{"category":"supply-chain","changes":[{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"gatepay-sdk-python-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"gatepay-sdk-python (PyPI): malicious package exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-rp2f-46j6-grv4","status":"live","title":"gatepay-sdk-python (PyPI): malicious package exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/gatepay-sdk-python-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"theholocron-holocron-plugin-discord-npm-package-flagged-as-malware-full-host-compromise-no-cve","incidentTitle":"@theholocron/holocron-plugin-discord — npm package flagged as malware, full host compromise (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-95pv-hv63-58m8","status":"live","title":"@theholocron/holocron-plugin-discord — npm package flagged as malware, full host compromise (no CVE)","url":"https://helix.ml/threat-watch/i/theholocron-holocron-plugin-discord-npm-package-flagged-as-malware-full-host-compromise-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and","incidentTitle":"GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client / gateio-v4 (PyPI) exfiltrate env vars and host data on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8chm-xj53-hg7h","status":"live","title":"Gateio typosquat campaign expands: gateio-v4 (PyPI) exfiltrates host info on install/import","url":"https://helix.ml/threat-watch/i/generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"node-zserial-npm-package-1-0-42-is-malware-full-machine-compromise-no-patched-version","incidentTitle":"node-zserial npm package 1.0.42 is malware — full machine compromise, no patched version","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2p2h-g9qq-v2wx","status":"live","title":"node-zserial npm package 1.0.42 is malware — full machine compromise, no patched version","url":"https://helix.ml/threat-watch/i/node-zserial-npm-package-1-0-42-is-malware-full-machine-compromise-no-patched-version"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"crvouga-mockingbird-service-microsoft-npm-package-contains-malware-no-cve","incidentTitle":"@crvouga/mockingbird-service-microsoft npm package contains malware (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-w3gq-mm9x-7w7c","status":"live","title":"@crvouga/mockingbird-service-microsoft npm package contains malware (no CVE)","url":"https://helix.ml/threat-watch/i/crvouga-mockingbird-service-microsoft-npm-package-contains-malware-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"testpackage83-npm-malicious-package-downloads-and-executes-remote-binary-via-postinstall-and-on-import","incidentTitle":"testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-ccgw-9w4v-vqh2","status":"live","title":"testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import","url":"https://helix.ml/threat-watch/i/testpackage83-npm-malicious-package-downloads-and-executes-remote-binary-via-postinstall-and-on-import"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"ps-bool-pypi-malware-obfuscated-code-exfiltrates-photos-documents-to-telegram-bot-targets-android","incidentTitle":"ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fmcm-6g66-p65w","status":"live","title":"ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android","url":"https://helix.ml/threat-watch/i/ps-bool-pypi-malware-obfuscated-code-exfiltrates-photos-documents-to-telegram-bot-targets-android"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"demo-pingtest-xyz-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7r7f-5mcw-j79p","status":"live","title":"demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/demo-pingtest-xyz-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and","incidentTitle":"GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client / gateio-v4 (PyPI) exfiltrate env vars and host data on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-h6gp-mprh-hhhv","status":"live","title":"GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client PyPI packages exfiltrate env vars and host data on install","url":"https://helix.ml/threat-watch/i/generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"malicious-pypi-package-xrfdc-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fmq9-qj28-89vh","status":"live","title":"Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-pypi-package-xrfdc-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"trezortranslate-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"trezortranslate (PyPI): malicious package exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://github.com/advisories/GHSA-9fc6-4mrc-h6pp","status":"live","title":"trezortranslate (PyPI): malicious package exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/trezortranslate-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"sfunction-dsh-screenshot-npm-package-is-malware-full-machine-compromise-for-installers-no-cve","incidentTitle":"@sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7jf6-qwv2-qppp","status":"live","title":"@sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE)","url":"https://helix.ml/threat-watch/i/sfunction-dsh-screenshot-npm-package-is-malware-full-machine-compromise-for-installers-no-cve"},{"body":"Per