{"category":"all","changes":[{"body":null,"category":"breach","date":"2026-11-15","incident":"artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve","incidentTitle":"ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/fbi-warns-artex-ai-hacking-tool-is-powering-global-cyberattacks/","status":"live","title":"FBI warns ARTEX AI hacking tool is powering global cyberattacks, including a ConnectWise supply-chain breach compromising Microsoft 365 customer environments","url":"https://helix.ml/threat-watch/i/artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve"},{"body":null,"category":"breach","date":"2026-11-15","incident":"maileva-la-poste-group-cyberattack-exposed-personal-data-of-22-million-people","incidentTitle":"Maileva (La Poste Group): cyberattack exposed personal data of ~22 million people","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/15/hack-at-french-postal-unit-exposes-22-million-peoples-data/","status":"live","title":"Maileva (La Poste Group): cyberattack exposed personal data of ~22 million people","url":"https://helix.ml/threat-watch/i/maileva-la-poste-group-cyberattack-exposed-personal-data-of-22-million-people"},{"body":null,"category":"breach","date":"2026-11-15","incident":"tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found","incidentTitle":"TSMC: seller claims 46,000 employee records for sale; TSMC says data matches a cloud provider","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/tsmc-employee-data-breach-linked-to-cloud-provider/","status":"live","title":"TSMC confirms employee data leaked online and links it to a cloud provider","url":"https://helix.ml/threat-watch/i/tsmc-46-000-employee-records-6-9gb-offered-for-sale-on-underground-forum-no-intrusion-evidence-found"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"gatepay-sdk-python-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"gatepay-sdk-python (PyPI): malicious package exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-rp2f-46j6-grv4","status":"live","title":"gatepay-sdk-python (PyPI): malicious package exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/gatepay-sdk-python-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"theholocron-holocron-plugin-discord-npm-package-flagged-as-malware-full-host-compromise-no-cve","incidentTitle":"@theholocron/holocron-plugin-discord — npm package flagged as malware, full host compromise (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-95pv-hv63-58m8","status":"live","title":"@theholocron/holocron-plugin-discord — npm package flagged as malware, full host compromise (no CVE)","url":"https://helix.ml/threat-watch/i/theholocron-holocron-plugin-discord-npm-package-flagged-as-malware-full-host-compromise-no-cve"},{"body":"Member notice lists the exposed data (contact, profile, login IPs, hashed passwords, linked-account IDs, some private messages) and says CNIL and ICO were notified and a police complaint filed.","category":"breach","date":"2026-11-15","incident":"codingame-intruder-abused-an-internal-data-analysis-tool-to-copy","incidentTitle":"CodinGame: intruder abused an internal data-analysis tool to copy member databases; all passwords reset","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":null,"status":"live","title":"CodinGame emails all members: every account treated as affected, passwords reset, sessions revoked","url":"https://helix.ml/threat-watch/i/codingame-intruder-abused-an-internal-data-analysis-tool-to-copy"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and","incidentTitle":"GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client / gateio-v4 (PyPI) exfiltrate env vars and host data on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8chm-xj53-hg7h","status":"live","title":"Gateio typosquat campaign expands: gateio-v4 (PyPI) exfiltrates host info on install/import","url":"https://helix.ml/threat-watch/i/generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"node-zserial-npm-package-1-0-42-is-malware-full-machine-compromise-no-patched-version","incidentTitle":"node-zserial npm package 1.0.42 is malware — full machine compromise, no patched version","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2p2h-g9qq-v2wx","status":"live","title":"node-zserial npm package 1.0.42 is malware — full machine compromise, no patched version","url":"https://helix.ml/threat-watch/i/node-zserial-npm-package-1-0-42-is-malware-full-machine-compromise-no-patched-version"},{"body":null,"category":"supply-chain","date":"2026-11-15","incident":"crvouga-mockingbird-service-microsoft-npm-package-contains-malware-no-cve","incidentTitle":"@crvouga/mockingbird-service-microsoft npm package contains malware (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-w3gq-mm9x-7w7c","status":"live","title":"@crvouga/mockingbird-service-microsoft npm package contains malware (no CVE)","url":"https://helix.ml/threat-watch/i/crvouga-mockingbird-service-microsoft-npm-package-contains-malware-no-cve"},{"body":null,"category":"breach","date":"2026-11-14","incident":"maileva-data-breach-la-poste-subsidiary-exposes-names-and-addresses-of-22-million-people-in-france","incidentTitle":"Maileva data breach: intruders accessed names and postal addresses of 22 million people in France","kind":"disclosure","patchStatus":"unknown","severity":"medium","sourceUrl":"https://securityaffairs.com/203126/data-breach/data-breach-at-la-poste-subsidiary-maileva-affects-22-million-people-in-france.html","status":"closed","title":"La