{"category":"supply-chain","changes":[{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"crvouga-mockingbird-service-microsoft-npm-package-contains-malware-no-cve","incidentTitle":"@crvouga/mockingbird-service-microsoft npm package contains malware (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-w3gq-mm9x-7w7c","status":"live","title":"@crvouga/mockingbird-service-microsoft npm package contains malware (no CVE)","url":"https://helix.ml/threat-watch/i/crvouga-mockingbird-service-microsoft-npm-package-contains-malware-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"testpackage83-npm-malicious-package-downloads-and-executes-remote-binary-via-postinstall-and-on-import","incidentTitle":"testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-ccgw-9w4v-vqh2","status":"live","title":"testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import","url":"https://helix.ml/threat-watch/i/testpackage83-npm-malicious-package-downloads-and-executes-remote-binary-via-postinstall-and-on-import"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"ps-bool-pypi-malware-obfuscated-code-exfiltrates-photos-documents-to-telegram-bot-targets-android","incidentTitle":"ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fmcm-6g66-p65w","status":"live","title":"ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android","url":"https://helix.ml/threat-watch/i/ps-bool-pypi-malware-obfuscated-code-exfiltrates-photos-documents-to-telegram-bot-targets-android"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"demo-pingtest-xyz-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7r7f-5mcw-j79p","status":"live","title":"demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/demo-pingtest-xyz-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and","incidentTitle":"GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client PyPI packages exfiltrate env vars and host data on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-h6gp-mprh-hhhv","status":"live","title":"GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client PyPI packages exfiltrate env vars and host data on install","url":"https://helix.ml/threat-watch/i/generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"malicious-pypi-package-xrfdc-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fmq9-qj28-89vh","status":"live","title":"Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-pypi-package-xrfdc-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"trezortranslate-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"trezortranslate (PyPI): malicious package exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://github.com/advisories/GHSA-9fc6-4mrc-h6pp","status":"live","title":"trezortranslate (PyPI): malicious package exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/trezortranslate-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"sfunction-dsh-screenshot-npm-package-is-malware-full-machine-compromise-for-installers-no-cve","incidentTitle":"@sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7jf6-qwv2-qppp","status":"live","title":"@sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE)","url":"https://helix.ml/threat-watch/i/sfunction-dsh-screenshot-npm-package-is-malware-full-machine-compromise-for-installers-no-cve"},{"body":"Cursor says the intrusion started with an access key it had issued to Fireworks, which the attacker used to copy data from a read-only Cursor storage bucket. A credential found in that exposed data was then used on 2026-10-29 to place the malicious 2.1.312 and 2.1.313 copies on the marketplace cache. Cursor says the last attacker activity it saw was on 2026-11-01, that it has moved inference off Fireworks, and that it has rotated exposed credentials. Cursor says the key was exposed by Fireworks and links Fireworks' bulletin, which does not mention Cursor. This is Cursor's account and is not independently verified.","category":"supply-chain","date":"2026-11-13","incident":"claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1","incidentTitle":"Claude Code extension (Cursor marketplace): tampered 2.1.312/2.1.313 plants SSH backdoor (no CVE)","kind":"other","patchStatus":"patched","severity":"high","sourceUrl":"https://cursor.com/blog/security-incident-update","status":"closed","title":"Cursor's November 13 post gives its account of how the builds were placed","url":"https://helix.ml/threat-watch/i/claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-know-your-why-by-ken-costa-46wpa-fully-compromises-installers","incidentTitle":"Malicious npm package know_your_why_by_ken_costa_46wpa fully compromises installers","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-c378-v8c4-hpch","status":"live","title":"Malicious npm package know_your_why_by_ken_costa_46wpa fully compromises installers","url":"https://helix.ml/threat-watch/i/malicious-npm-package-know-your-why-by-ken-costa-46wpa-fully-compromises-installers"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6p5c-33pm-w6g4","status":"live","title":"Ebook-download npm malware cluster expands: 18 more dowload_ebok_* packages confirmed as fully compromising malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v5rg-fr44-xwrf","status":"live","title":"Ebook-download npm malware cluster grows: 17 more dowload_ebok_* packages (plus the_shaolin_workout) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2f94-hq8v-53h8","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* (and one Nikon ebook) packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-f7vm-rh3w-xfxm","status":"live","title":"Ebook-download npm malware cluster expands with 17 more dowload_ebok_* packages (and ramses_the_battle_of_kadesh) fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"axiom-dragon-xyz-pypi-malware-install-time-infostealer-exfiltrates-crypto-wallet-and-cloud-credential-files","incidentTitle":"axiom-dragon-xyz PyPI malware — install-time infostealer exfiltrates crypto wallet and cloud credential files","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xxj6-4xmj-wx6q","status":"live","title":"axiom-dragon-xyz PyPI malware — install-time infostealer exfiltrates crypto wallet and cloud credential files","url":"https://helix.ml/threat-watch/i/axiom-dragon-xyz-pypi-malware-install-time-infostealer-exfiltrates-crypto-wallet-and-cloud-credential-files"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"pypi-malware-campaign-2026-11-testing1345-qap793gl4l-setup-py-install-hook-downloads-and-runs-remote-rat-script-no-cve","incidentTitle":"PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-rm58-9wp3-cwmv","status":"live","title":"PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE)","url":"https://helix.ml/threat-watch/i/pypi-malware-campaign-2026-11-testing1345-qap793gl4l-setup-py-install-hook-downloads-and-runs-remote-rat-script-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-4wm6-gm7f-w542","status":"live","title":"Ebook-download npm malware cluster expands: ~20 more dowload_ebok_* packages (plus one iPhone-guide package) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3v92-2fvx-qfvh","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-p5w2-x39v-7m34","status":"live","title":"New dowload_ebok package (dowload_ebok_the_lawrence_browne_affair_by_cat_sebastian_vi2g8, GHSA-p5w2-x39v-7m34) added to the ebook-download npm malware cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j828-q274-mm9j","status":"live","title":"Ebook-download npm malware cluster expands: ~20 more malicious dowload_ebok_* packages (plus campus_baby_by_lex_martin_htsnt) confirmed to fully compromise installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wg3p-w574-m5qp","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* (and one pure_*) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-58f4-mpx2-frc9","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware (GHSA-58f4-mpx2-frc9 et al.), expanding the cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3f64-x867-x5x2","status":"live","title":"Ebook-download npm malware cluster grows: 13 more dowload_ebok_* packages (plus el_ano_que_llego_putin) confirmed as fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"zread-cli-npm-malware-malicious-cli-and-platform-binaries-fully-compromise-installed-machines","incidentTitle":"zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3429-mj25-c5wf","status":"live","title":"zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines","url":"https://helix.ml/threat-watch/i/zread-cli-npm-malware-malicious-cli-and-platform-binaries-fully-compromise-installed-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cvg5-86p5-xpm9","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* packages (plus a fake 'Design Patterns' ebook package) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fp29-qgj4-rfhp","status":"live","title":"Ebook-download npm malware cluster expands: 19 more dowload_ebok_* (and phi_phi_island) packages confirmed as malware, full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hjjp-4f5p-39g8","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* (and one rasmus_klump) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qp63-c497-pc28","status":"live","title":"20 more malicious ebook-download npm packages (dowload_ebok_* plus el_rio_de_la_vida) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v592-6qpm-x6p7","status":"live","title":"Ebook-download npm malware cluster grows: ten more dowload_ebok_* packages (e.g. sanfte_rache, radium_girls, moon_knight) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8f57-g29h-rjmh","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (e.g. dowload_ebok_nuremberg_by_francis_biddle_pof88, dowload_ebok_persuasao_by_jane_austen_px4y8) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8g6q-hfvp-9mmf","status":"live","title":"Ebook-download npm malware cluster grows: nine more dowload_ebok_* packages (plus orgulhosamente_sos) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v9cq-v7gh-wx9c","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (ebook-download cluster) confirmed — full machine compromise, rotate secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"other","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j3h7-rw3q-5789","status":"live","title":"Ebook-download dowload_ebok_* npm malware