Poisoned Pipeline / Changelog

Changelog

What changed in this catalogue. Dated, meant to be skimmed. Git history remains the audit trail.

2026-10-26

Gheist mass workflow planting on stolen GitHub tokens

AS334: Wiz Research's Gheist campaign, tracked since 15 September, plants .github/workflows/sync-check.yml on a ci-sync-<six chars> branch in every repository a stolen GitHub token can reach — 13,500 branches across 850 accounts, personal projects to enterprise private repositories. The workflow prints env and toJSON(secrets) into its own run log in base32, which defeats verbatim secret masking, and the operator pulls the log back through the GitHub API and deletes the run seconds later. A job matrix over deployment environments reaches environment-scoped production secrets. A later self-hosted job sweeps the runner host through the Docker socket, /proc/*/environ and 31 token formats. GitHub's July approval hold stopped every public-repo run at action_required; private repositories and GitHub Enterprise Server had no such hold.
T0219: added for the mechanism that carries this story — secrets printed into a pipeline's own log and collected later from the platform's log API, so no attacker domain and no outbound connection exist for egress control to catch. Distinct from T0192 (reading logs that already hold secrets) and T0145 (data hidden inside a legitimate outbound channel).
Skipped: CVE-2026-111497 (Brotli, Node2Shell/Broccoli2Shell) and the PHP2Shell follow-ups remain vulnerability disclosures with no malicious publish, and the XRPL payment-engine overflow is a bug in the chain's own code. Cargo dependency cooldowns and the GitHub package firewall are platform defaults.
Skipped as already carried or out of scope: Sansec's deepveindrilling.com wave is mass Magento storefront compromise through a CMS block loader, not a poisoned supplier artifact; Mandiant's AOMEI update-channel tampering is AS309; the Midnight Blizzard hash-expansion piece is targeted espionage with lure files; CrowdStrike's four agentic AI actors are intrusions, not supply-chain publishes.
Same-day recheck: SafeDep (testmetest, hugo-paper/mevn-cli), CloudSEK (NEBULA), Socket's LiteLLM timeline, StepSecurity (GhostAction), ReversingLabs (Graphalgo), Aikido, Checkmarx Zero, RubyGems, Rust blog and the GitHub changelog carried nothing new that is not already mapped.

2026-10-25

Second sources for eMudhra, LiteLLM, Tensorlake and Graphalgo

AS311: the eMudhra CA key story now carries Checkmarx Zero's account of the April 2025 key-generation ceremony (a wrap/unwrap step produced a weak second set, only the weak set was published), SafeDep's developer response guide, Aikido's write-up and the Mozilla-run incident site with the eight intermediates and the per-client patch table.
AS313: Socket recovered two earlier malicious workflow commits in BerriAI/litellm, on 10 and 12 October, each adding cache.yml on a short-lived branch and each recorded as a successful run. LiteLLM's follow-up traces initial access to an Agent Platform master key committed to a public repository in May and never revoked, so the compromise window is at least eleven days, not the two-hour release window. Description and the compromised-token mapping updated; Socket, Wiz and Aikido write-ups added as links.
AS302: the Tensorlake npm compromise now also cites Checkmarx Zero on the hostage-token monitor that deletes a home directory.
AS40: ReversingLabs' 21 October piece on Graphalgo moving into Terraform providers and Go modules added as a second source. It reports Aikido's September research, so it is the same operation, not a new story.
Skipped: CVE-2026-111497 (Brotli, marketed as Node2Shell) and its Python, Bazel Central Registry, workerd and DuckDB follow-ups are vulnerability disclosures with no malicious publish. PHP2Shell, the BeyondTrust CVE-2026-102764 exploitation and the Go x509 deny-list release are the same class. GitHub changelog and cargo dependency-cooldown items are platform defaults, not incidents.
Skipped as outside the catalogue's scope: the Sansec deepveindrilling.com wave is mass Magento storefront compromise through a product flaw and CMS block injection, not a poisoned supplier artifact, and the Wiz ARTEX expansion against other vendors' identity providers is attempted intrusion already carried in AS329.

