] dsh-native (npm) — malicious package version 1.4.1 fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/dsh-native-npm-malicious-package-version-1-4-1-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-22
GitHub published a malware advisory on 2026-10-26 (GHSA-x94m-hxm5-m298) for dsh-native version 1.4.1, the only version of the package that was ever published with real content. The registry shows 1.4.1 went up on 2026-10-22 at 08:06 UTC, one day after the package's 0.0.0-stage entry, and it has since been removed from the registry without a security placeholder, so the package now carries no installable version. OSV's malware record MAL-2026-18315 names 1.4.1 as the malicious version. npm download counts show 312 installs on 2026-10-22 and 110 on 2026-10-26, which suggests the release was pulled in quickly. GitHub classes the package as containing embedded malicious code and says any computer that installed or ran it should be considered fully compromised, with control potentially handed to an outside party; secrets and keys on those machines should be rotated from a clean machine, and removing the package may not remove the follow-on malware. No fix, CVE or public writeup for this package was found.
Do: Rotate all secrets, keys, and credentials stored on machines where dsh-native 1.4.1 was installed, using a clean computer; Remove dsh-native 1.4.1 from all projects, lockfiles, and CI caches; Rebuild or wipe affected machines and audit for persistence mechanisms and follow-on malware; Review npm install logs and CI history to identify when and where the package was pulled; Block the package in dependency firewalls/registries and audit dependencies for similar typosquat or compromised packages

### [critical] numbors npm package 1.6.1 is malware — full machine compromise; rotate secrets
https://helix.ml/threat-watch/i/numbors-npm-package-1-6-1-is-malware-full-machine-compromise-rotate-secrets · Supply chain · no-fix-needed · since 2026-10-20
GitHub's malware database published GHSA-682c-pwqm-7gxv on 2026-10-26 flagging version 1.6.1 of the npm package numbors as embedded malicious code, with no patched version. Anyone who installed or ran 1.6.1 should treat that machine as fully compromised, rotate every secret reachable from it from a clean machine, and rebuild the host, because removing the package may not remove what it installed. The package's 1.6.1 was published on 2026-10-20. Its metadata was last modified at 02:39 UTC on 2026-10-26, the same time the advisory was published, and 1.6.1 no longer appears in the registry's version list, which suggests it was withdrawn then. No write-up of the payload's behaviour has been published that we could find.
Do: Search lockfiles, global installs and CI caches for numbors 1.6.1 (for example npm ls numbors) and remove it; Treat any machine or runner that installed or ran numbors 1.6.1 as fully compromised: rotate all secrets, keys and tokens from a clean machine and rebuild the host; Do not rely on 1.6.0 as safe on this evidence: it is not flagged, but it is unverified and was published by the same package; Audit CI/CD runners and developer machines that installed the package for persistence and outbound connections since 2026-10-20; Block the numbors package name in dependency policy until the publisher is vetted

### [critical] Dependency-confusion beacon malware: wiseke npm packages (@greenlake, @sxm-web, @drone-js-ext, @ppa-web-components) — postinstall exfiltrates hostname/paths to 185.158.107.175
https://helix.ml/threat-watch/i/dependency-confusion-beacon-malware-wiseke-npm-packages-greenlake-sxm-web-drone-js-ext-ppa-web-components-postinstall-ex · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-26 GitHub advisories (GHSA-pfqf-544g-rvp9 and others) flagged 14 dependency-confusion packages published by npm user wiseke under the @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components scopes between 2026-10-23 and 2026-10-25. Each package poses as a 'compatibility shim' for an 'authorized dependency-confusion test', uses inflated version numbers to win resolution, and runs beacon.cjs via a postinstall script (also on import). It POSTs hostname, install path and cwd over plain HTTP to http://185.158.107.175:8787/_ah/dc, while exporting a no-op Proxy so builds keep running. index.js is byte-identical to ph-common (MAL-2026-1809). No patched versions exist; affected orgs are those whose internal scope names match these packages.
Do: Audit lockfiles and CI logs for any @greenlake/*, @sxm-web/*, @drone-js-ext/* or @ppa-web-components/* installs since 2026-10-23 and remove/quarantine them; Check egress and proxy logs for connections to 185.158.107.175:8787 (path /_ah/dc) and treat hits as confirmed compromise of the build host; Rebuild affected projects from clean caches and rotate any secrets accessible to CI runners on those hosts; Block the C2 IP at the firewall and disable install scripts (npm config set ignore-scripts true) in CI; Register/claim these internal scopes on npm and enable dependency-confusion protections

### [critical] Malicious npm packages: harlow-css-mixer, birch-css-utils, postcss-semantic-themes — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-harlow-css-mixer-birch-css-utils-postcss-semantic-themes-full-system-compromise · Supply chain · no-fix-needed · since 2026-10-25
Three npm packages were flagged by GitHub on 2026-10-26. Two of them, birch-css-utils and postcss-semantic-themes, are described by OSV as zero-runtime CSS theme kits that carry obfuscated JavaScript. birch-css-utils and postcss-semantic-themes were published on 2026-10-25, and their OSV records name the malicious versions as birch-css-utils 1.2.2 and 1.3.0 and postcss-semantic-themes 1.0.0 and 1.0.1. The analysis describes a shared design: birch-css-utils asks users to install it as a Tailwind alias (tailwindcss@npm:birch-css-utils), and its tarball carries about 760 KB of obfuscated JavaScript in modules named build-cache, cache-sweep and cache-warm. postcss-semantic-themes runs a chain of obfuscated modules on require or import, with XOR- and base64-encoded blobs. harlow-css-mixer has only the generic GitHub advisory text, and no version history survives, so its malicious versions could not be confirmed. npm replaced all three names with placeholders on 2026-10-26, and no safe version exists. Any machine that installed one should be treated as fully compromised: rebuild it and rotate its secrets from a clean machine.
Do: Treat every machine that installed any of the three packages as fully compromised; rebuild and rotate secrets from a clean machine; Remove the packages from projects and lockfiles, and search for the Tailwind alias form (tailwindcss@npm:birch-css-utils) in package.json and lockfiles, which npm can hide behind a legitimate package name; Review install scripts and build caches for build-cache, cache-sweep and cache-warm .mjs files in node_modules and CI caches; Block the three names in the internal proxy and dependency scanning