cluster grows with ten more malicious packages (e.g. dowload_ebok_the_beginner_s_bible_ety5v, dowload_ebok_juntos_es_mejor_gnroh)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cqj6-2v47-286r","status":"live","title":"Ten more dowload_ebok_* ebook-download npm packages flagged as malware (GHSA-cqj6-2v47-286r, GHSA-x4c5-h8f6-pg7g, GHSA-rc7r-4572-7jp6, GHSA-37c8-qh78-v93w, GHSA-95r4-828h-qgwj, GHSA-4jf6-g7jc-3wxm, GHSA-3fx8-cjwg-9m3j, GHSA-fx7q-v4vh-68x3, GHSA-49gf-xv7v-2m98, GHSA-x9wv-rrvc-v767)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jmg9-v87p-7jmv","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (GHSA-jmg9-v87p-7jmv and 9 others) confirmed as full-compromise malware in the ebook-download cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"other","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-vf5j-5gvq-4mcw","status":"live","title":"Nine more dowload_ebok_* malicious ebook packages added to the cluster (GHSA-vf5j-5gvq-4mcw and others)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"jelou-cli-win32-x64-npm-package-malicious-code-compromises-any-machine-where-version-4-26-1-is-installed-no-cve","incidentTitle":"@jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-q78g-75cg-hwq6","status":"live","title":"@jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE)","url":"https://helix.ml/threat-watch/i/jelou-cli-win32-x64-npm-package-malicious-code-compromises-any-machine-where-version-4-26-1-is-installed-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wvq7-93v4-m6fc","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages (e.g. dowload_ebok_moonwalk_by_michael_jackson_7z8ay, dowload_ebok_pulsation_by_vi_keeland_wxraw) confirmed as malware that fully compromises installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qcj3-5ggx-pf4p","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hvjx-644w-p82p","status":"live","title":"New dowload_ebok package (dowload_ebok_in_nacht_und_eis_by_fridtjof_nansen_2f4lr) confirmed as malware — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qcw7-vqpv-6r8x","status":"live","title":"Ebook-download npm malware cluster expands: 19 more dowload_ebok_* packages plus conni_erzahlbande_24 flagged as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jcjq-hc9v-x22m","status":"live","title":"19 more dowload_ebok_* npm packages confirmed as malware, fully compromising machines that install them","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fgjw-mxhx-cxhh","status":"live","title":"New dowload_ebok package (your_3_best_super_powers by Sonia Choquette) added to the ebook-download npm malware cluster — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-pvpp-r3pr-2gjc","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* packages (plus animal_farm_by_george_orwell_npad7) flagged as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-4832-5gm5-7g35","status":"live","title":"Ebook-download npm malware cluster expands with ~19 more malicious dowload_ebok_* and ebook-titled packages (e.g. dowload_ebok_walk_of_shame_by_lauren_layne_33w19, apple_pro_training_series_by_david_nahmani_xvd91) causing full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wwxm-44xv-6gjf","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware that fully compromise installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-pfv6-hwp2-qqw3","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* packages (plus the_name_of_the_wind_by_patrick_rothfuss_fvqm3) flagged as malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"rush-mfa-npm-package-is-malware-full-compromise-of-any-machine-where-installed","incidentTitle":"rush-mfa npm package is malware — full compromise of any machine where installed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j4f5-mgch-g6xr","status":"live","title":"rush-mfa npm package is malware — full compromise of any machine where installed","url":"https://helix.ml/threat-watch/i/rush-mfa-npm-package-is-malware-full-compromise-of-any-machine-where-installed"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-gq55-g7fw-fr79","status":"live","title":"Ebook-download npm malware cluster expands: 14 more dowload_ebok_* packages (e.g. dowload_ebok_estres_postraumatico_5t7to, dowload_ebok_the_walking_dead_164_wcx6l) confirmed as malware, fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hr3v-wv3m-mrx4","status":"live","title":"16 more dowload_ebok_* npm packages confirmed as malware, expanding the ebook-download cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j2jf-336w-rr68","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (paper girls, erin hunter, stoic, etc.) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-86q5-32j9-x2qv","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* (and slave_by_mende_nazer) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cvxm-6533-8g38","status":"live","title":"18 more dowload_ebok_* npm packages confirmed as malware — full machine compromise, rotate all secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3gf4-58w6-3mqx","status":"live","title":"Two more dowload_ebok_* ebook packages (caraval, la_caisse) flagged as malware — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6ph4-56rh-rcm3","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages (plus dikkie_dik_bundel_geel) confirmed as fully compromising malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jgmq-xhcq-cmfx","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* (and one transgalactic_*) packages confirmed as malware, full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6jvp-gjjc-5g26","status":"live","title":"New dowload_ebok package (estudando_o_evangelho by martins peralva) added to the ebook-download npm malware cluster — full compromise, rotate secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xxj5-pjp5-qcqm","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages flagged as malware, fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-packages-asavie-ui-and-asavie-i18n-flagged-as-malware-full-host-compromise","incidentTitle":"Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wwwv-86vw-pg9w","status":"live","title":"Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise","url":"https://helix.ml/threat-watch/i/malicious-npm-packages-asavie-ui-and-asavie-i18n-flagged-as-malware-full-host-compromise"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v5rj-pm56-3mp5","status":"live","title":"16 more dowload_ebok_* ebook-download malware packages flagged (GHSA advisories), expanding the cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-tailwindcss-hook-forms-0-5-2-full-system-compromise-on-install","incidentTitle":"Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8j4g-6q77-9w6p","status":"live","title":"Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-tailwindcss-hook-forms-0-5-2-full-system-compromise-on-install"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-kampodra-0-8-16-full-system-compromise-on-install-no-cve","incidentTitle":"Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-57xg-9jqp-97gm","status":"live","title":"Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-kampodra-0-8-16-full-system-compromise-on-install-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-hauntview-0-2-9-full-system-compromise-of-installed-machines-no-cve","incidentTitle":"Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v244-m2jr-cmc2","status":"live","title":"Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-hauntview-0-2-9-full-system-compromise-of-installed-machines-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"testing1345-pypi-malicious-package-installs-rat-via-setup-py-remote-script-download","incidentTitle":"testing1345 (PyPI): malicious package installs RAT via setup.py remote script download","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-w462-j2j5-xmp7","status":"live","title":"testing1345 (PyPI): malicious package installs RAT via setup.py remote script download","url":"https://helix.ml/threat-watch/i/testing1345-pypi-malicious-package-installs-rat-via-setup-py-remote-script-download"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"node-global-key-listener-v9-npm-malicious-package-compromises-machines-that-install-it","incidentTitle":"node-global-key-listener-v9 (npm): malicious package compromises machines that install it","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-vh6f-827c-9wqg","status":"live","title":"node-global-key-listener-v9 (npm): malicious package compromises machines that install it","url":"https://helix.ml/threat-watch/i/node-global-key-listener-v9-npm-malicious-package-compromises-machines-that-install-it"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wh8h-578j-wh6x","status":"live","title":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installers (no CVE)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly","incidentTitle":"Quantum Systems QBase: reported malware in ground-control update; Bundeswehr fleet grounded, then resumed","kind":"victim","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/german-military-drone-operations-disrupted-by-cyberattack/","status":"live","title":"Quantum Systems confirms late-October incident was an active cyberattack by hostile actors disrupting German military drone operations","url":"https://helix.ml/threat-watch/i/quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"npm-malware-wave-casamare-ansi-sanitize-lineparse-malicious-packages-fully-compromise-installed-machines","incidentTitle":"npm malware wave: casamare, ansi-sanitize, lineparse — malicious packages fully compromise installed machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xqvf-vmv8-fhw5","status":"live","title":"npm malware wave: casamare, ansi-sanitize, lineparse — malicious packages fully compromise installed machines","url":"https://helix.ml/threat-watch/i/npm-malware-wave-casamare-ansi-sanitize-lineparse-malicious-packages-fully-compromise-installed-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"claudecode-cli-npm-package-is-malware-full-machine-compromise-no-safe-version-exists","incidentTitle":"@claudecode/cli npm package is malware — full machine compromise, no safe version exists","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-vp2q-gp5r-xh5j","status":"live","title":"@claudecode/cli