2026-10-25

Railway build secrets; OpenCode Console; Rank Math PRO; Zeabur

AS330: Railway identified a privilege escalation in its build infrastructure on 20 October and halted pipelines. A preliminary report says the attacker later decrypted CI artifacts and a subset of customer environment variables, searching for AI-provider API keys. Upper bound given is 1.85 percent of workspaces, about 100,000. The exploit itself is unpublished. Not merged with other October disclosures the vendor did not name.
AS331: OpenCode said on 17 October that a distillation attack breached Console accounts for 1.4 percent of users, the subset with external AI providers linked (Anthropic, OpenAI, Google). Root cause and whether those credentials were copied are unpublished. Scoped to Console, not to every CLI install.
AS332: Rank Math PRO 3.0.123 files downloaded from 20:02 UTC on 15 October to 07:12 UTC on 16 October contained malware. Activation can plant a backdoor that recreates itself and calls rank1cdn.com. The free WordPress.org plugin was not the affected build. How the files were poisoned is unpublished.
AS333: Zeabur said an external attacker accessed internal systems and some customer services on 14 October, a wider event than one in late August. Entry vector and what was taken are unpublished. The same post announces the platform is winding down; that decision is not the attack.

2026-10-24

Site rebranded to Poisoned Pipeline on poisonedpipeline.com

Brand: SCIC is gone from every page. The site is now Poisoned Pipeline, with the name in the nav wordmark, page titles, breadcrumbs and the home heading. The catalogue subtitle still describes what it is: a catalogue of software supply-chain incidents.
Canonical address is https://poisonedpipeline.com. Site links and the Plausible data-domain derive from SITE_BASE, so the old github.io path no longer appears in page chrome.
GitHub Pages config is generated by the build: docs/CNAME holds poisonedpipeline.com, and robots.txt and sitemap.xml (951 URLs) are emitted each run so a rebuild cannot drop them.

2026-10-24

testmetest npm worm; ConnectWise Cloud Backup application identities

AS328: fifteen npm names ending in testmetest, published 19-22 October from the operator's own accounts. SafeDep says event-bus-lite-testmetest 0.0.1 carried a Miasma-family worm (no install script; node-gyp starts it) that steals credentials, republishes, plants AI-agent files, and deletes the home directory if the stolen GitHub token is revoked. No third-party victim in the write-up. Registry reads on 24 October show the armed name unpublished later the same day. Not merged with AS50.
AS329: ConnectWise disabled seven Cloud Backup (formerly SkyKick) application identities at 07:00 UTC on 17 October after unauthorized access. Microsoft assesses Storm-0940 used those credentials, sped up with ARTEX, to attempt sign-in to more than 2,250 customer tenants that had already granted the apps, with Key Vault secret reads in some environments. How the vendor identities were taken is unpublished. Backup archives are a separate negative finding from ConnectWise.

2026-10-23

NCSC SCEG supply-chain incident-response guidance; mitigations page added

Reviewed "Developing Incident Response and Management with your Supply Chain" (NCSC ICS Community of Interest Supply Chain Expert Group, Colin Topping, July 2023). It is process guidance, so no new attacker techniques — but it exposed a real gap: all 123 mitigations in the corpus were technical or platform-side, and none addressed living with a supplier compromise.
Added M1932 contractual incident-notification clause (named recipient, reporting template, SLA from the supplier's own detection, reciprocal public-disclosure terms, NDA/TLP set at the same time); M1933 supplier-specific incident playbook (risk profile, stakeholders, standing connection inventory including OT paths, the question set, joint exercises); M1934 named and tested fallback route per critical supplier service (manual operation, queued-transaction reconciliation, second source, spares).
M1932 and M1933 attached to T0112, T0209, T0205, T0109 and T0135. M1934 is left unattached: the technique set is attacker behaviour only and has no availability element, which is recorded as a gap rather than forced.
New /mitigations/ index and a page per mitigation, listed in the nav. Every mitigation record now has a destination and shows the techniques that reference it; previously they rendered only as IDs inside technique pages.