### [critical] @capsense npm packages (@capsense/core-ui, @capsense/ccx-welcome-page) — malicious packages fully compromise installed machines
https://helix.ml/threat-watch/i/capsense-npm-packages-capsense-core-ui-capsense-ccx-welcome-page-malicious-packages-fully-compromise-installed-machines · Supply chain · no-fix-needed · since 2026-10-25
GitHub published two malware advisories on 2026-10-26 (GHSA-c2qc-c78r-386v and GHSA-phgq-4c2g-6xpx) for @capsense/core-ui and @capsense/ccx-welcome-page, both replaced by npm security placeholders at 16:19–16:21 UTC the same day. The malicious versions named by OSV are 99.99.99 and 99.99.100 of each package, published 2026-10-25 between 17:28 and 17:35 UTC; OSV imported the detections at 18:19 and 19:13 UTC the same evening. GitHub classes every version as affected, no safe version exists, and the npm metadata shows no fixed release. Any machine that installed or ran either package should be treated as fully compromised: rotate secrets and keys from a clean machine, and do not assume uninstalling removed what the package dropped. The @capsense scope is held by npm now, so it is not confirmed that it belongs to any real company; treat the 'vendor' as unknown until a verified owner is found. No writeup for these packages was found.
Do: Immediately rotate all secrets, keys, tokens and credentials stored on any machine where these packages were installed, using a clean, uncompromised computer; Remove both packages from all projects and lockfiles and audit for transitive dependencies on them; Rebuild affected systems from trusted images; do not assume uninstalling the package removed the malware; Review CI/CD and developer machines that ran installs or builds for persistence and indicators of compromise; Block the @capsense scope in npm installs and dependency firewall policies

### [critical] Malicious npm packages: path-stream-utils-testmetest and @iobandamwer/native-helper — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-packages-path-stream-utils-testmetest-and-iobandamwer-native-helper-full-system-compromise-on-install-no-c · Supply chain · no-fix-needed · since 2026-10-25
GitHub published two malware advisories on 2026-10-26 (GHSA-7pvr-f92m-6fwg and GHSA-g457-v22r-g8j3) for the npm packages path-stream-utils-testmetest and @iobandamwer/native-helper, both replaced by npm security placeholders at 16:28 UTC the same day. The first malicious publishes are dated in the registry to 2026-10-25 (path-stream-utils-testmetest 0.0.1 at 23:05 UTC, @iobandamwer/native-helper 0.0.1 at 23:21 UTC), so the attack began the day before the advisory. OSV names path-stream-utils-testmetest 0.0.1 through 0.0.4 and @iobandamwer/native-helper 0.0.1 and 0.0.2 as malicious. GitHub classes every version as affected, no safe version exists, and no fix or CVE is reported. Any machine that installed or ran either package should be treated as fully compromised: rotate secrets and keys from a clean machine, and do not assume uninstalling removed what was dropped. The @iobandamwer scope also appears in a second Threat Watch record for @iobandamwer/cache-helper, and the -testmetest name suffix also appears on other packages from different publishers; the sources do not show a single shared event for these.
Do: Check dependency trees and lockfiles for path-stream-utils-testmetest and @iobandamwer/native-helper; quarantine and rebuild any machine where they were installed; Rotate all secrets, tokens, SSH keys, and credentials stored on affected machines, using a clean computer; Remove the packages and reimage/rebuild affected systems rather than trusting cleanup; Audit npm install logs and CI runners for exposure; block the package names in registry proxies and dependency firewalls; Review for signs of compromise (unusual processes, outbound connections, credential use) on affected hosts

### [high] GitHub: stolen tokens planted secret-dumping workflows in 13,500+ branches across 850+ accounts (Gheist)
https://helix.ml/threat-watch/i/gheist-github-actions-token-abuse-stolen-tokens-plant-secret-harvesting-workflows-across-850-accounts · Supply chain · no-fix-needed · since 2026-10-25
Wiz Research (Rami McCarthy and Hila Ramati) published on 2026-10-25 an account of a campaign it calls Gheist, which it has tracked since 2026-09-15. Operators used stolen GitHub tokens to push a workflow file named sync-check.yml onto branches named ci-sync- plus six characters, in every repository those tokens could reach. The workflow prints the environment and a JSON dump of all secrets through base32 into its own run log, the operator downloads that log through the GitHub API, and the run is deleted seconds later, so no attacker domain exists to block. Wiz counts more than 13,500 planted branches and more than 850 compromised accounts, with victims ranging from personal projects to enterprise private repositories; roughly two-thirds of the implicated accounts are no longer available on GitHub. GitHub's approval hold for workflow runs in public repositories, in effect since 2026-07-28, stopped the payloads there, but it does not cover private repositories or GitHub Enterprise Server, where Wiz saw the payloads run. In one enterprise, hours after the planting, cloud credentials from the same organization were used to enumerate AWS Secrets Manager. The fix is credential hygiene: revoke and rotate tokens and every secret the affected repositories could reach, and harden workflows and runners.
Do: Revoke and rotate long-lived GitHub tokens (PATs, fine-grained and service-account tokens), prioritising those with write access; move automation to short-lived, scoped credentials (GitHub Apps or short-lived fine-grained tokens); Hunt: search repositories for branches matching ci-sync- plus six lowercase letters or digits and a commit titled 'ci: sync config' that adds .github/workflows/sync-check.yml; Hunt: review GitHub audit logs for short-lived runs that were deleted soon after creation and for the gheist user agent; review cloud logs for OIDC role assumptions from ci-sync- branches; Hunt: on self-hosted runners, look for .gdmp_* files; treat any self-hosted runner that executed a ci-sync branch as compromised; Respond: rotate every secret available to affected repositories, including cloud credentials such as AWS Secrets Manager secrets; revoke the tokens that pushed the commits; check account owners' devices for infostealers; Harden: require reviewers on production environments, scope OIDC trust to protected branches, run self-hosted runners as ephemeral hosts, and enforce MFA on developer accounts

### [critical] PyPI donutautosellsrc: claudeopuseni, claudeopusenifile, claudeopusfile run staged infostealer (no CVE)
https://helix.ml/threat-watch/i/pypi-typosquat-infostealer-campaign-donutautosellsrc-claudeopuseni-claudeopusenifile-dictmerge-lite-malicious-packages-s · Supply chain · no-fix-needed · since 2026-10-26
Three malicious PyPI packages in the donutautosellsrc campaign, claudeopuseni (0.1.0, 0.1.1), claudeopusenifile (0.1.3) and claudeopusfile (0.1.1, 0.1.2), carry a staged infostealer that is hidden in obfuscated code. They are malware with no fixed version. OpenSSF's analysis (kam193) says install-time obfuscated code fetches a payload hidden in an image. The payload is a Python application with a native extension that holds an infostealer, which sends collected data to a C2 server whose address is read from Polygon blockchain transaction history. Per the Amazon Inspector entries, claudeopuseni runs its payload on import, not at install. It checks whether it runs in a sandbox and whether a real user profile exists, and it can fall back to a payload embedded in the package. claudeopusfile runs from its setup.py during pip install. Anyone who installed these versions should treat the host and its credentials as compromised, remove the packages and rebuild.
Do: Uninstall claudeopuseni, claudeopusenifile and claudeopusfile and block them in your package index or proxy. No fixed version exists.; Treat every host that installed or imported them as compromised. Rotate credentials, SSH keys, API tokens and saved browser passwords from that host.; Rebuild affected machines from trusted images. Look for persistence and for downloaded executables.; Hunt for indicators: outbound connections to thisisafalsepositive.st, the Polygon address 0x9c0a507300fd902787bb193d80fca5ce6e1bff9a, and VirusTotal hash d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e.; Audit lockfiles, CI caches and install logs for these packages and for other packages from the same campaign.