Cursor's 2026-11-13 post, the attacker used an access key Cursor had issued to Fireworks to copy data from a read-only storage bucket. The bucket held limited coding-agent traces, mostly from 2025, from sessions not in Privacy Mode. Cursor says fewer than 0.01% of customers had API credentials exposed, and that coding-agent traces were exposed for fewer than 0.05% of non-Privacy-Mode users. Credentials from that data then let the attacker reach select Cursor SaaS tools, from which it took archived non-production source repositories, limited customer support data and some user-submitted credentials. The post does not date the SaaS access. Cursor's account, not independently verified; Fireworks' bulletin does not mention Cursor.","category":"supply-chain","date":"2026-11-13","incident":"claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1","incidentTitle":"Claude Code extension (Cursor marketplace): tampered 2.1.312/2.1.313 plants SSH backdoor (no CVE)","kind":"victim","patchStatus":"patched","severity":"high","sourceUrl":"https://cursor.com/blog/security-incident-update","status":"closed","title":"Cursor: the Fireworks-issued key reached Cursor SaaS tools, archived repos and support data","url":"https://helix.ml/threat-watch/i/claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1"},{"body":"Cursor says the intrusion started with an access key it had issued to Fireworks, which the attacker used to copy data from a read-only Cursor storage bucket. A credential found in that exposed data was then used on 2026-10-29 to place the malicious 2.1.312 and 2.1.313 copies on the marketplace cache. Cursor says the last attacker activity it saw was on 2026-11-01, that it has moved inference off Fireworks, and that it has rotated exposed credentials. Cursor says the key was exposed by Fireworks and links Fireworks' bulletin, which does not mention Cursor. This is Cursor's account and is not independently verified.","category":"supply-chain","date":"2026-11-13","incident":"claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1","incidentTitle":"Claude Code extension (Cursor marketplace): tampered 2.1.312/2.1.313 plants SSH backdoor (no CVE)","kind":"other","patchStatus":"patched","severity":"high","sourceUrl":"https://cursor.com/blog/security-incident-update","status":"closed","title":"Cursor's November 13 post gives its account of how the builds were placed","url":"https://helix.ml/threat-watch/i/claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-know-your-why-by-ken-costa-46wpa-fully-compromises-installers","incidentTitle":"Malicious npm package know_your_why_by_ken_costa_46wpa fully compromises installers","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-c378-v8c4-hpch","status":"live","title":"Malicious npm package know_your_why_by_ken_costa_46wpa fully compromises installers","url":"https://helix.ml/threat-watch/i/malicious-npm-package-know-your-why-by-ken-costa-46wpa-fully-compromises-installers"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6p5c-33pm-w6g4","status":"live","title":"Ebook-download npm malware cluster expands: 18 more dowload_ebok_* packages confirmed as fully compromising malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v5rg-fr44-xwrf","status":"live","title":"Ebook-download npm malware cluster grows: 17 more dowload_ebok_* packages (plus the_shaolin_workout) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2f94-hq8v-53h8","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* (and one Nikon ebook) packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-f7vm-rh3w-xfxm","status":"live","title":"Ebook-download npm malware cluster expands with 17 more dowload_ebok_* packages (and ramses_the_battle_of_kadesh) fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"axiom-dragon-xyz-pypi-malware-install-time-infostealer-exfiltrates-crypto-wallet-and-cloud-credential-files","incidentTitle":"axiom-dragon-xyz PyPI malware — install-time infostealer exfiltrates crypto wallet and cloud credential files","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xxj6-4xmj-wx6q","status":"live","title":"axiom-dragon-xyz PyPI malware — install-time infostealer exfiltrates crypto wallet and cloud credential files","url":"https://helix.ml/threat-watch/i/axiom-dragon-xyz-pypi-malware-install-time-infostealer-exfiltrates-crypto-wallet-and-cloud-credential-files"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"pypi-malware-campaign-2026-11-testing1345-qap793gl4l-setup-py-install-hook-downloads-and-runs-remote-rat-script-no-cve","incidentTitle":"PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-rm58-9wp3-cwmv","status":"live","title":"PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE)","url":"https://helix.ml/threat-watch/i/pypi-malware-campaign-2026-11-testing1345-qap793gl4l-setup-py-install-hook-downloads-and-runs-remote-rat-script-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-4wm6-gm7f-w542","status":"live","title":"Ebook-download