2026-10-23

MITRE supply-chain framework and 2021 lifecycle casebook reviewed; five gaps filled

MITRE MTR140021 Supply Chain Attack Framework (41 attack patterns, Dec 2013): reviewed as guidance, no new techniques. About two thirds of the patterns are hardware counterfeiting, ASIC/firmware substitution and shipping-channel interception — outside a software-delivery corpus. The software patterns duplicate existing techniques (altered compilers to T0170, dev-tooling tampering to T0154, malicious update to the update-channel family). Two classes have no counterpart and are left as gaps: insider tampering with requirements/design so faults are built in (A13–A17) and deliberate build-data misconfiguration (A30).
The 2021 lifecycle casebook named five incidents with no story here. Added from the cited primary research: AS323 Operation SignSight (two VGCA installers on ca.gov.vn replaced, ESET), AS324 Operation StealthyTrident (Able Desktop update server, LuckyMouse/TA428, ESET), AS325 AppleJeus (counterfeit crypto trading apps, CISA/FBI/Treasury AA21-048A), AS326 GoldenSpy (backdoor in bank-mandated tax software, Trustwave), AS327 WIZERVA VeraPort (plugin installed malware signed with stolen certificates, ESET). The other five cases were already covered: SolarWinds, NotPetya, ShadowHammer, Copay/event-stream, dependency confusion.
Verified along the way that AS5 CCleaner and AS8 Polyfill.io were already correct. AS321 citation tidied: the BleepingComputer write-up is the report, with the inf0stache and IntelFusions originals plus the OX Security finding now linked.

2026-10-23

OpenSSF S2C2F reviewed as defender guidance

Added S2C2F (Secure Supply Chain Consumption Framework) to the guidance review and the watch list. Its 13-threat OSS-consumption table maps to incidents the catalogue already carries — CCleaner (build compromise), ua-parser-js (registry-account takeover), eslint and event-stream (repo and dependency compromise), typosquats, dependency confusion, node-ipc (license-change sabotage). No new attacker techniques: S2C2F is the consumption-side control set (ingest, scan, inventory, update, audit, enforce, rebuild, fix) for threats this corpus describes from the attacker side. Three threat classes stay incident-free here (post-build artifact tampering, upstream takedown, end-of-life components) — supply risks, not attacker techniques.

2026-10-23

Pointer-corpus pass; two gaps added, two links attached

Walked the internal pointer index (never cited) against the catalogue. NEW: AS321 — 24 npm packages abusing trusted registry mirrors to host ClickFix/fake-Cloudflare phishing redirect pages (BleepingComputer); the mirror is the abused trusted asset, no install-script involved. NEW: AS322 — Docker Hub CVE-2026-105445 (GhostPat): account→org conversion re-assigned personal access tokens to the new owner without revoking them, 26-month window, ~304k transfers reviewed, no abuse found (Docker advisory).
ATTACH: AS313 LiteLLM gained the Datadog Security Labs primary; AS311 eMudhra gained Cloudflare's mitigation post.
Verified already covered: OVHcloud (AS310), LiteLLM (AS313), eMudhra (AS311), MALFEX imgdecode (AS297), AUR yay (AS308), Apex Accelerator (AS307), Docker GhostAction (AS304), TraderTraitor Terraform (AS305), Graphalgo (AS40), WeaselBiscuit (AS32), llms.txt dependency confusion (AS29), Virtualizor BGP (AS291), OpenInfra Artifactory (AS190), Rust fake-job (AS18/AS305), TanStack + CrowdSec (AS16), Unit42 Web3 C2 (AS28), Mandiant assistant (AS27), PhantomRaven (AS26), sckit (AS39), Brevo (AS19), Hades (AS30), GHAPPIER (AS34), Sonatype Q3 index (AS65), rogue-AI publish (AS65), AI protestware (AS181).
SKIP as non-incidents per the corpus rules: defensive research (Trail of Bits package-manager integrity study, arXiv model-signing gap, Skill Constellations, Modelstamp, SBOM divergence, CASHEWS, ImportMine, KEVGraph, DistillGuard, git-signing study, market-for- lemons), platform defenses (npm recovery-code holds, GitHub package firewall), and vuln-only advisories with no malicious publish (VulnCheck TLS-verification-off wave, AWS IoT SDK, Bouncy Castle MLS, fsspec jinja, Composer bin-escape).