Poste announces theft of names and postal addresses of 22 million people from Maileva","url":"https://helix.ml/threat-watch/i/maileva-data-breach-la-poste-subsidiary-exposes-names-and-addresses-of-22-million-people-in-france"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"testpackage83-npm-malicious-package-downloads-and-executes-remote-binary-via-postinstall-and-on-import","incidentTitle":"testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-ccgw-9w4v-vqh2","status":"live","title":"testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import","url":"https://helix.ml/threat-watch/i/testpackage83-npm-malicious-package-downloads-and-executes-remote-binary-via-postinstall-and-on-import"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"ps-bool-pypi-malware-obfuscated-code-exfiltrates-photos-documents-to-telegram-bot-targets-android","incidentTitle":"ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fmcm-6g66-p65w","status":"live","title":"ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android","url":"https://helix.ml/threat-watch/i/ps-bool-pypi-malware-obfuscated-code-exfiltrates-photos-documents-to-telegram-bot-targets-android"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"demo-pingtest-xyz-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7r7f-5mcw-j79p","status":"live","title":"demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/demo-pingtest-xyz-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and","incidentTitle":"GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client / gateio-v4 (PyPI) exfiltrate env vars and host data on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-h6gp-mprh-hhhv","status":"live","title":"GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client PyPI packages exfiltrate env vars and host data on install","url":"https://helix.ml/threat-watch/i/generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and"},{"body":null,"category":"breach","date":"2026-11-14","incident":"n0n-extortion-group-claims-theft-of-1b-expedia-traveler-records-via-third-party-provider","incidentTitle":"Expedia: n0n claims ~1B traveler records stolen via unnamed third-party data platform provider","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://securityaffairs.com/203062/cyber-crime/extortion-group-claims-theft-of-nearly-one-billion-expedia-traveler-records.html","status":"live","title":"n0n extortion group claims theft of ~1B Expedia traveler records via third-party provider","url":"https://helix.ml/threat-watch/i/n0n-extortion-group-claims-theft-of-1b-expedia-traveler-records-via-third-party-provider"},{"body":null,"category":"breach","date":"2026-11-14","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.bleepingcomputer.com/news/security/us-disrupts-north-korean-campaign-behind-400-million-crypto-theft/","status":"live","title":"US government disrupts North Korean FaceStealer social engineering campaign behind $400M+ in stolen cryptocurrency","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":null,"category":"breach","date":"2026-11-14","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"other","patchStatus":"unknown","severity":"medium","sourceUrl":"https://databreaches.net/2026/11/14/statement-from-microsoft/","status":"live","title":"Microsoft issues apology statement, says broad recovery achieved and confirms outage was a technical issue unrelated to cyberattack or AI agents","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"malicious-pypi-package-xrfdc-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fmq9-qj28-89vh","status":"live","title":"Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-pypi-package-xrfdc-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"trezortranslate-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve","incidentTitle":"trezortranslate (PyPI): malicious package exfiltrates host info on install/import (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://github.com/advisories/GHSA-9fc6-4mrc-h6pp","status":"live","title":"trezortranslate (PyPI): malicious package exfiltrates host info on install/import (no CVE)","url":"https://helix.ml/threat-watch/i/trezortranslate-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve"},{"body":null,"category":"breach","date":"2026-11-14","incident":"faa-nationwide-ground-stop-after-air-traffic-control-communications-disruption-cyberattack-unconfirmed","incidentTitle":"FAA: nationwide ground stop after ATC communications disruption; cause unknown, cyberattack not confirmed","kind":"other","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.securityweek.com/no-signs-of-hacking-in-faa-ground-stop-as-fbi-reportedly-probes-software-update/","status":"live","title":"Officials report no signs of hacking; FBI reportedly probes a software update as the cause of the FAA ground stop","url":"https://helix.ml/threat-watch/i/faa-nationwide-ground-stop-after-air-traffic-control-communications-disruption-cyberattack-unconfirmed"},{"body":null,"category":"supply-chain","date":"2026-11-14","incident":"sfunction-dsh-screenshot-npm-package-is-malware-full-machine-compromise-for-installers-no-cve","incidentTitle":"@sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-7jf6-qwv2-qppp","status":"live","title":"@sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE)","url":"https://helix.ml/threat-watch/i/sfunction-dsh-screenshot-npm-package-is-malware-full-machine-compromise-for-installers-no-cve"},{"body":null,"category":"patch","date":"2026-11-14","incident":"php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618","incidentTitle":"Check