Threat Watch– active

Incident archive

Every exploited vulnerability, breach and supply chain attack Threat Watch has logged, grouped by the day it started. Each date opens that day's log.

3,644 incidents, newest first. Page 1 of 37. 100 incidents from 12 November 2026 to 15 November 2026.

15 November 2026

@theholocron/holocron-plugin-discord — npm package flagged as malware, full host compromise (no CVE) Critical · Supply chain
gatepay-sdk-python (PyPI): malicious package exfiltrates host info on install/import (no CVE) Critical · Supply chain
node-zserial npm package 1.0.42 is malware — full machine compromise, no patched version Critical · Supply chain
@crvouga/mockingbird-service-microsoft npm package contains malware (no CVE) Critical · Supply chain
CodinGame: intruder abused an internal data-analysis tool to copy member databases; all passwords reset High · Breach
Maileva (La Poste Group): cyberattack exposed personal data of ~22 million people Medium · Breach

14 November 2026

GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client / gateio-v4 (PyPI) exfiltrate env vars and host data on install Critical · Supply chain
testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import Critical · Supply chain
demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE) Critical · Supply chain
ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android Critical · Supply chain
Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE) Critical · Supply chain
@sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE) Critical · Supply chain
Apache Shiro: DefaultLdapRealm accepts any password with auth caching enabled (CVE-2026-129349) Critical · Patch now
Uber: driver personal data accessed via compromised credentials at a service provider (no CVE) Medium · Breach
trezortranslate (PyPI): malicious package exfiltrates host info on install/import (no CVE) Medium · Supply chain

13 November 2026

Copeland Dixell XWEB EVO: 14 disclosed flaws give root on refrigeration controllers Critical · Patch now
Malicious npm package know_your_why_by_ken_costa_46wpa fully compromises installers Critical · Supply chain
PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE) Critical · Supply chain
axiom-dragon-xyz PyPI malware — install-time infostealer exfiltrates crypto wallet and cloud credential files Critical · Supply chain
Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE) Critical · Supply chain
zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines Critical · Supply chain
@jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE) Critical · Supply chain
rush-mfa npm package is malware — full compromise of any machine where installed Critical · Supply chain
Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install Critical · Supply chain
Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise Critical · Supply chain
testing1345 (PyPI): malicious package installs RAT via setup.py remote script download Critical · Supply chain
Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE) Critical · Supply chain
Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE) Critical · Supply chain
node-global-key-listener-v9 (npm): malicious package compromises machines that install it Critical · Supply chain
@claudecode/cli npm package is malware — full machine compromise, no safe version exists Critical · Supply chain
npm malware wave: casamare, ansi-sanitize, lineparse — malicious packages fully compromise installed machines Critical · Supply chain
@ewms/el-bootstrap npm package is malware — full machine compromise for any version installed Critical · Supply chain
hxqrtv-bznwkp-util: malicious npm package fully compromises machines that install it (no CVE) Critical · Supply chain
celest-browser (npm): malicious package compromises any machine where installed; no safe version exists Critical · Supply chain
sol-wallet-adapater (npm): malicious package compromises machines and exposes all stored secrets and keys (no CVE) Critical · Supply chain
berg-fonbock (npm): malicious package compromises any machine where it is installed (no CVE) Critical · Supply chain
Malware in tailwindcss-animationkit npm package — full compromise of installed machines Critical · Supply chain
karma365-mcp npm package — malicious code in v2.1.0 fully compromises installed machines (no CVE) Critical · Supply chain
internallib_v647 / internallib_v811 (npm): malicious packages install unauthenticated HTTP tarball from internal IP, enabling arbitrary code execution on npm install Critical · Supply chain
Dependency-confusion canary malware: curse-allies-module & helper-agent (npm) beacon to webhook.site and mutate local services on install Critical · Supply chain
Dependency-confusion malware wave: @securihackbot/depconf-flow-1792484611, axon-web, math-helpers-extra-utils, quickgreet — npm packages exfiltrate host metadata on install Critical · Supply chain
r17d-sec-research-marker (npm): postinstall script exfiltrates host metadata and credential-path inventory to webhook.site Critical · Supply chain
@test-org-aczxvz/test-package (npm): malicious init() exfiltrates HMAC keys and bearer tokens to attacker webhook (no CVE) Critical · Supply chain
Malicious npm package zxcvb90-utils-helper exfiltrates page DOM to webhook.site collector Critical · Supply chain
@wanzforme/bails4u (npm): malicious package pins unpinned GitHub-hosted libsignal dependency, enabling arbitrary code execution on install Critical · Supply chain
stylelint-standard (npm) — malicious package compromises any machine where it is installed (no CVE) Critical · Supply chain
Malware in em-owa-walletconnect-sign-client (npm) — full compromise of installed machines; no patched version Critical · Supply chain
Malicious npm package jsconvict compromises installers' machines Critical · Supply chain
Malicious npm package tailwind-lines-clamps compromises installer machines (no CVE) Critical · Supply chain
Malicious npm package mre-notificacao-react — full system compromise on install Critical · Supply chain
fetchium PyPI malware: covert Windows loader with MSI dropper and Run-key persistence Critical · Supply chain
2026-10-voice-synthesis-profiles: malicious PyPI loader packages qwen3ttsui, voxcpmttslora, garvisometerui download and execute remote scripts Critical · Supply chain
my-mcp-server-driving-license-ocr (PyPI): malicious MCP OCR tool exfiltrates driving-license images to hardcoded bare IP over HTTP (no CVE) Critical · Supply chain
Malicious npm packages rampage-unpack, griffing-ui-pkg, griffing-ux-pkg, eigenlayer-sdk — full host compromise Critical · Supply chain
Malicious Rust crates basek & hesk on crates.io — keyloggers/wallet stealers exfiltrating via Telegram Bot API Critical · Supply chain
PyPI loader malware campaign: dashloom & acustoviasr — malicious packages download and execute remote code (no CVE) Critical · Supply chain
Malicious npm package @i18n.site/cli-win32-x64 0.1.10 — full machine compromise; rotate secrets Critical · Supply chain
FAA: nationwide ground stop after ATC communications disruption; cause unknown, cyberattack not confirmed High · Breach
Dropbear: per-destination forwarding limits bypassed via unix sockets, docker.sock reachable High · Patch now
AWS: intruder from a CyberStrikeAI host used 8 identities across 4 accounts over 16 days (no CVE) High · Breach
University of Texas at Arlington: university confirms personal information stolen; Qilin claims attack (no CVE) Medium · Breach
Quantum Systems QBase: reported malware in ground-control update; Bundeswehr fleet grounded, then resumed Medium · Supply chain
WARDEN Stealer: Fake GTA 6 PC installer — steals Steam/Roblox credentials, browser data and crypto wallets Medium · Breach
UK NHS medical record snooping: ICO demands assurances after 300+ insider access reports in 2026 Medium · Breach