2026-10-22

New technique T0218; historical TLS trust incidents backfilled

New technique T0218 Compromise TLS trust identity (Defense Evasion) — the attacker holds a CA or intermediate private key that client trust stores accept and mints certificates for domains they do not control. The TLS half of AS311 eMudhra now maps here; the gap note on AS311 is closed.
Backfilled the historical class: AS314 Comodo reseller RA account (nine fraudulent certs for mail.google.com and friends, March 2011, observed live on addons.mozilla.org), AS315 DigiNotar breach (wildcard google.com used in Iran; Fox-IT Black Tulip report via archive), AS316 TURKTRUST (a server certificate issued as an intermediate CA, December 2012), AS317 ANSSI (intermediate run inside a MITM appliance, December 2013), AS318 MCS Holdings on CNNIC (same failure, March 2015), AS319 Symantec test certificates (23 disclosed, 164+2458 found via CT; progressive distrust 2015-2017), AS320 WoSign/StartCom (github.com issued without authorization, SHA-1 backdating; trust removed 2016-2017).
All mapped from root-program operator posts (Google Online Security Blog, Mozilla). Trustwave 2012 is recorded in the AS320 gap note — the canonical Mozilla post is no longer served and archive.org rate-limited this environment during the pass.

2026-10-22

Web Hacking Techniques Index added to the watch list

New source row: webhacklist.com, Soroush Dalili's (irsdl) preservation archive of web-hacking technique write-ups 2006 onwards. Tracked at the current-year page. Discovery and archive backfill only — public citations must be the original research URL each record credits, never webhacklist itself. No RSS; non-supply-chain technique posts classify SKIP under the normal rules.

2026-10-22

eMudhra intermediate CA keys added; new certificates/trust-stores platform

AS311: the private keys of eight eMudhra intermediate certificates are single-byte P-384 scalars (4, 56, 115, ...), recoverable in under a second from the public certificates. Six TLS issuing CAs and two code-signing CAs, created April 2025 and cross-signed by Sectigo's AAA root. Reported 17 October to Apple, Google, Microsoft, Mozilla, and eMudhra; Chrome CRLSet that evening, Firefox OneCRL hours later; Mozilla announced publicly and removed the root from NSS on 20 October, Chrome root store v43 confirmed. Source: Scott Helme's 20 October write-up. Mapped to T0208 for the code-signing half. The TLS half has no technique in the corpus — recorded as a gap. No rogue certificate from the weak keys has been publicly reported.
New platform id pki (Certificates / trust stores), filed under the deploy stage in the five-stage cut.

2026-10-20

GlassWorm-hijacked account swapped OVHcloud CLI release assets

AS310: Release assets of ovh/ovhcloud-cli v0.11.0 to v0.15.0 were replaced through the Releases API on 19 October, 12:47 to 13:12 UTC, by the contributor account HassenBF. No tag push and no workflow run. The binary is a dirty local go build (pseudo- version, vcs.modified=true) of a 13 October commit. Mainstream platform archives and checksums.txt were swapped; i386, Windows arm64, and WASM were not. A downstream CI that pinned a SHA-256 caught it in 94 minutes; OVHcloud deleted the assets and shipped immutable, attested v0.16.0 from a service account. OpenSourceMalware links the account to GlassWorm via March amend-and-force-push preinstall loaders and a known Solana dead-drop wallet, and says that linkage is an inference. go install, source builds, and the internal Docker image were not affected. https://github.com/ovh/ovhcloud-cli/issues/300 https://opensourcemalware.com/blog/glassworm-hacks-ovh-clouds-cli-tool
No other new operation. SafeDep's latest post is the 18 September mathmain loader. The 18 October items (Trail of Bits package- manager integrity study, the model-signing arXiv paper) are defensive research, not incidents; the Databricks LLM-triage piece is a tooling write-up.