Point gateways: PHP2Shell chain to root, webshells and ESXi wiper (CVE-2026-109618, CVE-2026-123039)","kind":"exploitation","patchStatus":"patched","severity":"critical","sourceUrl":"https://securityaffairs.com/203040/hacking/u-s-cisa-adds-check-point-and-unrealircd-flaws-to-its-known-exploited-vulnerabilities-catalog.html","status":"live","title":"CISA adds Check Point flaw (CVE-2026-114713) to KEV catalog, confirming active exploitation; UnrealIRCd flaw also added","url":"https://helix.ml/threat-watch/i/php2shell-check-point-gateways-attackers-chain-php-rce-local-privesc-to-root-deploy-webshells-and-wiper-cve-2026-109618"},{"body":null,"category":"patch","date":"2026-11-14","incident":"apache-shiro-defaultldaprealm-accepts-any-password-with-auth-caching-enabled-cve-2026-129349","incidentTitle":"Apache Shiro: DefaultLdapRealm accepts any password with auth caching enabled (CVE-2026-129349)","kind":"disclosure","patchStatus":"patched","severity":"critical","sourceUrl":"https://seclists.org/oss-sec/2026/q4/705","status":"live","title":"Apache Shiro: DefaultLdapRealm accepts any password with auth caching enabled (CVE-2026-129349)","url":"https://helix.ml/threat-watch/i/apache-shiro-defaultldaprealm-accepts-any-password-with-auth-caching-enabled-cve-2026-129349"},{"body":"In a written reply to Cyberattaque.org (undated in the article), Maileva confirms the theft of first name, surname and postal address for 22 million people, says it notified the CNIL and filed a complaint, and says a judicial investigation is open.","category":"breach","date":"2026-11-13","incident":"maileva-data-breach-la-poste-subsidiary-exposes-names-and-addresses-of-22-million-people-in-france","incidentTitle":"Maileva data breach: intruders accessed names and postal addresses of 22 million people in France","kind":"disclosure","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.cyberattaque.org/maileva-docaposte-la-poste-cyberattaque/","status":"closed","title":"Maileva confirms theft of identity data for 22 million people","url":"https://helix.ml/threat-watch/i/maileva-data-breach-la-poste-subsidiary-exposes-names-and-addresses-of-22-million-people-in-france"},{"body":"Per Cursor's 2026-11-13 post, the attacker used an access key Cursor had issued to Fireworks to copy data from a read-only storage bucket. The bucket held limited coding-agent traces, mostly from 2025, from sessions not in Privacy Mode. Cursor says fewer than 0.01% of customers had API credentials exposed, and that coding-agent traces were exposed for fewer than 0.05% of non-Privacy-Mode users. Credentials from that data then let the attacker reach select Cursor SaaS tools, from which it took archived non-production source repositories, limited customer support data and some user-submitted credentials. The post does not date the SaaS access. Cursor's account, not independently verified; Fireworks' bulletin does not mention Cursor.","category":"supply-chain","date":"2026-11-13","incident":"claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1","incidentTitle":"Claude Code extension (Cursor marketplace): tampered 2.1.312/2.1.313 plants SSH backdoor (no CVE)","kind":"victim","patchStatus":"patched","severity":"high","sourceUrl":"https://cursor.com/blog/security-incident-update","status":"closed","title":"Cursor: the Fireworks-issued key reached Cursor SaaS tools, archived repos and support data","url":"https://helix.ml/threat-watch/i/claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1"},{"body":"Cursor says the intrusion started with an access key it had issued to Fireworks, which the attacker used to copy data from a read-only Cursor storage bucket. A credential found in that exposed data was then used on 2026-10-29 to place the malicious 2.1.312 and 2.1.313 copies on the marketplace cache. Cursor says the last attacker activity it saw was on 2026-11-01, that it has moved inference off Fireworks, and that it has rotated exposed credentials. Cursor says the key was exposed by Fireworks and links Fireworks' bulletin, which does not mention Cursor. This is Cursor's account and is not independently verified.","category":"supply-chain","date":"2026-11-13","incident":"claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1","incidentTitle":"Claude Code extension (Cursor marketplace): tampered 2.1.312/2.1.313 plants SSH backdoor (no CVE)","kind":"other","patchStatus":"patched","severity":"high","sourceUrl":"https://cursor.com/blog/security-incident-update","status":"closed","title":"Cursor's November 13 post gives its account of how the builds were placed","url":"https://helix.ml/threat-watch/i/claude-code-extension-open-vsx-trojanized-anthropic-claude-code-2-1"},{"body":"As reported by The Record, the university says its investigation confirmed that personal information was stolen. It has not said what data was taken or whose. It is working to identify affected people and will contact them directly. MachForms remains offline, and the university is monitoring for further effects on its systems.","category":"breach","date":"2026-11-13","incident":"qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach","incidentTitle":"University of Texas at Arlington: university confirms personal information