12 November 2026

Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039) Critical · Patch now
Citrix NetScaler November 2026 patches: Console auth bypass and ADC/Gateway memory flaws (CVE-2026-120869 et al.) Critical · Patch now
N-able N-central: unauthenticated root RCE and Windows SYSTEM exploits work on Hotfix 2 (CVE-2026-90436) Critical · Patch now
@rclaude/darwin-x64 & @rclaude/darwin-arm64 npm packages — malicious code, full machine compromise (no CVE) Critical · Supply chain
GitHub Actions: hijacked accounts push CI secret stealer to ~62k repos (GhostActions-linked) Critical · Supply chain
2026-10-voice-synthesis-profiles: malicious PyPI loader packages (eulaliatts, evalometer, ferrotts, lumitts) download and execute remote scripts Critical · Supply chain
otto-git-cli (npm): malicious package compromises machines and steals secrets — remove and rotate credentials (no CVE) Critical · Supply chain
depfix-ai (npm): malicious package compromises machines and steals secrets; no safe version exists Critical · Supply chain
@hesxo/viro-cli and @hesxo/forge-cli npm packages are malware — full machine compromise, no safe versions Critical · Supply chain
base65-* npm malware campaign — base65-33x, base65-15x, base65-77x flagged as embedded malicious code; full host compromise Critical · Supply chain
Malicious npm package @brunosps00/dev-workflow compromises developer machines Critical · Supply chain
Malicious RubyGems install-time exfiltration: buffer-code-exercise-api & cheesebox — gems steal system files via fake native extension Critical · Supply chain
future-scripts (npm): package confirmed as malware — full machine compromise, no safe version exists Critical · Supply chain
npm typosquat malware wave: ganach, soid-wallet, uniswa-v2-sdk-holesky, cosmjs-types-sovid — full machine compromise; no patched versions Critical · Supply chain
Malicious npm packages @budetzz/baileys and @budetzz/libsignal-node flagged as malware Critical · Supply chain
budetzz npm packages: malware in budetzz and @budetzz/eslint-config compromises any machine that installs them Critical · Supply chain
npm malware: @csp-frontend/dashboard and @csp-frontend/auth packages fully compromise installed machines Critical · Supply chain
Malicious npm packages diezyx*-baileys / diezy-libsignal-node — full host compromise via embedded malware (no CVE) Critical · Supply chain
Malware in stelar-sdk npm package — full host compromise, rotate all secrets Critical · Supply chain
Malware in self-certificate npm package — full compromise of installed machines; rotate all secrets Critical · Supply chain
Malicious npm package @go-gost/mcp-darwin-x64 — full system compromise on install (no CVE) Critical · Supply chain
Malicious npm package 'solidty' (typo of Solidity) — full machine compromise on install Critical · Supply chain
Malicious npm package npm-builderio-qwik-poc fully compromises installed machines Critical · Supply chain
PTC Windchill/FlexPLM: critical deserialization RCE patched (CVE-2026-126325) Critical · Patch now
pdf-html5-page-flip npm package 2.0.2 is malware — full machine compromise; no safe version exists Critical · Supply chain
carboniteapp npm malware: install-script exfiltrates host data and public IP to attacker Telegram bot Critical · Supply chain
Off-registry HTTP tarball dependency: @rfewqa-fes/mnm-doc-mcp npm package delivers arbitrary code on install Critical · Supply chain
superlib_ex3 (npm): malicious multi-stage loader fetches second-stage payload from x.exxcube.fr on install Critical · Supply chain
ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE) High · Breach
TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra High · Breach
PostgreSQL 14-18 update: 52 CVEs fixed, many allow code execution by a database user High · Patch now
Microsoft 365: device code phishing via fake Teams scheduler gave attacker a session at one construction firm High · Breach
ArcticRAT: Android users — crypto stealer evolved into AI-powered RAT with full device control and financial data profiling High · Breach
Caixa Vida e Previdência: intrusion copies registration database covering 7.6M active clients (names, CPF) High · Breach
Luna Moth: vishing victims hand over Microsoft Graph tokens to exfiltrate law-firm files High · Breach
Cairn AI pentest framework: Chinese-speaking attackers autonomously breached 10 orgs via AI-driven intrusions High · Breach