2026-10-17

AUR yay typosquat and AOMEI update-config windows

AS308: marchos1as typosquatted yay on the AUR (aur-general, 13 October). Fifteen lookalikes were enumerated (ay through yzy, including yyay). yyay reuses the real yay 13.0.1 tarball and runs a root install scriptlet that pipes a gitflic.ru script into a shell. The fetched script was not recovered. An AUR trusted user banned the account and deleted the packages the same evening. Not the June orphan wave (AS201) or the July adoption halt (AS202). https://lists.archlinux.org/archives/list/aur-general@lists.archlinux.org/thread/L3TGW6CC6WCX32VKEXLFAYDWCQXA2ICZ/
AS309: UNC7017 tampered with AOMEI update configuration for five to ten minutes at a time, April–July 2026 (Mandiant, 15 October; METAL, 16 October). Clients still requested the real hosts. down_html.ini redirected the archive and rewrote the MD5. Confirmed windows are 28 May, 16 July, and 20 July. CROSSROAD staged SHINYROAD. How the origin was written is not described. A restored ini does not clean an endpoint. https://cloud.google.com/blog/topics/threat-intelligence/investigating-ephemeral-supply-chain-tampering/ https://www.manageengine.com/threat-analysis-lab/aomei-backupper-supply-chain-compromise.html
No other new operation. Tracked posts since 16 October were product notes, a podcast, hardening, a Magento product RCE, and intrusion reports that never touch a registry, an update channel, or CI. BeyondTrust CVE-2026-102764 is appliance exploitation, not a shipped update. LiteLLM CVE-2026-59822 honeypot hits are gateway RCE, not a package publish. The AISI Astra note is a simulated CTF, not a victim.

2026-10-16

GhostAction fake-font stage

AS304 gained the 16 October OpenSourceMalware write-up. Same operation, not a new story. On 15 October the operator committed a hidden folderOpen task and public/fonts/fa-solid-400.woff2 into a cluster of 94 repositories. The font is 38 lines of plain Node.js. It reads cloud, registry, git, and AI-tool credential files, posts to 193.32.204.199:8080, and installs a five-minute cron that pipes /c2/ plus the hostname to bash. The returned script was not recovered. Platforms now include vscode and workstation. https://opensourcemalware.com/blog/ghostaction-copycats-polinrider-by-hiding-a-stealer-in-a-fake-font-file
AS45 gained the same URL for one overlapping repository. daxitzadafiya/bagisto-dhs also has a 25 June PolinRider Tailwind loader. No shared indicator with the October files.
No other new operation. Tracked posts since 14 October were product notes, a podcast, hardening write-ups, and intrusion reports that never touch a registry or CI. GitHub Actions workflow lockfiles are a platform control, not an incident.

2026-10-14

Apex Accelerator npm agent and MALFEX native loader

AS307: Elastic REF8801 (12 October). @apexacc/cli and @apexacc/audit were malicious from first publish. Same publisher as the July @copilot-mcp/apex republish (AS86); the audit package is a later campaign, not that republish. The cli repackages Oh My Pi, redirects OpenRouter to arena.apexaccs.org, and registers an attacker MCP server. The audit tools return fabricated findings. macOS verification drops CloudSyncD. Windows stages a Telegram stealer. No named victim organisation. https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages
AS297 gained the 13 October SafeDep write-up. imgdecode, published by malfexteste8, moves the MALFEX loader into a prebuilt Windows Node addon. require runs it during module init, with no install script, and only from an interactive console. Version 1.0.3 was still on npm on 13 October. Same cavecrew/proj staging repo. SafeDep has not confirmed that banner.jpg is the recovered banner.png payload. Same operation, not a new story. https://safedep.io/malfex-imgdecode-npm-native-addon-loader/
No other new operation. Docker Hub CVE-2026-105445 reassigned personal access tokens on account-to-org conversion. Docker reviewed about 304,000 transferred-token pushes and found no exploitation. Not a story. The 13 October ReversingLabs note is agents publishing screenshots to finish a task, not a malicious package. CrowdStrike Famous Chollima on 13 October is laptop-farm employment fraud, not a registry or CI compromise. GitHub changelog rows were product notes. https://www.docker.com/blog/docker-hub-security-advisory-cve-2026-105445/