### [critical] @worca/app npm: malicious 1.14.0-rc.2 and 1.14.0-rc.4 fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/worca-app-npm-package-malicious-code-in-1-14-0-rc-2-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-26
GitHub's malware advisory database flagged two prerelease builds of the @worca/app npm package, 1.14.0-rc.2 and 1.14.0-rc.4, as embedded malicious code. Anyone who installed or ran either build should treat that machine as fully compromised and rotate every secret it could reach from a clean machine, because removing the package does not undo what it may have done. Both builds were published by the project's own GitHub Actions release workflow through npm trusted publishing, with signed provenance, after tags were pushed under the maintainer's GitHub account. Our metadata review found nothing that shows the npm publishing path itself was abused, but it cannot tell a compromised maintainer GitHub identity apart from malicious code that entered the development branch and was released as designed. The stable 1.14.0 release, cut about 2.5 hours after rc.4 from a commit whose only change is the version string in package.json and package-lock.json, is not flagged, yet it carries the same source tree and dependency lockfile as rc.4, so it cannot be called safe on this evidence. Both prerelease builds had dropped out of the npm registry's version list by 10:42 UTC on 2026-10-26. The last release before the flagged builds is 1.13.1.
Do: Remove @worca/app 1.14.0-rc.2 and 1.14.0-rc.4 from projects, lockfiles and CI caches; Treat any machine that installed or ran either build as fully compromised: rotate secrets from a clean machine and rebuild the host; Pin @worca/app to 1.13.1 or earlier until 1.14.0 has been verified; do not upgrade on the strength of this record; Verify 1.14.0 by comparing the published tarball with git archive of commit dbd969eb4c in an isolated environment, and check its Sigstore provenance; Audit the maintainer's GitHub account for unexpected pushes, tags, sessions and tokens around 05:50 to 11:00 UTC on 2026-10-26

### [high] Codex, Claude Code: planted AGENTS.md in Downloads makes agents install malicious npm package function-color
https://helix.ml/threat-watch/i/malfex-ai-coding-agents-codex-claude-code-planted-agents-md-in-downloads-tricks-agent-into-installing-malicious-npm-pack · Supply chain · no-fix-needed · since 2026-10-26
Forever Security (researchers Gal Weizman and Omer Samet) published research on 2026-10-26 showing that a website can save an AGENTS.md or CLAUDE.md file into a user's Downloads folder without a prompt, and that a coding agent opened in that folder follows the file's instructions. In the researchers' tests, Codex ran the malicious npm package function-color in more than 90% of attempts and changed its own settings in a way that applies machine-wide. Claude Code followed through about half the time; the planted file had it save a settings change routing requests to an attacker-controlled server, and a replayed login token then gave account takeover. Forever says about half of its customers run a coding agent in Downloads. OSV's malware record for function-color (versions 1.0.0 and 1.7.3, GHSA-m6cg-6crx-mggv) dates from 2026-10-07, and npm has since removed the package. There is no vendor patch: the researchers say there is nothing for OpenAI or Anthropic to patch, so the mitigation is behavioural. Keep agents out of Downloads, read instruction files you did not write, check agent settings for servers or addresses you did not add, keep approval prompts and sandboxes on, and treat any planted file as a token leak.
Do: Developers: do not start Codex, Claude Code or any other coding agent in ~/Downloads or in a freshly downloaded folder; Developers: read any AGENTS.md or CLAUDE.md you did not write, including in repositories you have just copied, before letting an agent run; Developers: check agent settings files for MCP servers, gateways or base URLs you did not add; Codex settings apply machine-wide; Developers: keep approval prompts and sandboxes enabled and treat any instruction to disable them as hostile; Developers: if a planted file is found, assume the login token leaked and rotate it; treat any machine where function-color was installed as compromised; Fleet or IT admins (recommended, not stated in the source): sweep managed machines for function-color and for unexpected instruction files in Downloads, and apply the same no-agents-in-Downloads rule by policy

### [critical] PyPI malware: changes-lxc-wrapper & zagents-framework exfiltrate host info on install/import (no CVE)
https://helix.ml/threat-watch/i/pypi-typosquat-malware-changes-lxc-wrapper-zagents-framework-exfiltrate-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-10-26
Two malicious PyPI packages, changes-lxc-wrapper (versions 0.0.0, 0.1.0) and zagents-framework (versions 6.25.30.10b5, 99.25.30.10b5), were published to the GitHub Advisory Database on 2026-10-26 as embedded malware (CWE-506). Installing either package or importing the module exfiltrates basic host information such as IP address and username; the packages have no other purpose. Both override the install command in setup.py to execute malicious code during installation, meaning even a pip install without importing triggers the exfiltration. Classified under the GENERIC-standard-pypi-install-pentest campaign as PROBABLY_PENTEST with limited risk. No patched versions exist; the packages should be treated as malware and removed.
Do: Check environments and dependency lockfiles for changes-lxc-wrapper or zagents-framework and uninstall them immediately; Treat any host where they were installed or imported as having leaked IP/username data; review for follow-on targeting; Rotate credentials if the affected host is shared or CI infrastructure; Block the package names in PyPI proxies/mirrors and internal artifact repositories; Audit setup.py-based installs and prefer hash-pinned dependencies from trusted sources

### [critical] netweavex (PyPI): NetworkX typosquat runs obfuscated code on import and fetches a remote script (no CVE)
https://helix.ml/threat-watch/i/netweavex-typosquat-malware-pypi-malicious-clone-downloads-remote-code-on-import-no-cve · Supply chain · no-fix-needed · since 2026-10-26
The PyPI package netweavex, versions 1.1.0, 1.1.1 and 1.1.2, is malware and a typosquat of NetworkX, the graph library published on PyPI as networkx. It copies NetworkX's public API and README examples, including the 'import netweavex as nx' idiom. Importing it runs obfuscated code. OpenSSF's Amazon Inspector analysis says the code reverses, base64-decodes and zlib-decompresses a string literal and passes the result to exec(), so attacker bytecode runs at import. A second analysis (kam193) says the import also fetches a script from the GitHub repository jerryjohnston91/helper-library. That script was only a placeholder when examined. Both sources classify the package as malicious, and no fixed version exists. Remove netweavex, audit any host where it was imported, rotate its credentials, and install networkx if the code needs NetworkX.
Do: Remove netweavex immediately. Do not use any version.; Audit environments and CI for netweavex 1.1.0 to 1.1.2 and rebuild the systems where it was imported.; Rotate credentials and secrets on machines where the package was imported.; If the code needs NetworkX, install networkx from PyPI and verify the name before installing. Check for typosquats.; Block the package name and the GitHub repository jerryjohnston91/helper-library in dependency firewalls and proxies.