npm malware cluster expands: ~20 more dowload_ebok_* packages (plus one iPhone-guide package) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3v92-2fvx-qfvh","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-p5w2-x39v-7m34","status":"live","title":"New dowload_ebok package (dowload_ebok_the_lawrence_browne_affair_by_cat_sebastian_vi2g8, GHSA-p5w2-x39v-7m34) added to the ebook-download npm malware cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j828-q274-mm9j","status":"live","title":"Ebook-download npm malware cluster expands: ~20 more malicious dowload_ebok_* packages (plus campus_baby_by_lex_martin_htsnt) confirmed to fully compromise installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wg3p-w574-m5qp","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* (and one pure_*) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-58f4-mpx2-frc9","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware (GHSA-58f4-mpx2-frc9 et al.), expanding the cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3f64-x867-x5x2","status":"live","title":"Ebook-download npm malware cluster grows: 13 more dowload_ebok_* packages (plus el_ano_que_llego_putin) confirmed as fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"zread-cli-npm-malware-malicious-cli-and-platform-binaries-fully-compromise-installed-machines","incidentTitle":"zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3429-mj25-c5wf","status":"live","title":"zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines","url":"https://helix.ml/threat-watch/i/zread-cli-npm-malware-malicious-cli-and-platform-binaries-fully-compromise-installed-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cvg5-86p5-xpm9","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* packages (plus a fake 'Design Patterns' ebook package) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fp29-qgj4-rfhp","status":"live","title":"Ebook-download npm malware cluster expands: 19 more dowload_ebok_* (and phi_phi_island) packages confirmed as malware, full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hjjp-4f5p-39g8","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* (and one rasmus_klump) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qp63-c497-pc28","status":"live","title":"20 more malicious ebook-download npm packages (dowload_ebok_* plus el_rio_de_la_vida) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v592-6qpm-x6p7","status":"live","title":"Ebook-download npm malware cluster grows: ten more dowload_ebok_* packages (e.g. sanfte_rache, radium_girls, moon_knight) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8f57-g29h-rjmh","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (e.g. dowload_ebok_nuremberg_by_francis_biddle_pof88, dowload_ebok_persuasao_by_jane_austen_px4y8) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8g6q-hfvp-9mmf","status":"live","title":"Ebook-download npm malware cluster grows: nine more dowload_ebok_* packages (plus orgulhosamente_sos) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v9cq-v7gh-wx9c","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (ebook-download cluster) confirmed — full machine compromise, rotate secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"other","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j3h7-rw3q-5789","status":"live","title":"Ebook-download dowload_ebok_* npm malware cluster grows with ten more malicious packages (e.g. dowload_ebok_the_beginner_s_bible_ety5v, dowload_ebok_juntos_es_mejor_gnroh)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cqj6-2v47-286r","status":"live","title":"Ten more dowload_ebok_* ebook-download npm packages flagged as malware (GHSA-cqj6-2v47-286r, GHSA-x4c5-h8f6-pg7g, GHSA-rc7r-4572-7jp6, GHSA-37c8-qh78-v93w, GHSA-95r4-828h-qgwj, GHSA-4jf6-g7jc-3wxm, GHSA-3fx8-cjwg-9m3j, GHSA-fx7q-v4vh-68x3, GHSA-49gf-xv7v-2m98, GHSA-x9wv-rrvc-v767)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jmg9-v87p-7jmv","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (GHSA-jmg9-v87p-7jmv and 9 others) confirmed as full-compromise malware in the ebook-download cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"other","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-vf5j-5gvq-4mcw","status":"live","title":"Nine more dowload_ebok_* malicious ebook packages added to the cluster (GHSA-vf5j-5gvq-4mcw and others)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"jelou-cli-win32-x64-npm-package-malicious-code-compromises-any-machine-where-version-4-26-1-is-installed-no-cve","incidentTitle":"@jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-q78g-75cg-hwq6","status":"live","title":"@jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE)","url":"https://helix.ml/threat-watch/i/jelou-cli-win32-x64-npm-package-malicious-code-compromises-any-machine-where-version-4-26-1-is-installed-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wvq7-93v4-m6fc","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages (e.g. dowload_ebok_moonwalk_by_michael_jackson_7z8ay, dowload_ebok_pulsation_by_vi_keeland_wxraw) confirmed as malware that fully compromises installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qcj3-5ggx-pf4p","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hvjx-644w-p82p","status":"live","title":"New dowload_ebok package (dowload_ebok_in_nacht_und_eis_by_fridtjof_nansen_2f4lr) confirmed as malware — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qcw7-vqpv-6r8x","status":"live","title":"Ebook-download npm malware cluster expands: 19 more dowload_ebok_* packages plus conni_erzahlbande_24 flagged as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jcjq-hc9v-x22m","status":"live","title":"19 more dowload_ebok_* npm packages confirmed as malware, fully compromising machines that install them","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fgjw-mxhx-cxhh","status":"live","title":"New dowload_ebok package (your_3_best_super_powers by Sonia Choquette) added to the ebook-download npm malware cluster — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-pvpp-r3pr-2gjc","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* packages (plus animal_farm_by_george_orwell_npad7) flagged as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-4832-5gm5-7g35","status":"live","title":"Ebook-download npm malware cluster expands with ~19 more malicious dowload_ebok_* and ebook-titled packages (e.g. dowload_ebok_walk_of_shame_by_lauren_layne_33w19, apple_pro_training_series_by_david_nahmani_xvd91) causing full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wwxm-44xv-6gjf","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware that fully compromise installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-pfv6-hwp2-qqw3","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* packages (plus the_name_of_the_wind_by_patrick_rothfuss_fvqm3) flagged as malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"rush-mfa-npm-package-is-malware-full-compromise-of-any-machine-where-installed","incidentTitle":"rush-mfa npm package is malware — full compromise of any machine where installed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j4f5-mgch-g6xr","status":"live","title":"rush-mfa npm package is malware — full compromise of any machine where installed","url":"https://helix.ml/threat-watch/i/rush-mfa-npm-package-is-malware-full-compromise-of-any-machine-where-installed"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-gq55-g7fw-fr79","status":"live","title":"Ebook-download npm malware cluster expands: 14 more dowload_ebok_* packages (e.g. dowload_ebok_estres_postraumatico_5t7to, dowload_ebok_the_walking_dead_164_wcx6l) confirmed as malware, fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hr3v-wv3m-mrx4","status":"live","title":"16 more dowload_ebok_* npm packages confirmed as malware, expanding the ebook-download cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j2jf-336w-rr68","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (paper girls, erin hunter, stoic, etc.) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-86q5-32j9-x2qv","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* (and slave_by_mende_nazer) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cvxm-6533-8g38","status":"live","title":"18 more dowload_ebok_* npm packages confirmed as malware — full machine compromise, rotate all secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3gf4-58w6-3mqx","status":"live","title":"Two more dowload_ebok_* ebook packages (caraval, la_caisse) flagged as malware — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6ph4-56rh-rcm3","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages (plus dikkie_dik_bundel_geel) confirmed as fully compromising malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jgmq-xhcq-cmfx","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* (and one transgalactic_*) packages confirmed as malware, full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6jvp-gjjc-5g26","status":"live","title":"New dowload_ebok package (estudando_o_evangelho by martins peralva) added to the ebook-download npm malware cluster — full compromise, rotate secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xxj5-pjp5-qcqm","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages flagged as malware, fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-packages-asavie-ui-and-asavie-i18n-flagged-as-malware-full-host-compromise","incidentTitle":"Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wwwv-86vw-pg9w","status":"live","title":"Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise","url":"https://helix.ml/threat-watch/i/malicious-npm-packages-asavie-ui-and-asavie-i18n-flagged-as-malware-full-host-compromise"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v5rj-pm56-3mp5","status":"live","title":"16 more dowload_ebok_* ebook-download