npm package is malware — full machine compromise, no safe version exists","url":"https://helix.ml/threat-watch/i/claudecode-cli-npm-package-is-malware-full-machine-compromise-no-safe-version-exists"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"hxqrtv-bznwkp-util-malicious-npm-package-fully-compromises-machines-that-install-it-no-cve","incidentTitle":"hxqrtv-bznwkp-util: malicious npm package fully compromises machines that install it (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-rm59-wxgp-7g45","status":"live","title":"hxqrtv-bznwkp-util: malicious npm package fully compromises machines that install it (no CVE)","url":"https://helix.ml/threat-watch/i/hxqrtv-bznwkp-util-malicious-npm-package-fully-compromises-machines-that-install-it-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ewms-el-bootstrap-npm-package-is-malware-full-machine-compromise-for-any-version-installed","incidentTitle":"@ewms/el-bootstrap npm package is malware — full machine compromise for any version installed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v22r-22vf-5p3c","status":"live","title":"@ewms/el-bootstrap npm package is malware — full machine compromise for any version installed","url":"https://helix.ml/threat-watch/i/ewms-el-bootstrap-npm-package-is-malware-full-machine-compromise-for-any-version-installed"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malware-in-tailwindcss-animationkit-npm-package-full-compromise-of-installed-machines","incidentTitle":"Malware in tailwindcss-animationkit npm package — full compromise of installed machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2hrf-5wrm-jw55","status":"live","title":"Malware in tailwindcss-animationkit npm package — full compromise of installed machines","url":"https://helix.ml/threat-watch/i/malware-in-tailwindcss-animationkit-npm-package-full-compromise-of-installed-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"berg-fonbock-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve","incidentTitle":"berg-fonbock (npm): malicious package compromises any machine where it is installed (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-gw64-g39x-vqhr","status":"live","title":"berg-fonbock (npm): malicious package compromises any machine where it is installed (no CVE)","url":"https://helix.ml/threat-watch/i/berg-fonbock-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"sol-wallet-adapater-npm-malicious-package-compromises-machines-and-exposes-all-stored-secrets-and-keys-no-cve","incidentTitle":"sol-wallet-adapater (npm): malicious package compromises machines and exposes all stored secrets and keys (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-5c87-58w4-f8xf","status":"live","title":"sol-wallet-adapater (npm): malicious package compromises machines and exposes all stored secrets and keys (no CVE)","url":"https://helix.ml/threat-watch/i/sol-wallet-adapater-npm-malicious-package-compromises-machines-and-exposes-all-stored-secrets-and-keys-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"celest-browser-npm-malicious-package-compromises-any-machine-where-installed-no-safe-version-exists","incidentTitle":"celest-browser (npm): malicious package compromises any machine where installed; no safe version exists","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-q7wh-hgh8-x5hw","status":"live","title":"celest-browser (npm): malicious package compromises any machine where installed; no safe version exists","url":"https://helix.ml/threat-watch/i/celest-browser-npm-malicious-package-compromises-any-machine-where-installed-no-safe-version-exists"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly","incidentTitle":"Quantum Systems QBase: reported malware in ground-control update; Bundeswehr fleet grounded, then resumed","kind":"disclosure","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.theregister.com/security/2026/11/13/quantum-systems-drones-back-in-the-air-after-malware-scare/5309658","status":"live","title":"Quantum Systems QBase malware in update — German Bundeswehr drones grounded then cleared to fly","url":"https://helix.ml/threat-watch/i/quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"karma365-mcp-npm-package-malicious-code-in-v2-1-0-fully-compromises-installed-machines-no-cve","incidentTitle":"karma365-mcp npm package — malicious code in v2.1.0 fully compromises installed machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-72xc-q3v8-7grp","status":"live","title":"karma365-mcp npm package — malicious code in v2.1.0 fully compromises installed machines (no CVE)","url":"https://helix.ml/threat-watch/i/karma365-mcp-npm-package-malicious-code-in-v2-1-0-fully-compromises-installed-machines-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"rclaude-darwin-x64-npm-package-malicious-code-full-machine-compromise-no-cve","incidentTitle":"@rclaude/darwin-x64 \u0026 @rclaude/darwin-arm64 npm packages — malicious code, full machine compromise (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-mq7w-jmv5-vq3p","status":"live","title":"Malicious @rclaude/darwin-arm64 variant confirmed — same full-compromise malware family