### [critical] Malicious npm package ctf-agent 0.1.0 — installed machines must be treated as compromised (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-ctf-agent-0-1-0-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-10-26
The npm package ctf-agent published a 0.1.0 release on 2026-10-26 that GitHub flagged as malware, GHSA-2j3v-rjgw-5wgg, the same day. Unlike the other records in this set, the name had an earlier release history: versions 1.2.0 through 1.3.7 were published between 2026-09-06 and 2026-09-11 under the same maintainer account. The new 0.1.0 is numbered lower than those earlier versions, and the packument now lists only a 0.0.0-stage version. That points to a name takeover or re-creation after the earlier versions were removed, but the registry alone does not show which. No payload description is in any source I read. Any machine that installed 0.1.0 should be treated as compromised, with secrets rotated from a clean machine. No safe version exists.
Do: Treat any machine that installed ctf-agent 0.1.0 as fully compromised; rebuild and rotate secrets from a clean machine; Remove ctf-agent from projects and lockfiles; check whether 1.x versions were in use before 2026-10-26 and treat them as unverified; Check for maintainer or ownership changes on the ctf-agent name before trusting any future release; Block ctf-agent 0.1.0 in the internal proxy and dependency scanning

### [critical] w-mousekey npm malware — package fully compromises machines that install it (no CVE)
https://helix.ml/threat-watch/i/w-mousekey-npm-malware-package-fully-compromises-machines-that-install-it-no-cve · Supply chain · no-fix-needed · since 2026-10-25
GitHub's malware advisory database published GHSA-gmhr-j769-j6qf on 2026-10-25 flagging npm package w-mousekey version 1.0.42 as embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity. No patched versions exist and no known source code is available; the package has roughly 1,139 downloads per month. Removal of the package alone is not guaranteed to remove all malicious software it installed. Any developer or CI environment that installed w-mousekey 1.0.42 must treat secrets and keys on that machine as stolen and rotate them from a clean computer.
Do: Rotate all secrets, keys, and credentials stored on any machine that installed w-mousekey 1.0.42, using a different clean computer; Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the system; Audit dependency lockfiles and CI caches for w-mousekey and block the package in registries/proxies; Review access logs and monitor for suspicious activity from affected hosts

### [critical] Malicious npm package event-bus-lite-testmetest — obfuscated installer decrypts and runs hidden Bun payload
https://helix.ml/threat-watch/i/malicious-npm-package-event-bus-lite-testmetest-obfuscated-installer-decrypts-and-runs-hidden-bun-payload · Supply chain · no-fix-needed · since 2026-10-22
The npm package event-bus-lite-testmetest@0.0.6 is malicious code, flagged by Amazon Inspector and OpenSSF. Its binding.gyp uses a GYP <!(...) command expansion to run node index.js during the automatic node-gyp rebuild triggered by npm install. index.js is multi-layer obfuscated (Caesar-shifted char-code array passed to eval), reads a bundled ~312 KB high-entropy lib_native.dat, brotli-decompresses and AES-128-GCM-decrypts it with hardcoded key/IV/AAD, writes the plaintext to a mkdtempSync('.b-') temp directory, and spawns the Bun runtime to execute the decrypted payload — bypassing Node-only analysis. The payload's contents are not inspectable from the shipped artifact. Only version 0.0.6 is affected; no fixed version exists and the package should be treated as compromised. Anyone who installed it should assume arbitrary code execution on their machine.
Do: Remove event-bus-lite-testmetest@0.0.6 from all dependencies and lockfiles; Audit install logs and CI for installs of this package; rebuild affected machines/containers from trusted images; Rotate credentials, tokens, and secrets accessible from affected environments; Check for temp directories matching '.b-*' and any spawned Bun processes as indicators of compromise; Block the package name in npm/registry allowlists and add the payload sha256 e1ab1e330d3db532d511d4af4386ab2d2c6245ca807410f51c1211ae48814d73 to detection

### [high] zagents-message-bus (PyPI): malicious package exfiltrates host info on install/import (no CVE)
https://helix.ml/threat-watch/i/zagents-message-bus-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-10-25
GitHub Advisory Database published GHSA-2hr3-wchh-6g2q on 2026-10-25 flagging the PyPI package zagents-message-bus as malicious. Installing the package or importing the module exfiltrates basic host information (e.g., IP address, username); the package has no legitimate purpose. It overrides the install command in setup.py to execute malicious code during installation. Affected versions are 1.0.5, 1.0.10, 99.99.99, and 99.99.100, with no patched versions available. Categorized as PROBABLY_PENTEST under the GENERIC-standard-pypi-install-pentest campaign with limited risk. Anyone who installed or imported the package should treat the host as potentially compromised and remove the package.
Do: Remove zagents-message-bus from all environments and dependency files; Audit systems where it was installed/imported for exfiltration of host data (IP, username) and signs of further compromise; Rotate credentials used on affected hosts and review network logs for outbound connections around install time; Block the package name in internal PyPI mirrors/dependency scanning; Check CI pipelines and lockfiles for historical use of the package

### [critical] nebulallm typosquatting malware: malicious PyPI package executes remote DLL during pip install
https://helix.ml/threat-watch/i/nebulallm-typosquatting-malware-malicious-pypi-package-executes-remote-dll-during-pip-install · Supply chain · no-fix-needed · since 2026-10-25
The PyPI package nebulallm version 1.4.3 is malicious malware, published to the GitHub Advisory Database on 2026-10-25 as GHSA-mvgr-2gjf-h99c (CWE-506, Embedded Malicious Code). It is a typosquat that overrides the install command in setup.py so malicious code runs during pip install. On installation it downloads a JScript script, which in turn downloads and executes a malicious remote DLL/executable; the campaign is categorized as MALICIOUS with infostealer-like intent. Anyone who pip-installed nebulallm 1.4.3 has executed attacker code on their machine. There are no patched versions — the package itself is the malware — so remediation is removal, host forensics, and credential rotation. Credit: OpenSSF malicious-packages, analysis by kam193.
Do: Immediately uninstall nebulallm and purge it from requirements/lockfiles and CI caches; Treat any machine or CI runner that installed it as compromised: rotate credentials, tokens, and keys accessible to that environment; Hunt for the downloaded JScript/DLL artifacts and review endpoint telemetry for follow-on activity; Block the package name in PyPI proxies/mirrors and audit for typosquats of similarly named LLM packages

### [critical] npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware
https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware · Supply chain · no-fix-needed · since 2026-10-25
On 2026-10-25 GitHub published four malware advisories (GHSA-fr38-45mf-vcqf, GHSA-5pw8-3xv5-6cmg, GHSA-4fw4-xm5r-mh69, GHSA-9w8h-674f-4x2j) covering npm packages appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search and appit-cordova-admob. All versions (>= 0) are affected, CWE-506 embedded malicious code, no patched versions exist. The advisories state any machine with these packages installed or running should be considered fully compromised, implying credential/key theft and remote control by an outside party. The names mimic legitimate Cordova/Ionic plugins, suggesting a typosquatting or account-compromise campaign targeting Ionic/Cordova developers. No exploitation details or fixed versions are available; removal alone may not eliminate the compromise.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the packages from all projects and lockfiles and rebuild from a clean environment; Audit build machines and developer workstations for persistence, unexpected processes and network connections; Check CI/CD pipelines and published app artifacts for inclusion of these packages and re-sign/rebuild affected apps; Block these package names in npm dependency policies and review dependency trees for similar typosquats