malware packages flagged (GHSA advisories), expanding the cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-tailwindcss-hook-forms-0-5-2-full-system-compromise-on-install","incidentTitle":"Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8j4g-6q77-9w6p","status":"live","title":"Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-tailwindcss-hook-forms-0-5-2-full-system-compromise-on-install"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-kampodra-0-8-16-full-system-compromise-on-install-no-cve","incidentTitle":"Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-57xg-9jqp-97gm","status":"live","title":"Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-kampodra-0-8-16-full-system-compromise-on-install-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-hauntview-0-2-9-full-system-compromise-of-installed-machines-no-cve","incidentTitle":"Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v244-m2jr-cmc2","status":"live","title":"Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-hauntview-0-2-9-full-system-compromise-of-installed-machines-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"testing1345-pypi-malicious-package-installs-rat-via-setup-py-remote-script-download","incidentTitle":"testing1345 (PyPI): malicious package installs RAT via setup.py remote script download","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-w462-j2j5-xmp7","status":"live","title":"testing1345 (PyPI): malicious package installs RAT via setup.py remote script download","url":"https://helix.ml/threat-watch/i/testing1345-pypi-malicious-package-installs-rat-via-setup-py-remote-script-download"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"node-global-key-listener-v9-npm-malicious-package-compromises-machines-that-install-it","incidentTitle":"node-global-key-listener-v9 (npm): malicious package compromises machines that install it","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-vh6f-827c-9wqg","status":"live","title":"node-global-key-listener-v9 (npm): malicious package compromises machines that install it","url":"https://helix.ml/threat-watch/i/node-global-key-listener-v9-npm-malicious-package-compromises-machines-that-install-it"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wh8h-578j-wh6x","status":"live","title":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installers (no CVE)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly","incidentTitle":"Quantum Systems QBase: reported malware in ground-control update; Bundeswehr fleet grounded, then resumed","kind":"victim","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/german-military-drone-operations-disrupted-by-cyberattack/","status":"live","title":"Quantum Systems confirms late-October incident was an active cyberattack by hostile actors disrupting German military drone operations","url":"https://helix.ml/threat-watch/i/quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"npm-malware-wave-casamare-ansi-sanitize-lineparse-malicious-packages-fully-compromise-installed-machines","incidentTitle":"npm malware wave: casamare, ansi-sanitize, lineparse — malicious packages fully compromise installed machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xqvf-vmv8-fhw5","status":"live","title":"npm malware wave: casamare, ansi-sanitize, lineparse — malicious packages fully compromise installed machines","url":"https://helix.ml/threat-watch/i/npm-malware-wave-casamare-ansi-sanitize-lineparse-malicious-packages-fully-compromise-installed-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"claudecode-cli-npm-package-is-malware-full-machine-compromise-no-safe-version-exists","incidentTitle":"@claudecode/cli npm package is malware — full machine compromise, no safe version exists","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-vp2q-gp5r-xh5j","status":"live","title":"@claudecode/cli npm package is malware — full machine compromise, no safe version exists","url":"https://helix.ml/threat-watch/i/claudecode-cli-npm-package-is-malware-full-machine-compromise-no-safe-version-exists"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"hxqrtv-bznwkp-util-malicious-npm-package-fully-compromises-machines-that-install-it-no-cve","incidentTitle":"hxqrtv-bznwkp-util: malicious npm package fully compromises machines that install it (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-rm59-wxgp-7g45","status":"live","title":"hxqrtv-bznwkp-util: malicious npm package fully compromises machines that install it (no CVE)","url":"https://helix.ml/threat-watch/i/hxqrtv-bznwkp-util-malicious-npm-package-fully-compromises-machines-that-install-it-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ewms-el-bootstrap-npm-package-is-malware-full-machine-compromise-for-any-version-installed","incidentTitle":"@ewms/el-bootstrap npm package is malware — full machine compromise for any version installed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v22r-22vf-5p3c","status":"live","title":"@ewms/el-bootstrap npm package is malware — full machine