stolen; Qilin claims attack (no CVE)","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/university-of-texas-arlington-warns-data-breach","status":"live","title":"University confirms personal information stolen; MachForms taken offline","url":"https://helix.ml/threat-watch/i/qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach"},{"body":"Microsoft said it will publish a full report once its review is complete. No post-incident report was found in the sources checked.","category":"breach","date":"2026-11-13","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"advisory","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.spokesman.com/stories/2026/nov/13/on-day-2-of-massive-outlook-outage-microsoft-moves/","status":"live","title":"Microsoft says it will publish a full post-incident report","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":"At 21:44 UTC Microsoft said actions taken so far had not provided the anticipated relief, and it had no estimate for full recovery. Its 20:02 UTC update had promised another status update by 00:00 UTC on Saturday 14 November.","category":"breach","date":"2026-11-13","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.theregister.com/saas/2026/11/13/microsofts-massive-m365-outage-stretches-past-27-hours-as-its-fixes-keep-failing/5309609","status":"live","title":"Microsoft: earlier fix did not work; no recovery ETA (21:44 UTC)","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":"On Friday 13 November Microsoft said the incident was introduced by an issue during an earlier network capacity upgrade, and denied signs of cyberattack or rogue AI agents. Reported in KUOW and the Seattle Times. The same day Microsoft's own status text (reported by The Register) still described the underlying cause as unconfirmed.","category":"breach","date":"2026-11-13","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.kuow.org/technology/2026-11-13/microsoft-says-outage-not-caused-by-ai-or-cyber-attack","status":"live","title":"Microsoft attributes outage to an earlier network capacity upgrade","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":"Microsoft status update at 04:11 UTC: no indication this is the result of malicious activity. A second update at 05:46 UTC said Microsoft was not aware of any malicious activity causing the incident.","category":"breach","date":"2026-11-13","incident":"microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve","incidentTitle":"Microsoft 365 / Exchange Online global outage — email and cloud services down 24+ hours, no CVE","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.theregister.com/saas/2026/11/13/microsofts-massive-m365-outage-stretches-past-27-hours-as-its-fixes-keep-failing/5309609","status":"live","title":"Microsoft: no indication of malicious activity (04:11 UTC)","url":"https://helix.ml/threat-watch/i/microsoft-365-exchange-online-global-outage-email-and-cloud-services-down-12-hours-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-know-your-why-by-ken-costa-46wpa-fully-compromises-installers","incidentTitle":"Malicious npm package know_your_why_by_ken_costa_46wpa fully compromises installers","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-c378-v8c4-hpch","status":"live","title":"Malicious npm package know_your_why_by_ken_costa_46wpa fully compromises installers","url":"https://helix.ml/threat-watch/i/malicious-npm-package-know-your-why-by-ken-costa-46wpa-fully-compromises-installers"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6p5c-33pm-w6g4","status":"live","title":"Ebook-download npm malware cluster expands: 18 more dowload_ebok_* packages confirmed as fully compromising malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v5rg-fr44-xwrf","status":"live","title":"Ebook-download npm malware cluster grows: 17 more dowload_ebok_* packages (plus the_shaolin_workout) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-2f94-hq8v-53h8","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* (and one Nikon ebook) packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-f7vm-rh3w-xfxm","status":"live","title":"Ebook-download npm malware cluster expands with 17 more dowload_ebok_* packages (and ramses_the_battle_of_kadesh) fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"axiom-dragon-xyz-pypi-malware-install-time-infostealer-exfiltrates-crypto-wallet-and-cloud-credential-files","incidentTitle":"axiom-dragon-xyz PyPI malware — install-time infostealer exfiltrates crypto wallet and cloud credential files","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xxj6-4xmj-wx6q","status":"live","title":"axiom-dragon-xyz PyPI malware — install-time infostealer exfiltrates crypto wallet and cloud credential files","url":"https://helix.ml/threat-watch/i/axiom-dragon-xyz-pypi-malware-install-time-infostealer-exfiltrates-crypto-wallet-and-cloud-credential-files"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"pypi-malware-campaign-2026-11-testing1345-qap793gl4l-setup-py-install-hook-downloads-and-runs-remote-rat-script-no-cve","incidentTitle":"PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-rm58-9wp3-cwmv","status":"live","title":"PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE)","url":"https://helix.ml/threat-watch/i/pypi-malware-campaign-2026-11-testing1345-qap793gl4l-setup-py-install-hook-downloads-and-runs-remote-rat-script-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-4wm6-gm7f-w542","status":"live","title":"Ebook-download