### [medium] fontus PyPI malware: fingerprinting/exfiltration package (no CVE)
https://helix.ml/threat-watch/i/fontus-pypi-malware-fingerprinting-exfiltration-package-no-cve · Supply chain · no-fix-needed · since 2026-10-25
OpenSSF and GitHub advisory GHSA-g5mh-f2v3-6p25 (published 2026-10-25) flag the PyPI package 'fontus' as malicious. Versions 0.0.1–0.0.3 contain code that performs system fingerprinting, exfiltrating basic information such as IP address, username, and the list of available fonts, with no other functionality. The campaign is categorized PROBABLY_PENTEST with limited risk, and CWE-506 (embedded malicious code) is noted. No patched versions exist; the package is malware and should not be used. Anyone who installed fontus should treat the exfiltrated data as leaked and remove the package.
Do: Remove/uninstall fontus from all environments and block it in dependency policies; Audit install logs and CI for any use of fontus; Rotate credentials or tokens if installs ran on sensitive hosts; Assess what host data (IP, username, fonts) may have been exfiltrated and whether it creates risk; Add the package and its hashes to internal blocklists/SCA denylists

### [critical] Dependency-confusion npm malware: @drone-js-ext & @fmr-ap153177/@futurae-public stubs beacon hosts / pull off-registry tarballs
https://helix.ml/threat-watch/i/dependency-confusion-npm-malware-drone-js-ext-fmr-ap153177-futurae-public-stubs-beacon-hosts-pull-off-registry-tarballs · Supply chain · no-fix-needed · since 2026-10-25
Four malicious npm packages published as dependency-confusion lures were flagged on 2026-10-25. @drone-js-ext/core and @drone-js-ext/vip-badge (both v99.0.1) ship a beacon.cjs that collects hostname, install path, cwd and Node version and POSTs it in cleartext to a hardcoded bare-IP endpoint (http://185.158.107.175:8787/_ah/dc), firing on npm install (postinstall) and at require() time; the rest of each package is a no-op Proxy stub. @fmr-ap153177/apex-kit-icons and @futurae-public/adaptive-js (both v99.9.1) declare their sole dependency 'ltidisafe' as a direct HTTPS tarball URL on a Google Cloud Storage bucket with no version pin or integrity hash, giving whoever controls the bucket code execution on every installer. Any developer or CI system resolving these names instead of internal packages is affected. No patched versions exist; the packages are malware and should be removed.
Do: Audit lockfiles and CI logs for any of the four package names/versions and for connections to 185.158.107.175:8787 or ltidi.storage.googleapis.com; treat any hit as a host-compromise indicator; Remove the packages and rebuild affected environments from clean images; Block the beacon IP and the ltidi.storage.googleapis.com tarball URL at egress firewalls; Enforce registry-only resolution: disallow HTTPS tarball dependencies, pin internal scopes in .npmrc, and use scoped registry mappings to defeat dependency confusion; Disable or gate npm lifecycle scripts (e.g. --ignore-scripts) in CI and developer workstations; Rotate any secrets present on machines where these packages were installed

### [critical] PyPI: malicious package journey-teste-shellhello spawns reverse shell during installation (no CVE)
https://helix.ml/threat-watch/i/pypi-malicious-package-journey-teste-shellhello-spawns-reverse-shell-during-installation-no-cve · Supply chain · no-fix-needed · since 2026-10-23
The PyPI package journey-teste-shellhello version 0.2.0 was identified as malicious: it overrides the install command in setup.py to execute code during installation, and in specific environments starts a reverse shell, giving an attacker arbitrary command execution on the victim machine. The GitHub advisory (GHSA-r42r-j8h5-x7r3), published 2026-10-23 and credited to OpenSSF's malicious-packages database, categorizes it as MALICIOUS under campaign 2026-10-journey-test-helloshell and marks it a targeted attack (CWE-506, embedded malicious code). Anyone who pip-installed version 0.2.0 is affected. There are no patched versions; the package is malware and should be removed, not upgraded.
Do: Check pip/requirements logs and environments for any install of journey-teste-shellhello==0.2.0 and remove it; If installed, treat the machine as compromised: isolate, hunt for reverse-shell/network callbacks, rotate credentials, and rebuild from a clean image; Block the package name in internal PyPI mirrors/proxies and alert on attempts to install it; Review CI/CD and developer workstations for signs of execution during pip install phases

### [critical] @tekmidian/pai: npm package flagged as malware, full host compromise (no CVE)
https://helix.ml/threat-watch/i/tekmidian-pai-npm-package-flagged-as-malware-full-host-compromise-no-cve · Supply chain · no-fix-needed · since 2026-10-23
GitHub's advisory database published GHSA-xvgg-qjjh-gq34 on 2026-10-23 flagging the npm package @tekmidian/pai as malware (CWE-506, embedded malicious code). Versions 1.0.8, 1.0.9 and 1.0.10 are affected, with no patched versions available — the package itself is malicious, not a compromised release. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying attackers can exfiltrate secrets and keys and maintain control of the host. Removal of the package does not guarantee removal of all malicious software. No fixed version exists; the only remediation is removal plus credential rotation and host rebuild.
Do: Remove @tekmidian/pai from all projects and lockfiles and block the package in your dependency allowlists/CI; Treat affected machines as fully compromised: rotate all secrets, keys, and credentials stored on them, from a clean machine; Rebuild or reimage affected hosts; do not assume package removal removes the malware; Audit logs and network traffic for signs of exfiltration or attacker persistence; Check dependency trees (including transitive dependencies) for other installs of the package

### [critical] @kibt/www-nuxt-i18n: npm package flagged as malware, all versions compromised (no CVE)
https://helix.ml/threat-watch/i/kibt-www-nuxt-i18n-npm-package-flagged-as-malware-all-versions-compromised-no-cve · Supply chain · no-fix-needed · since 2026-10-23
GitHub's advisory database published GHSA-2c7v-rmgw-3xrp on 2026-10-23 flagging the npm package @kibt/www-nuxt-i18n as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and no patched versions exist; the package appears to be a typosquat-style malicious imitation of nuxt-i18n with no known source code. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying credential and secret theft by an outside party. Anyone who installed it via npm is affected. There is no fix beyond removal and remediation of the compromised host.
Do: Remove @kibt/www-nuxt-i18n from all projects and lockfiles and block the package in your registry/proxy allowlists; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean machine; Rebuild affected machines or containers from trusted images; do not assume removal of the package removes the malware; Audit npm install logs and CI pipelines for installs of the package and check for follow-on attacker activity; Switch to the legitimate nuxt-i18n package from a verified source