compromise for any version installed","url":"https://helix.ml/threat-watch/i/ewms-el-bootstrap-npm-package-is-malware-full-machine-compromise-for-any-version-installed"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malware-in-tailwindcss-animationkit-npm-package-full-compromise-of-installed-machines","incidentTitle":"Malware in tailwindcss-animationkit npm package — full compromise of installed machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2hrf-5wrm-jw55","status":"live","title":"Malware in tailwindcss-animationkit npm package — full compromise of installed machines","url":"https://helix.ml/threat-watch/i/malware-in-tailwindcss-animationkit-npm-package-full-compromise-of-installed-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"berg-fonbock-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve","incidentTitle":"berg-fonbock (npm): malicious package compromises any machine where it is installed (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-gw64-g39x-vqhr","status":"live","title":"berg-fonbock (npm): malicious package compromises any machine where it is installed (no CVE)","url":"https://helix.ml/threat-watch/i/berg-fonbock-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"sol-wallet-adapater-npm-malicious-package-compromises-machines-and-exposes-all-stored-secrets-and-keys-no-cve","incidentTitle":"sol-wallet-adapater (npm): malicious package compromises machines and exposes all stored secrets and keys (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-5c87-58w4-f8xf","status":"live","title":"sol-wallet-adapater (npm): malicious package compromises machines and exposes all stored secrets and keys (no CVE)","url":"https://helix.ml/threat-watch/i/sol-wallet-adapater-npm-malicious-package-compromises-machines-and-exposes-all-stored-secrets-and-keys-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"celest-browser-npm-malicious-package-compromises-any-machine-where-installed-no-safe-version-exists","incidentTitle":"celest-browser (npm): malicious package compromises any machine where installed; no safe version exists","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-q7wh-hgh8-x5hw","status":"live","title":"celest-browser (npm): malicious package compromises any machine where installed; no safe version exists","url":"https://helix.ml/threat-watch/i/celest-browser-npm-malicious-package-compromises-any-machine-where-installed-no-safe-version-exists"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly","incidentTitle":"Quantum Systems QBase: reported malware in ground-control update; Bundeswehr fleet grounded, then resumed","kind":"disclosure","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.theregister.com/security/2026/11/13/quantum-systems-drones-back-in-the-air-after-malware-scare/5309658","status":"live","title":"Quantum Systems QBase malware in update — German Bundeswehr drones grounded then cleared to fly","url":"https://helix.ml/threat-watch/i/quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"karma365-mcp-npm-package-malicious-code-in-v2-1-0-fully-compromises-installed-machines-no-cve","incidentTitle":"karma365-mcp npm package — malicious code in v2.1.0 fully compromises installed machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-72xc-q3v8-7grp","status":"live","title":"karma365-mcp npm package — malicious code in v2.1.0 fully compromises installed machines (no CVE)","url":"https://helix.ml/threat-watch/i/karma365-mcp-npm-package-malicious-code-in-v2-1-0-fully-compromises-installed-machines-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"rclaude-darwin-x64-npm-package-malicious-code-full-machine-compromise-no-cve","incidentTitle":"@rclaude/darwin-x64 \u0026 @rclaude/darwin-arm64 npm packages — malicious code, full machine compromise (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-mq7w-jmv5-vq3p","status":"live","title":"Malicious @rclaude/darwin-arm64 variant confirmed — same full-compromise malware family now affects ARM64 macOS installs","url":"https://helix.ml/threat-watch/i/rclaude-darwin-x64-npm-package-malicious-code-full-machine-compromise-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"wanzforme-bails4u-npm-malicious-package-pins-unpinned-github-hosted-libsignal-dependency-enabling-arbitrary-code-executi","incidentTitle":"@wanzforme/bails4u (npm): malicious package pins unpinned GitHub-hosted libsignal dependency, enabling arbitrary code execution on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-38gh-x97r-9cx2","status":"live","title":"@wanzforme/bails4u (npm): malicious package pins unpinned GitHub-hosted libsignal dependency, enabling arbitrary code execution on install","url":"https://helix.ml/threat-watch/i/wanzforme-bails4u-npm-malicious-package-pins-unpinned-github-hosted-libsignal-dependency-enabling-arbitrary-code-executi"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-zxcvb90-utils-helper-exfiltrates-page-dom-to-webhook-site-collector","incidentTitle":"Malicious npm package zxcvb90-utils-helper exfiltrates page