npm malware cluster expands: ~20 more dowload_ebok_* packages (plus one iPhone-guide package) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3v92-2fvx-qfvh","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-p5w2-x39v-7m34","status":"live","title":"New dowload_ebok package (dowload_ebok_the_lawrence_browne_affair_by_cat_sebastian_vi2g8, GHSA-p5w2-x39v-7m34) added to the ebook-download npm malware cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j828-q274-mm9j","status":"live","title":"Ebook-download npm malware cluster expands: ~20 more malicious dowload_ebok_* packages (plus campus_baby_by_lex_martin_htsnt) confirmed to fully compromise installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wg3p-w574-m5qp","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* (and one pure_*) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"patch","date":"2026-11-13","incident":"apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al","incidentTitle":"Apache HTTP Server mod_http2 RCE and mod_vhost_alias/mod_md flaws disclosed (CVE-2026-119618 et al.)","kind":"advisory","patchStatus":"patched","severity":"critical","sourceUrl":"https://webflow.sysdig.com/blog/httpd-cve-2026-119618-detecting-heap-corruption-and-rce-in-apache-http-server-mod-http2","status":"live","title":"Sysdig publishes detection guidance for heap corruption and RCE in Apache HTTP Server mod_http2 (CVE-2026-119618)","url":"https://helix.ml/threat-watch/i/apache-http-server-mod-http2-rce-and-mod-vhost-alias-mod-md-flaws-disclosed-cve-2026-119618-et-al"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-58f4-mpx2-frc9","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware (GHSA-58f4-mpx2-frc9 et al.), expanding the cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3f64-x867-x5x2","status":"live","title":"Ebook-download npm malware cluster grows: 13 more dowload_ebok_* packages (plus el_ano_que_llego_putin) confirmed as fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"zread-cli-npm-malware-malicious-cli-and-platform-binaries-fully-compromise-installed-machines","incidentTitle":"zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3429-mj25-c5wf","status":"live","title":"zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines","url":"https://helix.ml/threat-watch/i/zread-cli-npm-malware-malicious-cli-and-platform-binaries-fully-compromise-installed-machines"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cvg5-86p5-xpm9","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* packages (plus a fake 'Design Patterns' ebook package) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fp29-qgj4-rfhp","status":"live","title":"Ebook-download npm malware cluster expands: 19 more dowload_ebok_* (and phi_phi_island) packages confirmed as malware, full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hjjp-4f5p-39g8","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* (and one rasmus_klump) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qp63-c497-pc28","status":"live","title":"20 more malicious ebook-download npm packages (dowload_ebok_* plus el_rio_de_la_vida) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v592-6qpm-x6p7","status":"live","title":"Ebook-download npm malware cluster grows: ten more dowload_ebok_* packages (e.g. sanfte_rache, radium_girls, moon_knight) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8f57-g29h-rjmh","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (e.g. dowload_ebok_nuremberg_by_francis_biddle_pof88, dowload_ebok_persuasao_by_jane_austen_px4y8) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8g6q-hfvp-9mmf","status":"live","title":"Ebook-download npm malware cluster grows: nine more dowload_ebok_* packages (plus orgulhosamente_sos) confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v9cq-v7gh-wx9c","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (ebook-download cluster) confirmed — full machine compromise, rotate secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"other","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j3h7-rw3q-5789","status":"live","title":"Ebook-download dowload_ebok_* npm malware cluster grows with ten more malicious packages (e.g. dowload_ebok_the_beginner_s_bible_ety5v, dowload_ebok_juntos_es_mejor_gnroh)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cqj6-2v47-286r","status":"live","title":"Ten more dowload_ebok_* ebook-download npm packages flagged as malware (GHSA-cqj6-2v47-286r, GHSA-x4c5-h8f6-pg7g, GHSA-rc7r-4572-7jp6, GHSA-37c8-qh78-v93w, GHSA-95r4-828h-qgwj, GHSA-4jf6-g7jc-3wxm, GHSA-3fx8-cjwg-9m3j, GHSA-fx7q-v4vh-68x3, GHSA-49gf-xv7v-2m98, GHSA-x9wv-rrvc-v767)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jmg9-v87p-7jmv","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (GHSA-jmg9-v87p-7jmv and 9 others) confirmed as full-compromise malware in the ebook-download cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"other","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-vf5j-5gvq-4mcw","status":"live","title":"Nine more dowload_ebok_* malicious ebook packages added to the cluster (GHSA-vf5j-5gvq-4mcw and