### [critical] @cecm-web-sdk/core: npm package is malware, full compromise of installed machines (no CVE)
https://helix.ml/threat-watch/i/cecm-web-sdk-core-npm-package-is-malware-full-compromise-of-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-23
GitHub's malware advisory database published GHSA-88qx-q5v7-q7x5 on 2026-10-23 flagging the npm package @cecm-web-sdk/core as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists; the package has no known source code repository. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, meaning an attacker may have full control and access to secrets, keys, and credentials on affected hosts. Removal of the package alone cannot be assumed to eliminate the malicious software. Any developer or CI environment that installed this package is affected; the only remediation is removal plus host rebuild and credential rotation.
Do: Treat any machine with @cecm-web-sdk/core installed or running as fully compromised; rotate all secrets, keys, and credentials from a clean machine immediately; Remove the package and rebuild/reimage affected developer machines and CI runners from trusted images; Audit dependency lockfiles, install logs, and npm audit trails to identify where the package was pulled in and block it in registries/proxies; Review for signs of persistence or exfiltration on affected hosts and check for unauthorized access using stored credentials

### [critical] @blueskydataplatform/shared-ui: npm package is malware, full compromise of any machine where installed (no CVE)
https://helix.ml/threat-watch/i/blueskydataplatform-shared-ui-npm-package-is-malware-full-compromise-of-any-machine-where-installed-no-cve · Supply chain · no-fix-needed · since 2026-10-23
GitHub published advisory GHSA-6x9m-j5h8-w3vg on 2026-10-23 flagging the npm package @blueskydataplatform/shared-ui as malware (CWE-506, embedded malicious code). Every published version (>= 0) is affected and no patched version exists; the package has no known source code repository. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, meaning an attacker may have obtained full control, including access to secrets, keys and credentials stored on the machine. Removal of the package alone cannot be assumed to remove all malicious software. Any developer, CI system or host that installed this package is affected.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where the package was installed, using a clean machine; Rebuild affected machines/CI runners from trusted images rather than just uninstalling the package; Audit dependency lockfiles and remove @blueskydataplatform/shared-ui from all projects and caches; Review logs and systems for signs of attacker activity following installation; Block the package in internal registries/proxies to prevent reinstallation

### [critical] @ecg-internal (npm): four packages flagged as malware, full compromise of affected machines (no CVE)
https://helix.ml/threat-watch/i/ecg-internal-npm-four-packages-flagged-as-malware-full-compromise-of-affected-machines-no-cve · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-23 GitHub published four malware advisories covering every published version of four npm packages under the @ecg-internal scope: js-react-i18n (GHSA-5x9g-7rj9-4xc8), adobe-dmp-js (GHSA-vcj4-3hxm-4rf3), media-util-js-lib (GHSA-hcw5-m6mm-qg3q), and aurora-js-formatters (GHSA-9976-3w38-mrmj). All are rated critical with CWE-506 (embedded malicious code), no known source code, and no patched versions — the packages themselves are the malware. GitHub's guidance states any machine with these packages installed or running should be considered fully compromised, implying attackers may have obtained full control, harvested secrets and keys, and installed additional malicious software. Any project depending on these packages is affected; removal alone may not eradicate the compromise.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the packages from all projects and lockfiles and audit for persistence mechanisms or additional malware left behind; Rebuild or thoroughly forensically clean affected machines; treat them as attacker-controlled; Check CI/CD pipelines and build artifacts for use of these packages and re-run builds from clean environments; Audit npm dependency trees for other packages from the @ecg-internal scope or similar typosquats and block them

### [critical] GrabCAD (npm @grabcad/* packages): malicious packages published to npm compromise any machine that installs them (no CVE)
https://helix.ml/threat-watch/i/grabcad-npm-grabcad-packages-malicious-packages-published-to-npm-compromise-any-machine-that-installs-them-no-cve · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-23 GitHub added four malware advisories for npm packages under the @grabcad scope: @grabcad/user-license (GHSA-6w2v-744r-g5j5), @grabcad/preferences-client (GHSA-mfh5-wvcp-2v6v), @grabcad/company-server-shared (GHSA-fpfw-7wv8-x4mh) and @grabcad/grabcad-shop-shared (GHSA-cc6r-jh8f-6c76). All versions (>= 0) are affected, with no patched versions and no known source code, and each is classified CWE-506 embedded malicious code. GitHub's guidance states any computer with these packages installed or running should be considered fully compromised, implying credential and secret theft and potential remote control by an outside entity. Any developer, CI system or build environment that installed any version is affected. There is no fix; removal alone cannot be assumed to eliminate the malware.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine that installed any of these packages, using a clean computer; Isolate and rebuild affected machines and CI runners from trusted images; do not trust removal of the package alone; Audit lockfiles, dependency caches and install logs to identify every environment where the packages were installed and what they may have accessed; Check for persistence, unauthorized access and exfiltration in logs since installation; treat linked cloud/SCM accounts as potentially compromised; Remove the packages from all projects and block the @grabcad npm scope in dependency firewalls/allowlists

### [critical] qowa (PyPI): malicious package disguised as utility provides C2 server/agent with file exfiltration via Telegram bot
https://helix.ml/threat-watch/i/qowa-pypi-malicious-package-disguised-as-utility-provides-c2-server-agent-with-file-exfiltration-via-telegram-bot · Supply chain · no-fix-needed · since 2026-10-23
OpenSSF and the GitHub Advisory Database flagged the PyPI package qowa (version 0.1.0) as malicious, published 2026-10-23 under campaign 2026-10-qowa. The package, disguised as a generic utility, embeds a C2 server and agent with pre-filled credentials. It can execute remote commands on victims' machines, exfiltrate files, and uses a Telegram bot as its command channel; it is classified as a RAT with spyware-like behaviour and Android-targeting code (CWE-506, Embedded Malicious Code). No patched versions exist; the package is malware and has been removed from distribution. Anyone who installed qowa 0.1.0 should treat the host as compromised.
Do: Remove qowa 0.1.0 from all environments and rebuild affected systems from clean images; Audit machines where it ran for exfiltrated files, Telegram-based C2 traffic, and persistence; rotate credentials stored on those hosts; Check dependency lockfiles, CI caches, and internal mirrors for qowa and block/reject the package name; Review proxy/firewall logs for Telegram API access from build or developer hosts around installation time

### [critical] skillward (npm): malicious package compromises machines of developers who install it (no CVE)
https://helix.ml/threat-watch/i/skillward-npm-malicious-package-compromises-machines-of-developers-who-install-it-no-cve · Supply chain · no-fix-needed · since 2026-10-23
The GitHub Advisory Database published GHSA-9wgc-5pgr-25p3 on 2026-10-23 flagging the npm package skillward as malware (CWE-506, embedded malicious code). Versions 0.1.1 and 0.1.2 are affected, with no patched versions and no known source code repository. Any machine where the package was installed or run must be considered fully compromised, with potential full control handed to an outside entity, exposing secrets, keys, and credentials to theft. All users of the package are affected; removal of the package alone cannot be assumed to remove the malicious software. There is no fix; remediation is incident response: rotate credentials and rebuild affected systems.
Do: Rotate all secrets, API keys, tokens, and credentials stored on or accessible from any machine where skillward was installed, using a clean machine; Remove skillward from all projects and lockfiles and audit for other signs of compromise; Reimage or rebuild affected machines; do not assume uninstalling the package removed the malware; Review access and audit logs for anomalous activity from affected systems; Block skillward in internal registries and dependency scanning to prevent reintroduction