DOM to webhook.site collector","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2rfv-gw97-96gg","status":"live","title":"Malicious npm package zxcvb90-utils-helper exfiltrates page DOM to webhook.site collector","url":"https://helix.ml/threat-watch/i/malicious-npm-package-zxcvb90-utils-helper-exfiltrates-page-dom-to-webhook-site-collector"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"test-org-aczxvz-test-package-npm-malicious-init-exfiltrates-hmac-keys-and-bearer-tokens-to-attacker-webhook-no-cve","incidentTitle":"@test-org-aczxvz/test-package (npm): malicious init() exfiltrates HMAC keys and bearer tokens to attacker webhook (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-92mx-87xp-ppw9","status":"live","title":"@test-org-aczxvz/test-package (npm): malicious init() exfiltrates HMAC keys and bearer tokens to attacker webhook (no CVE)","url":"https://helix.ml/threat-watch/i/test-org-aczxvz-test-package-npm-malicious-init-exfiltrates-hmac-keys-and-bearer-tokens-to-attacker-webhook-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"r17d-sec-research-marker-npm-postinstall-script-exfiltrates-host-metadata-and-credential-path-inventory-to-webhook-site","incidentTitle":"r17d-sec-research-marker (npm): postinstall script exfiltrates host metadata and credential-path inventory to webhook.site","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7g8r-g568-m7rv","status":"live","title":"r17d-sec-research-marker (npm): postinstall script exfiltrates host metadata and credential-path inventory to webhook.site","url":"https://helix.ml/threat-watch/i/r17d-sec-research-marker-npm-postinstall-script-exfiltrates-host-metadata-and-credential-path-inventory-to-webhook-site"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"dependency-confusion-malware-wave-securihackbot-depconf-flow-1792484611-axon-web-math-helpers-extra-utils-quickgreet-npm","incidentTitle":"Dependency-confusion malware wave: @securihackbot/depconf-flow-1792484611, axon-web, math-helpers-extra-utils, quickgreet — npm packages exfiltrate host metadata on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fx6j-qp48-x4v4","status":"live","title":"Dependency-confusion malware wave: @securihackbot/depconf-flow-1792484611, axon-web, math-helpers-extra-utils, quickgreet — npm packages exfiltrate host metadata on install","url":"https://helix.ml/threat-watch/i/dependency-confusion-malware-wave-securihackbot-depconf-flow-1792484611-axon-web-math-helpers-extra-utils-quickgreet-npm"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"dependency-confusion-canary-malware-curse-allies-module-helper-agent-npm-beacon-to-webhook-site-and-mutate-local-service","incidentTitle":"Dependency-confusion canary malware: curse-allies-module \u0026 helper-agent (npm) beacon to webhook.site and mutate local services on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2hr9-fgpc-rp7w","status":"live","title":"Dependency-confusion canary malware: curse-allies-module \u0026 helper-agent (npm) beacon to webhook.site and mutate local services on install","url":"https://helix.ml/threat-watch/i/dependency-confusion-canary-malware-curse-allies-module-helper-agent-npm-beacon-to-webhook-site-and-mutate-local-service"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"internallib-v647-internallib-v811-npm-malicious-packages-install-unauthenticated-http-tarball-from-internal-ip-enabling","incidentTitle":"internallib_v647 / internallib_v811 (npm): malicious packages install unauthenticated HTTP tarball from internal IP, enabling arbitrary code execution on npm install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-pgx6-8rcf-2qrp","status":"live","title":"internallib_v647 / internallib_v811 (npm): malicious packages install unauthenticated HTTP tarball from internal IP, enabling arbitrary code execution on npm install","url":"https://helix.ml/threat-watch/i/internallib-v647-internallib-v811-npm-malicious-packages-install-unauthenticated-http-tarball-from-internal-ip-enabling"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"stylelint-standard-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve","incidentTitle":"stylelint-standard (npm) — malicious package compromises any machine where it is installed (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3qxq-88j2-x37v","status":"live","title":"stylelint-standard (npm) — malicious package compromises any machine where it is installed (no CVE)","url":"https://helix.ml/threat-watch/i/stylelint-standard-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-jsconvict-compromises-installers-machines","incidentTitle":"Malicious npm package jsconvict compromises installers' machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3c69-7f9m-gpvp","status":"live","title":"Malicious npm package jsconvict compromises installers' machines","url":"https://helix.ml/threat-watch/i/malicious-npm-package-jsconvict-compromises-installers-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malware-in-em-owa-walletconnect-sign-client-npm-full-compromise-of-installed-machines-no-patched-version","incidentTitle":"Malware