others)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"jelou-cli-win32-x64-npm-package-malicious-code-compromises-any-machine-where-version-4-26-1-is-installed-no-cve","incidentTitle":"@jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-q78g-75cg-hwq6","status":"live","title":"@jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE)","url":"https://helix.ml/threat-watch/i/jelou-cli-win32-x64-npm-package-malicious-code-compromises-any-machine-where-version-4-26-1-is-installed-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wvq7-93v4-m6fc","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages (e.g. dowload_ebok_moonwalk_by_michael_jackson_7z8ay, dowload_ebok_pulsation_by_vi_keeland_wxraw) confirmed as malware that fully compromises installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qcj3-5ggx-pf4p","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hvjx-644w-p82p","status":"live","title":"New dowload_ebok package (dowload_ebok_in_nacht_und_eis_by_fridtjof_nansen_2f4lr) confirmed as malware — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-qcw7-vqpv-6r8x","status":"live","title":"Ebook-download npm malware cluster expands: 19 more dowload_ebok_* packages plus conni_erzahlbande_24 flagged as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jcjq-hc9v-x22m","status":"live","title":"19 more dowload_ebok_* npm packages confirmed as malware, fully compromising machines that install them","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fgjw-mxhx-cxhh","status":"live","title":"New dowload_ebok package (your_3_best_super_powers by Sonia Choquette) added to the ebook-download npm malware cluster — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-pvpp-r3pr-2gjc","status":"live","title":"Ebook-download npm malware cluster grows: 20 more dowload_ebok_* packages (plus animal_farm_by_george_orwell_npad7) flagged as malware, fully compromising installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-4832-5gm5-7g35","status":"live","title":"Ebook-download npm malware cluster expands with ~19 more malicious dowload_ebok_* and ebook-titled packages (e.g. dowload_ebok_walk_of_shame_by_lauren_layne_33w19, apple_pro_training_series_by_david_nahmani_xvd91) causing full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"breach","date":"2026-11-13","incident":"screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a","incidentTitle":"ConnectWise ScreenConnect: unauthorized partner-account access used to deploy rogue remote-access software","kind":"exploitation","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.microsoft.com/en-us/security/blog/2026/11/13/sckit-abuses-screenconnect-deploy-remote-access-target-technician-sessions/","status":"live","title":"Microsoft details SCKit, a toolkit abusing ScreenConnect to deploy unauthorized remote access and target technician sessions, with Defender XDR hunting guidance","url":"https://helix.ml/threat-watch/i/screenconnect-rogue-client-campaign-connectwise-screenconnect-compromised-msp-environments-used-to-deploy-rogue-remote-a"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wwxm-44xv-6gjf","status":"live","title":"20 more dowload_ebok_* ebook-download npm packages confirmed as malware that fully compromise installer machines","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-pfv6-hwp2-qqw3","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* packages (plus the_name_of_the_wind_by_patrick_rothfuss_fvqm3) flagged as malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"rush-mfa-npm-package-is-malware-full-compromise-of-any-machine-where-installed","incidentTitle":"rush-mfa npm package is malware — full compromise of any machine where installed","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j4f5-mgch-g6xr","status":"live","title":"rush-mfa npm package is malware — full compromise of any machine where installed","url":"https://helix.ml/threat-watch/i/rush-mfa-npm-package-is-malware-full-compromise-of-any-machine-where-installed"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-gq55-g7fw-fr79","status":"live","title":"Ebook-download npm malware cluster expands: 14 more dowload_ebok_* packages (e.g. dowload_ebok_estres_postraumatico_5t7to, dowload_ebok_the_walking_dead_164_wcx6l) confirmed as malware, fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"other","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://securityaffairs.com/203012/cyber-crime/north-korea-crypto-theft-operations-doj-seizes-1-2-billion-and-disrupts-hacker-infrastructure.html","status":"live","title":"DOJ details $1.2B seizure and says the same DPRK hackers are now targeting open-source developers","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"},{"body":null,"category":"breach","date":"2026-11-13","incident":"artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve","incidentTitle":"ARTEX: open-source AI pentest agent used to turn leaked secrets into cloud access (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://therecord.media/artex-ai-tool-fbi-flash-alert","status":"live","title":"FBI flash alert warns Artex automates intrusions from targeting to privileged access in under three hours","url":"https://helix.ml/threat-watch/i/artex-ai-pentesting-tool-attackers-used-ai-agents-against-hundreds-of-orgs-via-leaked-secrets-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-hr3v-wv3m-mrx4","status":"live","title":"16 more dowload_ebok_* npm packages confirmed as malware, expanding the ebook-download cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"patch","date":"2026-11-13","incident":"dropbear-permitopen-permitlisten-bypass-via-unix-socket-forwarding-docker-sock-reachable","incidentTitle":"Dropbear: per-destination forwarding