### [critical] PyPI: Malicious packages onsokets, badgertask, brookworker, cobbleload published with file-exfiltration and remote-loader code (no CVE)
https://helix.ml/threat-watch/i/pypi-malicious-packages-onsokets-badgertask-brookworker-cobbleload-published-with-file-exfiltration-and-remote-loader-co · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-23 GitHub's Advisory Database, crediting OpenSSF's malicious-packages project and researcher kam193, published malware advisories for four PyPI packages, all at version 0.1.0: onsokets (campaign 2026-10-proxyrubika), which contains automated file-exfiltration code targeting Android, and badgertask, brookworker, and cobbleload (campaign 2026-10-voice-synthesis-profiles), a coordinated set of loader packages that download and execute remote scripts from attacker-controlled URLs. No patched versions exist; the packages are outright malware (CWE-506). Anyone who installed any of these packages is exposed to file theft or arbitrary remote code execution. Removal of the packages and incident response are required; there is no vendor fix.
Do: Search dependency locks, environments, and CI for onsokets, badgertask, brookworker, or cobbleload and remove them immediately; If any package was installed, treat the host as compromised: rotate credentials, inspect for exfiltrated files, and rebuild affected machines and containers; Block these package names in internal PyPI mirrors/proxies and alert on any historical download attempts; Audit other recently published low-reputation PyPI dependencies, especially typosquat-like names, and pin to verified packages; Enable dependency scanning (e.g., GitHub Advisory/OSSF malware feeds) in CI to catch future malicious-package advisories

### [critical] 2026-10-voice-synthesis-profiles loader campaign: thornqueue, runpier, workslip, taskquay (PyPI) — malicious packages download and execute remote code (no CVE)
https://helix.ml/threat-watch/i/2026-10-voice-synthesis-profiles-loader-campaign-thornqueue-runpier-workslip-taskquay-pypi-malicious-packages-download-a · Supply chain · no-fix-needed · since 2026-10-23
On 2026-10-23, GitHub Advisory Database (via OpenSSF malicious-packages and researcher kam193) published malware advisories for four PyPI packages: thornqueue, runpier, workslip, and taskquay, all at version 0.1.0. They belong to a coordinated campaign dubbed 2026-10-voice-synthesis-profiles consisting of similar loader packages that download and execute code from an attacker-controlled URL. The packages do not embed the final payload themselves, but provide deceptive mechanisms to load and run malicious code, with intent consistent with infostealer delivery (CWE-506, Embedded Malicious Code). No patched versions exist; the packages are pure malware and should be removed. Anyone who installed any of these packages is at risk of arbitrary remote code execution on their build or runtime environment.
Do: Search dependency locks, requirements files, CI logs and environments for thornqueue, runpier, workslip or taskquay and remove them immediately; If any package was installed, treat the affected machine/CI runner as compromised: rotate secrets, tokens and credentials accessible from it; Rebuild affected environments from trusted sources and audit for persistence or downloaded payloads; Block these package names in internal PyPI mirrors/proxies and enforce dependency allowlists or hash pinning; Monitor for follow-on packages from the same campaign and review new dependency additions for typosquat-style names

### [critical] npm malware: @k18k/entrypoint-sdk platform packages and orqiva-runtime-win32-x64 fully compromise installed hosts
https://helix.ml/threat-watch/i/npm-malware-k18k-entrypoint-sdk-platform-packages-and-orqiva-runtime-win32-x64-fully-compromise-installed-hosts · Supply chain · no-fix-needed · since 2026-10-23
GitHub's advisory database published four critical malware advisories on 2026-10-23 covering npm packages @k18k/entrypoint-sdk-darwin-x64 (0.2.0, 0.2.1), @k18k/entrypoint-sdk-darwin-arm64 (0.2.0, 0.2.1), @k18k/entrypoint-sdk-linux-x64 (0.2.0, 0.2.1), and orqiva-runtime-win32-x64 (0.1.0). The packages contain embedded malicious code (CWE-506) and no patched versions exist; GitHub states any computer with these packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Any developer or CI system that installed these platform-specific binaries is affected. Removal alone is not guaranteed to eliminate the malicious software. Affected organisations must treat hosts as compromised, rotate all secrets from clean machines, and rebuild affected systems.
Do: Immediately remove the affected packages and treat all machines where they were installed or run as fully compromised; Rotate all secrets, keys, and credentials stored on or accessible from those machines, using a different clean computer; Rebuild or reimage affected developer workstations and CI runners rather than trusting cleanup; Audit dependency lockfiles and install history for the affected package names and versions; Block the packages in npm registries/proxies and monitor for reappearing lookalike packages

### [critical] npm: four malicious packages (@conduitops/logview-archive, formatting-subtitles, simplewave, log-rotate-testmetest) execute attacker-controlled code at install time (no CVE)
https://helix.ml/threat-watch/i/npm-four-malicious-packages-conduitops-logview-archive-formatting-subtitles-simplewave-log-rotate-testmetest-execute-att · Supply chain · no-fix-needed · since 2026-10-22
GitHub Advisory Database published four npm malware advisories on 2026-10-22, each critical with no patched versions. @conduitops/logview-archive uses a postinstall hook to fetch and run a package from an attacker-controlled plain-HTTP bare-IP registry (139.196.94.195:8080) hidden behind base64+XOR masking. formatting-subtitles hides shell commands inside a fake JS comment in prepare.js, beaconing to webhook.site and executing unpinned content from a mutable GitHub Gist. simplewave exfiltrates os.hostname() to an oast.fun Interactsh collector on install. log-rotate-testmetest abuses binding.gyp command expansion to run a ROT+AES-GCM+brotli-obfuscated payload under Bun. Any developer or CI machine installing these versions gets arbitrary code execution or data exfiltration; no vendor fix exists since the packages are malware.
Do: Search dependency locks, CI logs and caches for the four package/version pairs and remove them from all manifests and lockfiles; Treat any machine or CI runner that installed them as compromised: rotate credentials, tokens and keys accessible to those environments and rebuild from clean images; Block egress to 139.196.94.195:8080, webhook.site/9e8c8742-3102-4716-aa8b-e150e9e84fe7, api.github.com/gists/da04f14c93acbe9a7aef827be0a2e91c and oast.fun in build environments; Disable or restrict npm lifecycle scripts (e.g. npm config set ignore-scripts true, --ignore-scripts in CI) and audit any package requiring install scripts; Prefer pinned, provenance-verified dependencies from internal registries/proxies and scan for typosquat package names

### [critical] PyPI: typosquatted packages 1h1 and aanthropic download and execute malware during install (no CVE)
https://helix.ml/threat-watch/i/pypi-typosquatted-packages-1h1-and-aanthropic-download-and-execute-malware-during-install-no-cve · Supply chain · no-fix-needed · since 2026-10-22
Two typosquatted PyPI packages, 1h1 and aanthropic (version 1.0.0), were published to the GitHub Advisory Database on 2026-10-22 as part of the '2026-10-semvver' malware campaign. Both packages download and execute a remote executable during installation, with infostealer-style malicious intent (CWE-506). The same malware binary hash appears in both advisories' VirusTotal references. Anyone who pip-installed either package — likely developers mistyping 'anthropic' or similar names — has executed malware on their machine. There are no patched versions; the packages are simply malicious and should never be used. Removal from PyPI and advisory publication are the mitigations.
Do: Check pip logs, lockfiles, and CI history for any install of 1h1 or aanthropic 1.0.0 and treat any machine that installed them as compromised; Rebuild affected machines/CI runners from trusted images and rotate all credentials, tokens, and secrets accessible from them; Audit environments for the malware binary hash e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7; Pin dependencies and verify package names carefully to avoid typosquatting; use hash-pinned requirements; Enable PyPI/GitHub Dependabot malware alerts and block these package names in dependency firewalls