in em-owa-walletconnect-sign-client (npm) — full compromise of installed machines; no patched version","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-q36f-8vwc-6vxm","status":"live","title":"Malware in em-owa-walletconnect-sign-client (npm) — full compromise of installed machines; no patched version","url":"https://helix.ml/threat-watch/i/malware-in-em-owa-walletconnect-sign-client-npm-full-compromise-of-installed-machines-no-patched-version"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"my-mcp-server-driving-license-ocr-pypi-malicious-mcp-ocr-tool-exfiltrates-driving-license-images-to-hardcoded-bare-ip-ov","incidentTitle":"my-mcp-server-driving-license-ocr (PyPI): malicious MCP OCR tool exfiltrates driving-license images to hardcoded bare IP over HTTP (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wg5f-m5mv-gmjg","status":"live","title":"my-mcp-server-driving-license-ocr (PyPI): malicious MCP OCR tool exfiltrates driving-license images to hardcoded bare IP over HTTP (no CVE)","url":"https://helix.ml/threat-watch/i/my-mcp-server-driving-license-ocr-pypi-malicious-mcp-ocr-tool-exfiltrates-driving-license-images-to-hardcoded-bare-ip-ov"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"2026-10-voice-synthesis-profiles-malicious-pypi-loader-packages-qwen3ttsui-voxcpmttslora-garvisometerui-download-and-exe","incidentTitle":"2026-10-voice-synthesis-profiles: malicious PyPI loader packages qwen3ttsui, voxcpmttslora, garvisometerui download and execute remote scripts","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jh3g-jv4f-xccp","status":"live","title":"2026-10-voice-synthesis-profiles: malicious PyPI loader packages qwen3ttsui, voxcpmttslora, garvisometerui download and execute remote scripts","url":"https://helix.ml/threat-watch/i/2026-10-voice-synthesis-profiles-malicious-pypi-loader-packages-qwen3ttsui-voxcpmttslora-garvisometerui-download-and-exe"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"fetchium-pypi-malware-covert-windows-loader-with-msi-dropper-and-run-key-persistence","incidentTitle":"fetchium PyPI malware: covert Windows loader with MSI dropper and Run-key persistence","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xjmc-fp37-3wx5","status":"live","title":"fetchium PyPI malware: covert Windows loader with MSI dropper and Run-key persistence","url":"https://helix.ml/threat-watch/i/fetchium-pypi-malware-covert-windows-loader-with-msi-dropper-and-run-key-persistence"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-mre-notificacao-react-full-system-compromise-on-install","incidentTitle":"Malicious npm package mre-notificacao-react — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-p5wc-vpqp-p35f","status":"live","title":"Malicious npm package mre-notificacao-react — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-mre-notificacao-react-full-system-compromise-on-install"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-tailwind-lines-clamps-compromises-installer-machines-no-cve","incidentTitle":"Malicious npm package tailwind-lines-clamps compromises installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-r79p-hc83-2mjh","status":"live","title":"Malicious npm package tailwind-lines-clamps compromises installer machines (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-tailwind-lines-clamps-compromises-installer-machines-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-packages-rampage-unpack-griffing-ui-pkg-griffing-ux-pkg-eigenlayer-sdk-full-host-compromise","incidentTitle":"Malicious npm packages rampage-unpack, griffing-ui-pkg, griffing-ux-pkg, eigenlayer-sdk — full host compromise","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6vpc-j6g3-7756","status":"live","title":"Malicious npm packages rampage-unpack, griffing-ui-pkg, griffing-ux-pkg, eigenlayer-sdk — full host compromise","url":"https://helix.ml/threat-watch/i/malicious-npm-packages-rampage-unpack-griffing-ui-pkg-griffing-ux-pkg-eigenlayer-sdk-full-host-compromise"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-i18n-site-cli-win32-x64-0-1-10-full-machine-compromise-rotate-secrets","incidentTitle":"Malicious npm package @i18n.site/cli-win32-x64 0.1.10 — full machine compromise; rotate secrets","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-m5f4-fvwx-j934","status":"live","title":"Malicious npm package @i18n.site/cli-win32-x64 0.1.10 — full machine compromise; rotate secrets","url":"https://helix.ml/threat-watch/i/malicious-npm-package-i18n-site-cli-win32-x64-0-1-10-full-machine-compromise-rotate-secrets"}],"feeds":{"changes":"https://helix.ml/threat-watch/c/supply-chain/changes.json","json":"https://helix.ml/threat-watch/c/supply-chain/feed.json","llms":"https://helix.ml/threat-watch/c/supply-chain/llms.txt","page":"https://helix.ml/threat-watch?c=supply-chain","rss":"https://helix.ml/threat-watch/c/supply-chain/feed.xml"},"generatedAt":"2026-11-15T20:59:36Z","site":"https://helix.ml/threat-watch"}