limits bypassed via unix sockets, docker.sock reachable","kind":"disclosure","patchStatus":"unpatched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/690","status":"live","title":"Dropbear permitopen/permitlisten bypass via unix-socket forwarding — docker.sock reachable","url":"https://helix.ml/threat-watch/i/dropbear-permitopen-permitlisten-bypass-via-unix-socket-forwarding-docker-sock-reachable"},{"body":null,"category":"breach","date":"2026-11-13","incident":"faa-nationwide-ground-stop-after-air-traffic-control-communications-disruption-cyberattack-unconfirmed","incidentTitle":"FAA: nationwide ground stop after ATC communications disruption; cause unknown, cyberattack not confirmed","kind":"disclosure","patchStatus":"unknown","severity":"high","sourceUrl":"https://www.securityweek.com/faa-ground-stop-issued-due-to-extraordinary-circumstances/","status":"live","title":"FAA nationwide ground stop after air traffic control communications disruption; cyberattack unconfirmed","url":"https://helix.ml/threat-watch/i/faa-nationwide-ground-stop-after-air-traffic-control-communications-disruption-cyberattack-unconfirmed"},{"body":null,"category":"patch","date":"2026-11-13","incident":"dixell-xweb-evo-refrigeration-controller-flaws-14-vulns-give-root-access-two-actively-exploited","incidentTitle":"Copeland Dixell XWEB EVO: 14 disclosed flaws give root on refrigeration controllers","kind":"disclosure","patchStatus":"partial","severity":"critical","sourceUrl":"https://cyberscoop.com/copeland-dixell-refrigeration-vulnerabilities/","status":"live","title":"Dixell XWEB EVO refrigeration controller flaws: 14 vulns give root access, two actively exploited","url":"https://helix.ml/threat-watch/i/dixell-xweb-evo-refrigeration-controller-flaws-14-vulns-give-root-access-two-actively-exploited"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-j2jf-336w-rr68","status":"live","title":"Ten more dowload_ebok_* malicious npm packages (paper girls, erin hunter, stoic, etc.) confirmed as full machine compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-86q5-32j9-x2qv","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* (and slave_by_mende_nazer) packages confirmed as full-compromise malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-cvxm-6533-8g38","status":"live","title":"18 more dowload_ebok_* npm packages confirmed as malware — full machine compromise, rotate all secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-3gf4-58w6-3mqx","status":"live","title":"Two more dowload_ebok_* ebook packages (caraval, la_caisse) flagged as malware — full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6ph4-56rh-rcm3","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages (plus dikkie_dik_bundel_geel) confirmed as fully compromising malware","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-jgmq-xhcq-cmfx","status":"live","title":"Ebook-download npm malware cluster grows: 19 more dowload_ebok_* (and one transgalactic_*) packages confirmed as malware, full machine compromise","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-6jvp-gjjc-5g26","status":"live","title":"New dowload_ebok package (estudando_o_evangelho by martins peralva) added to the ebook-download npm malware cluster — full compromise, rotate secrets","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-xxj5-pjp5-qcqm","status":"live","title":"Ebook-download npm malware cluster expands: 20 more dowload_ebok_* packages flagged as malware, fully compromising installers","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-packages-asavie-ui-and-asavie-i18n-flagged-as-malware-full-host-compromise","incidentTitle":"Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wwwv-86vw-pg9w","status":"live","title":"Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise","url":"https://helix.ml/threat-watch/i/malicious-npm-packages-asavie-ui-and-asavie-i18n-flagged-as-malware-full-host-compromise"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"advisory","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v5rj-pm56-3mp5","status":"live","title":"16 more dowload_ebok_* ebook-download malware packages flagged (GHSA advisories), expanding the cluster","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-tailwindcss-hook-forms-0-5-2-full-system-compromise-on-install","incidentTitle":"Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-8j4g-6q77-9w6p","status":"live","title":"Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install","url":"https://helix.ml/threat-watch/i/malicious-npm-package-tailwindcss-hook-forms-0-5-2-full-system-compromise-on-install"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-kampodra-0-8-16-full-system-compromise-on-install-no-cve","incidentTitle":"Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-57xg-9jqp-97gm","status":"live","title":"Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-kampodra-0-8-16-full-system-compromise-on-install-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"malicious-npm-package-hauntview-0-2-9-full-system-compromise-of-installed-machines-no-cve","incidentTitle":"Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v244-m2jr-cmc2","status":"live","title":"Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE)","url":"https://helix.ml/threat-watch/i/malicious-npm-package-hauntview-0-2-9-full-system-compromise-of-installed-machines-no-cve"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"testing1345-pypi-malicious-package-installs-rat-via-setup-py-remote-script-download","incidentTitle":"testing1345 (PyPI): malicious package installs RAT via setup.py remote script download","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-w462-j2j5-xmp7","status":"live","title":"testing1345 (PyPI): malicious package installs RAT via setup.py remote script download","url":"https://helix.ml/threat-watch/i/testing1345-pypi-malicious-package-installs-rat-via-setup-py-remote-script-download"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"node-global-key-listener-v9-npm-malicious-package-compromises-machines-that-install-it","incidentTitle":"node-global-key-listener-v9 (npm): malicious package compromises machines that install it","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-vh6f-827c-9wqg","status":"live","title":"node-global-key-listener-v9 (npm): malicious package compromises machines that install it","url":"https://helix.ml/threat-watch/i/node-global-key-listener-v9-npm-malicious-package-compromises-machines-that-install-it"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve","incidentTitle":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-wh8h-578j-wh6x","status":"live","title":"Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installers (no CVE)","url":"https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve"},{"body":"The Record reports ActiveCloud said main services were restored by Friday 13 November. Individual customers were still having problems, including with restoring some virtual machines.","category":"breach","date":"2026-11-13","incident":"ransomware-attack-on-belarusian-cloud-provider-activecloud-disrupts-hosting-email-and-vm-services-for-days","incidentTitle":"Ransomware attack on Belarusian cloud provider ActiveCloud disrupts hosting, email and VM services for days","kind":"status","patchStatus":"unknown","severity":"medium","sourceUrl":"https://therecord.media/belarus-cloud-provider-activecloud-ransomware-attack","status":"live","title":"Main services restored; some customers still resolving individual issues","url":"https://helix.ml/threat-watch/i/ransomware-attack-on-belarusian-cloud-provider-activecloud-disrupts-hosting-email-and-vm-services-for-days"},{"body":"The university's investigation confirmed that personal information was stolen. Scope, data types and affected individuals are not yet determined. MachForms is offline.","category":"breach","date":"2026-11-13","incident":"qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach","incidentTitle":"University of Texas at Arlington: university confirms personal information stolen; Qilin claims attack (no CVE)","kind":"victim","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://therecord.media/university-of-texas-arlington-warns-data-breach","status":"live","title":"University says personal information was stolen in a cybersecurity incident","url":"https://helix.ml/threat-watch/i/qilin-ransomware-university-of-texas-at-arlington-personal-data-of-students-employees-stolen-in-breach"},{"body":null,"category":"supply-chain","date":"2026-11-13","incident":"quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly","incidentTitle":"Quantum Systems QBase: reported malware in ground-control update; Bundeswehr fleet grounded, then resumed","kind":"victim","patchStatus":"unknown","severity":"medium","sourceUrl":"https://www.bleepingcomputer.com/news/security/german-military-drone-operations-disrupted-by-cyberattack/","status":"live","title":"Quantum Systems confirms late-October incident was an active cyberattack by hostile actors disrupting German military drone operations","url":"https://helix.ml/threat-watch/i/quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly"},{"body":null,"category":"patch","date":"2026-11-13","incident":"postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws","incidentTitle":"PostgreSQL 14-18 update: 52 CVEs fixed, many allow code execution by a database user","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://thehackernews.com/2026/11/postgresql-patches-52-flaws-including.html","status":"live","title":"PostgreSQL update highlights CVE-2026-6460, a 22-year-old type confusion authenticated RCE (CVSS 8.8) requiring C extension rebuilds for full protection","url":"https://helix.ml/threat-watch/i/postgresql-bulk-security-update-fixes-52-cves-incl-many-rce-flaws"},{"body":null,"category":"breach","date":"2026-11-13","incident":"tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure","incidentTitle":"TraderTraitor / FaceStealer: DOJ seizes or restrains $1.2B of Binance crypto, disrupts FaceStealer infra","kind":"disclosure","patchStatus":"no-fix-needed","severity":"high","sourceUrl":"https://www.stepsecurity.io/blog/accurasofthire-fake-interview-developer-machines","status":"live","title":"JFrog exposes AccuraSoftHire fake-interview campaign behind the Binance theft; malicious npm packages from the task stayed installable for months","url":"https://helix.ml/threat-watch/i/tradertraitor-facestealer-binance-doj-seizes-1-2b-stolen-crypto-and-disrupts-nk-social-engineering-infrastructure"}],"feeds":{"changes":"https://helix.ml/threat-watch/changes.json","json":"https://helix.ml/threat-watch/feed.json","llms":"https://helix.ml/threat-watch/llms.txt","page":"https://helix.ml/threat-watch","rss":"https://helix.ml/threat-watch/feed.xml"},"generatedAt":"2026-11-15T20:42:50Z","site":"https://helix.ml/threat-watch"}