### [critical] npm: Four malicious packages (@sudobility/indexer_client, agentic-awesome-skills, opencode-skills-collection, @pkgship/frpc-darwin-amd64) flagged as malware with no patched versions
https://helix.ml/threat-watch/i/npm-four-malicious-packages-sudobility-indexer-client-agentic-awesome-skills-opencode-skills-collection-pkgship-frpc-dar · Supply chain · no-fix-needed · since 2026-10-22
On 2026-10-22 GitHub added four malware advisories (CWE-506, embedded malicious code) covering npm packages @sudobility/indexer_client 0.0.146, agentic-awesome-skills (versions 18.9.0–19.13.0, ~20 listed), opencode-skills-collection (4.0.56–4.1.20, ~21 listed), and @pkgship/frpc-darwin-amd64 0.71.1. All are rated critical with no patched versions; GitHub's standard wording warns any machine with the package installed or running should be considered fully compromised, with secrets and keys exposed to an outside entity. Anyone who installed or runs these packages is affected. No fixes exist; remediation is removal plus credential rotation and host forensics.
Do: Remove the packages from all projects and lockfiles and block these names/versions in your registry proxy or allowlist; Rotate all secrets, API keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild affected machines or containers from trusted images; treat hosts as potentially fully compromised; Audit CI/CD and developer workstations for installs of these packages and review logs for post-install execution or exfiltration

### [critical] @seggy116/next-diff: npm package contains malware, full host compromise (no CVE)
https://helix.ml/threat-watch/i/seggy116-next-diff-npm-package-contains-malware-full-host-compromise-no-cve · Supply chain · no-fix-needed · since 2026-10-22
GitHub's advisory database published GHSA-fv2r-964m-pc2m on 2026-10-22 flagging version 0.3.0 of the npm package @seggy116/next-diff as malware (CWE-506, embedded malicious code). The advisory warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines should be rotated. No patched version exists and no known source code is available, so remediation is removal plus incident response rather than an upgrade. Anyone who installed the package is affected; exploitation is presumed wherever it was installed.
Do: Remove @seggy116/next-diff 0.3.0 from all systems and dependency trees; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit for persistence mechanisms and lateral movement from affected hosts; Block the package in dependency management and CI to prevent reinstalls

### [critical] @factiii/runner: npm package flagged as malware, full host compromise (no CVE)
https://helix.ml/threat-watch/i/factiii-runner-npm-package-flagged-as-malware-full-host-compromise-no-cve · Supply chain · no-fix-needed · since 2026-10-22
GitHub's advisory database (GHSA-9j83-qj34-g5vc, published 2026-10-22) flags the npm package @factiii/runner version 0.28.0 as embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines should be treated as stolen. No patched version exists and no known source code is listed. Anyone who installed @factiii/runner 0.28.0 is affected. The only remediation is removal of the package plus credential rotation and host forensics, since removal cannot guarantee all malicious software is eliminated.
Do: Rotate all secrets, keys, and credentials stored on or accessible from machines where @factiii/runner 0.28.0 was installed, using a clean machine; Remove the package and rebuild/reimage affected hosts; do not trust removal alone; Audit install logs and CI/CD systems for use of @factiii/runner 0.28.0 and check for persistence or unauthorized access; Block the package in dependency management and lockfile policies; scan repositories for references

### [high] Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)
https://helix.ml/threat-watch/i/pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8 · Supply chain · partial · since 2026-10-17
Pillow wheels from 11.1.0 through 12.3.0 bundle a libopenjp2 (2.5.3/2.5.4) containing a heap-buffer-overflow write in opj_j2k_read_sod (OSV-2025-219), introduced in OpenJPEG in June 2024 — notably, older OpenJPEG 2.5.2 is safe. The flaw is reachable from Image.open(fp); im.load() with default settings, and because the wheel bundles its own copy, patched host OS libraries do not help. A public ASan PoC demonstrates the overflow through Pillow's own decoder. Attackers can craft a JPEG 2000 codestream that triggers memory corruption even when uploaded as avatar.png with image/png Content-Type, since Image.open() sniffs magic bytes. Fixed in Pillow 13.0.0; the upstream OpenJPEG fix (91d08b11, Feb 2026) remains unreleased. No in-the-wild exploitation reported.
Fixed: pillow 13.0.0
Do: Upgrade Pillow to 13.0.0 (or pin to <=11.0.0 if downgrade is feasible); Until upgraded, pass an explicit formats= list excluding JPEG2000 to Image.open() and validate on the detected format, not client Content-Type or filename; Reject or sandbox untrusted image uploads; consider blocking JPEG 2000 magic bytes (JP2/j2k codestreams) at the application layer; Audit image-processing services for reliance on filename/Content-Type allowlists that Image.open() bypasses; Monitor for an OpenJPEG release carrying 91d08b11 and rebuild any vendored/bundled OpenJPEG accordingly

### [high] Rank Math SEO PRO 3.0.123: malware distributed in some downloads via compromised update channel (Oct 15–16, 2026)
https://helix.ml/threat-watch/i/rank-math-seo-pro-3-0-123-malware-distributed-in-some-downloads-via-compromised-update-channel-oct-15-16-2026 · Supply chain · no-fix-needed · since 2026-10-17
Rank Math disclosed that some copies of Rank Math SEO PRO version 3.0.123 contained malware. The affected version was downloaded or installed via update between October 15, 2026 at 20:02 UTC and October 16, 2026 at 07:12 UTC, meaning sites that updated during this window may be running a trojanized build of the popular WordPress SEO plugin. Wordfence published a PSA amplifying the disclosure. Rank Math has since addressed the issue, so users outside the window are unaffected; those who installed 3.0.123 during the window should treat their site as potentially compromised. No CVE has been assigned; details of the malware's capabilities have not been fully disclosed in the source.
Do: Check if Rank Math SEO PRO 3.0.123 was installed or updated between 2026-10-15 20:02 UTC and 2026-10-16 07:12 UTC; If so, update to the latest clean version immediately and scan the site for malware and backdoors; Rotate WordPress admin credentials, API keys, and any secrets accessible from the site; Review site integrity: unknown admin users, modified core/plugin files, scheduled tasks, and outbound connections; Check logs for suspicious activity since the update and consider professional incident response if compromise is suspected

Breach data from Have I Been Pwned (haveibeenpwned.com) is licensed CC BY 4.0. Vulnerability data from the CISA KEV catalog and NVD.