now affects ARM64 macOS installs","url":"https://helix.ml/threat-watch/i/rclaude-darwin-x64-npm-package-malicious-code-full-machine-compromise-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"wanzforme-bails4u-npm-malicious-package-pins-unpinned-github-hosted-libsignal-dependency-enabling-arbitrary-code-executi","incidentTitle":"@wanzforme/bails4u (npm): malicious package pins unpinned GitHub-hosted libsignal dependency, enabling arbitrary code execution on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-38gh-x97r-9cx2","status":"live","title":"@wanzforme/bails4u (npm): malicious package pins unpinned GitHub-hosted libsignal dependency, enabling arbitrary code execution on install","url":"https://helix.ml/threat-watch/i/wanzforme-bails4u-npm-malicious-package-pins-unpinned-github-hosted-libsignal-dependency-enabling-arbitrary-code-executi"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-zxcvb90-utils-helper-exfiltrates-page-dom-to-webhook-site-collector","incidentTitle":"Malicious npm package zxcvb90-utils-helper exfiltrates page DOM to webhook.site collector","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2rfv-gw97-96gg","status":"live","title":"Malicious npm package zxcvb90-utils-helper exfiltrates page DOM to webhook.site collector","url":"https://helix.ml/threat-watch/i/malicious-npm-package-zxcvb90-utils-helper-exfiltrates-page-dom-to-webhook-site-collector"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"test-org-aczxvz-test-package-npm-malicious-init-exfiltrates-hmac-keys-and-bearer-tokens-to-attacker-webhook-no-cve","incidentTitle":"@test-org-aczxvz/test-package (npm): malicious init() exfiltrates HMAC keys and bearer tokens to attacker webhook (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-92mx-87xp-ppw9","status":"live","title":"@test-org-aczxvz/test-package (npm): malicious init() exfiltrates HMAC keys and bearer tokens to attacker webhook (no CVE)","url":"https://helix.ml/threat-watch/i/test-org-aczxvz-test-package-npm-malicious-init-exfiltrates-hmac-keys-and-bearer-tokens-to-attacker-webhook-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"r17d-sec-research-marker-npm-postinstall-script-exfiltrates-host-metadata-and-credential-path-inventory-to-webhook-site","incidentTitle":"r17d-sec-research-marker (npm): postinstall script exfiltrates host metadata and credential-path inventory to webhook.site","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7g8r-g568-m7rv","status":"live","title":"r17d-sec-research-marker (npm): postinstall script exfiltrates host metadata and credential-path inventory to webhook.site","url":"https://helix.ml/threat-watch/i/r17d-sec-research-marker-npm-postinstall-script-exfiltrates-host-metadata-and-credential-path-inventory-to-webhook-site"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"dependency-confusion-malware-wave-securihackbot-depconf-flow-1792484611-axon-web-math-helpers-extra-utils-quickgreet-npm","incidentTitle":"Dependency-confusion malware wave: @securihackbot/depconf-flow-1792484611, axon-web, math-helpers-extra-utils, quickgreet — npm packages exfiltrate host metadata on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fx6j-qp48-x4v4","status":"live","title":"Dependency-confusion malware wave: @securihackbot/depconf-flow-1792484611, axon-web, math-helpers-extra-utils, quickgreet — npm packages exfiltrate host metadata on install","url":"https://helix.ml/threat-watch/i/dependency-confusion-malware-wave-securihackbot-depconf-flow-1792484611-axon-web-math-helpers-extra-utils-quickgreet-npm"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"dependency-confusion-canary-malware-curse-allies-module-helper-agent-npm-beacon-to-webhook-site-and-mutate-local-service","incidentTitle":"Dependency-confusion canary malware: curse-allies-module \u0026 helper-agent (npm) beacon to webhook.site and mutate local services on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2hr9-fgpc-rp7w","status":"live","title":"Dependency-confusion canary malware: curse-allies-module \u0026 helper-agent (npm) beacon to webhook.site and mutate local services on install","url":"https://helix.ml/threat-watch/i/dependency-confusion-canary-malware-curse-allies-module-helper-agent-npm-beacon-to-webhook-site-and-mutate-local-service"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"internallib-v647-internallib-v811-npm-malicious-packages-install-unauthenticated-http-tarball-from-internal-ip-enabling","incidentTitle":"internallib_v647 / internallib_v811 (npm): malicious packages install unauthenticated HTTP tarball from internal IP, enabling arbitrary code execution on npm install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-pgx6-8rcf-2qrp","status":"live","title":"internallib_v647 / internallib_v811 (npm): malicious packages install unauthenticated HTTP tarball from internal IP, enabling arbitrary code execution on npm install","url":"https://helix.ml/threat-watch/i/internallib-v647-internallib-v811-npm-malicious-packages-install-unauthenticated-http-tarball-from-internal-ip-enabling"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"stylelint-standard-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve","incidentTitle":"stylelint-standard (npm) — malicious package compromises any machine where it is installed (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3qxq-88j2-x37v","status":"live","title":"stylelint-standard (npm) — malicious package compromises any machine where it is installed (no CVE)","url":"https://helix.ml/threat-watch/i/stylelint-standard-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-jsconvict-compromises-installers-machines","incidentTitle":"Malicious npm package jsconvict compromises installers' machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3c69-7f9m-gpvp","status":"live","title":"Malicious npm package jsconvict compromises installers' machines","url":"https://helix.ml/threat-watch/i/malicious-npm-package-jsconvict-compromises-installers-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malware-in-em-owa-walletconnect-sign-client-npm-full-compromise-of-installed-machines-no-patched-version","incidentTitle":"Malware in em-owa-walletconnect-sign-client (npm) — full compromise of installed machines; no patched version","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-q36f-8vwc-6vxm","status":"live","title":"Malware in em-owa-walletconnect-sign-client (npm) — full compromise of installed machines; no patched version","url":"https://helix.ml/threat-watch/i/malware-in-em-owa-walletconnect-sign-client-npm-full-compromise-of-installed-machines-no-patched-version"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"my-mcp-server-driving-license-ocr-pypi-malicious-mcp-ocr-tool-exfiltrates-driving-license-images-to-hardcoded-bare-ip-ov","incidentTitle":"my-mcp-server-driving-license-ocr (PyPI): malicious MCP OCR tool exfiltrates driving-license images to hardcoded bare IP over HTTP (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wg5f-m5mv-gmjg","status":"live","title":"my-mcp-server-driving-license-ocr (PyPI): malicious MCP OCR tool exfiltrates driving-license images to hardcoded bare IP over HTTP (no CVE)","url":"https://helix.ml/threat-watch/i/my-mcp-server-driving-license-ocr-pypi-malicious-mcp-ocr-tool-exfiltrates-driving-license-images-to-hardcoded-bare-ip-ov"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"2026-10-voice-synthesis-profiles-malicious-pypi-loader-packages-qwen3ttsui-voxcpmttslora-garvisometerui-download-and-exe","incidentTitle":"2026-10-voice-synthesis-profiles: malicious PyPI loader packages qwen3ttsui, voxcpmttslora, garvisometerui download and execute remote scripts","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jh3g-jv4f-xccp","status":"live","title":"2026-10-voice-synthesis-profiles: malicious PyPI loader packages qwen3ttsui, voxcpmttslora, garvisometerui download and execute remote scripts","url":"https://helix.ml/threat-watch/i/2026-10-voice-synthesis-profiles-malicious-pypi-loader-packages-qwen3ttsui-voxcpmttslora-garvisometerui-download-and-exe"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"fetchium-pypi-malware-covert-windows-loader-with-msi-dropper-and-run-key-persistence","incidentTitle":"fetchium PyPI malware: covert Windows loader with MSI dropper and Run-key persistence","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xjmc-fp37-3wx5","status":"live","title":"fetchium PyPI malware: covert Windows loader with MSI dropper and Run-key persistence","url":"https://helix.ml/threat-watch/i/fetchium-pypi-malware-covert-windows-loader-with-msi-dropper-and-run-key-persistence"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-mre-notificacao-react-full-system-compromise-on-install","incidentTitle":"Malicious npm package mre-notificacao-react — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-p5wc-vpqp-p35f","status":"live","title":"Malicious npm package mre-notificacao-react — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-mre-notificacao-react-full-system-compromise-on-install"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-tailwind-lines-clamps-compromises-installer-machines-no-cve","incidentTitle":"Malicious npm package tailwind-lines-clamps compromises installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-r79p-hc83-2mjh","status":"live","title":"Malicious npm package tailwind-lines-clamps compromises installer machines (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-tailwind-lines-clamps-compromises-installer-machines-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-packages-rampage-unpack-griffing-ui-pkg-griffing-ux-pkg-eigenlayer-sdk-full-host-compromise","incidentTitle":"Malicious npm packages rampage-unpack, griffing-ui-pkg, griffing-ux-pkg, eigenlayer-sdk — full host compromise","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6vpc-j6g3-7756","status":"live","title":"Malicious npm packages rampage-unpack, griffing-ui-pkg, griffing-ux-pkg, eigenlayer-sdk — full host compromise","url":"https://helix.ml/threat-watch/i/malicious-npm-packages-rampage-unpack-griffing-ui-pkg-griffing-ux-pkg-eigenlayer-sdk-full-host-compromise"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-i18n-site-cli-win32-x64-0-1-10-full-machine-compromise-rotate-secrets","incidentTitle":"Malicious npm package @i18n.site/cli-win32-x64 0.1.10 — full machine compromise; rotate secrets","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-m5f4-fvwx-j934","status":"live","title":"Malicious npm package @i18n.site/cli-win32-x64 0.1.10 — full machine compromise; rotate secrets","url":"https://helix.ml/threat-watch/i/malicious-npm-package-i18n-site-cli-win32-x64-0-1-10-full-machine-compromise-rotate-secrets"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"pypi-loader-malware-campaign-dashloom-acustoviasr-malicious-packages-download-and-execute-remote-code-no-cve","incidentTitle":"PyPI loader malware campaign: dashloom \u0026 acustoviasr — malicious packages download and execute remote code (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fwqr-fm22-x7rr","status":"live","title":"PyPI loader malware campaign: dashloom \u0026 acustoviasr — malicious packages download and execute remote code (no CVE)","url":"https://helix.ml/threat-watch/i/pypi-loader-malware-campaign-dashloom-acustoviasr-malicious-packages-download-and-execute-remote-code-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-rust-crates-basek-hesk-on-crates-io-keyloggers-wallet-stealers-exfiltrating-via-telegram-bot-api","incidentTitle":"Malicious Rust crates basek \u0026 hesk on crates.io — keyloggers/wallet stealers exfiltrating via Telegram Bot API","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-5v6h-mqm2-w74c","status":"live","title":"Malicious Rust crates basek \u0026 hesk on crates.io — keyloggers/wallet stealers exfiltrating via Telegram Bot API","url":"https://helix.ml/threat-watch/i/malicious-rust-crates-basek-hesk-on-crates-io-keyloggers-wallet-stealers-exfiltrating-via-telegram-bot-api"},{"body":"Trezor's 12 November post: three Safe 5 units bought from CryptoBilis between 20 August and 23 September 2026 contain an extra circuit board between the main board and the screen. One was examined in Trezor's lab and two were identified from owners' photos. 48 customers have contacted Trezor. Trezor says the implants are limited to Safe 5 units from CryptoBilis, with none found in devices from other resellers or other models, and that it cut its reseller network by about 80%. No CryptoBilis buyer has reported lost funds.","category":"supply-chain","date":"2026-11-12","incident":"trezor-safe-5-hardware-wallet-implants-cryptobilis-reseller-devices-steal-recovery-phrases","incidentTitle":"Trezor Safe 5 hardware wallet implants: CryptoBilis reseller devices steal recovery phrases","kind":"disclosure","patchStatus":"partial","severity":"high","sourceUrl":"https://trezor.io/blog/news/our-cryptobilis-investigation-what-we-found-and-what-weve-changed","status":"closed","title":"Trezor confirms three CryptoBilis-sold Safe 5 units contain the implant","url":"https://helix.ml/threat-watch/i/trezor-safe-5-hardware-wallet-implants-cryptobilis-reseller-devices-steal-recovery-phrases"},{"body":"Per The Register, the company said the threat was contained thanks to its IT and security teams working with the authorities, and that there is no risk in operating its unmanned systems. Reuters, as cited by The Register, quotes the company saying the Bundeswehr was the only customer to ground its systems as a precaution. The date is inferred from The Register's 'on Thursday' (its article is dated Friday 13 November 2026). The company's own statement could not be fetched.","category":"supply-chain","date":"2026-11-12","incident":"quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly","incidentTitle":"Quantum Systems QBase: reported malware in ground-control update; Bundeswehr fleet grounded, then resumed","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.theregister.com/security/2026/11/13/quantum-systems-drones-back-in-the-air-after-malware-scare/5309658","status":"live","title":"Quantum Systems says threat contained and drones flying again","url":"https://helix.ml/threat-watch/i/quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly"},{"body":null,"category":"supply-chain","date":"2026-11-12","incident":"ghostactions-linked-ci-secret-stealer-github-compromised-accounts-push-workflow-payload-to-62k-repos-stealing-actions-cl","incidentTitle":"GitHub Actions: hijacked accounts push CI secret stealer to ~62k repos (GhostActions-linked)","kind":"exploitation","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://www.bleepingcomputer.com/news/security/hackers-compromise-4-800-github-accounts-to-steal-cloud-credentials/","status":"live","title":"'wfx-loot' campaign: 4,837 compromised GitHub accounts probed 61,764 repos and pushed secrets-stealing malware via PRs","url":"https://helix.ml/threat-watch/i/ghostactions-linked-ci-secret-stealer-github-compromised-accounts-push-workflow-payload-to-62k-repos-stealing-actions-cl"}],"feeds":{"changes":"https://helix.ml/threat-watch/c/supply-chain/changes.json","json":"https://helix.ml/threat-watch/c/supply-chain/feed.json","llms":"https://helix.ml/threat-watch/c/supply-chain/llms.txt","page":"https://helix.ml/threat-watch?c=supply-chain","rss":"https://helix.ml/threat-watch/c/supply-chain/feed.xml"},"generatedAt":"2026-11-15T04:20:31Z","site":"https://helix.ml/threat-watch"}