2026-10-13

Azazel GitLab CI harvest

AS306: Azazel, a Gentlemen affiliate, harvested GitLab CI secrets and called a local MCP tool (CloudSEK, 5 October). One GitLab instance hosted pipelines for two organisations. One CI token opened the second organisation's databases and three cloud hosts. A SaaS platform token reached more than a dozen of that platform's clients and hundreds of source repositories. va.py called exec_in_session on 127.0.0.1:35367. No malicious package. Initial GitLab access is not described. forgitlab.com is the operator's staging host, not a victim GitLab. Chain B, an imaging-API URL fetch against one AI company, is not this harvest. https://www.cloudsek.com/blog/caught-in-4k-the-gentlemen-files
No other new operation. Tracked posts since 12 October were GitHub changelog product notes (push attribution, Dependabot organisation registries), already mapped GhostAction and Tensorlake write-ups, and CISA AA26-281A, which is a network intrusion and not a package or CI compromise. Sansec's visible index still tops out at the 16 September Brevo post. Checkmarx Zero still tops out at the 17 September btree post.

2026-10-12

TraderTraitor Terraform provider, GhostAction phishing

AS305: TraderTraitor interview repositories ship a weaponized Terraform lock file. terraform init then downloads the provider from registry.hashicorp-aws.com, registry.hashicorp-aws.io, or registry.hashicorp-terraform.io. Zscaler's July binary, terraform-provider-awsbeta_v1.0.0, calls package awsbeta from main, so it runs when Terraform starts the provider, then fetches a Bash loader from hashicorp-terraform.io. The loader decrypts a fake .woff into FLATROOF. ROOFDECK resolves C2 through a signed Pastebin drop, then Nostr. SentinelOne (18 September) documents the lock files and a second victim, an IT-services DevOps MacBook, implants present from 18 March. Delivery of the July binary itself was not established. Not published on the official Terraform registry. The April LayerZero / KelpDAO case is the same provider lure; the 292 million dollar mint is the reported outcome, not a separate technique. https://www.zscaler.com/blogs/security-research/suspected-tradertraitor-group-uses-trojanized-terraform-provider-deliver https://www.sentinelone.com/labs/dont-call-us-well-call-your-apis-tradertraitor-backdoors-resurface-on-victim-with-no-crypto-ties/ https://layerzero.network/publications/kelpdao-incident-report.pdf
AS304 gained the 11 October phishing write-up. A GitHub security lure on my-github.com, same IP 193.32.204.199, proxies login and silently approves an OAuth device flow for repo, workflow, and read:org. The recovered email's form submission was not proven. Same operation, not a new story. https://opensourcemalware.com/blog/ghostaction-phishing-campaign
AS65 and AS28 gained the 8 October Sonatype Q3 index, which names those two operations and does not add a package. allianceauth-workflows and dough-synth embed a model refusal string. Sonatype says neither package is malicious. Not a story. https://www.sonatype.com/blog/q3-2026-open-source-malware-index-when-compromise-compounds
No other new operation. Tracked posts since 10 October were a Copilot JetBrains changelog note, product and how-to posts, the already mapped GhostAction and Tensorlake write-ups, a RubyGems beta release, CISA ICS rows, and a Magento product zero-day that is not a registry or CI compromise. Sansec's visible index still tops out at the 16 September Brevo post.

2026-10-10

GhostAction October workflow wave

AS304: GhostAction on 8 October. kitao (13:20-13:44 UTC, 27 repositories, including kitao/pyxel) and henrywoo (21:10-21:26 UTC, 318 repositories) pushed security-audit.yml under the victim identities. uber/athenadriver went straight to master. The workflow templates named Actions secrets and greps the tree plus git log -p --all, then POSTs cleartext to 193.32.204.199. athenadriver run 37846728441 got OK from that host. pyxel templated PyPI and crates.io token names; no malicious publish was observed. Same operation as the 7 October GitGuardian return (772 repositories, 31 August-30 September, same IP). 2025 origin used a different endpoint. A Socket same-day update, clock left blank on the page, says more than 500 accounts since 7 October. https://www.stepsecurity.io/blog/ghostaction-returns https://socket.dev/blog/ghostaction-cloud-credentials https://opensourcemalware.com/blog/ghostaction-attack-escalates https://blog.gitguardian.com/ghostaction-github-actions-supply-chain-attack-returns/
No other new operation. Tracked posts since 9 October were product notes, a podcast episode, an arXiv skills paper, an ASOS push-note extortion claim, a Midnight Blizzard telemetry recap, CrowdStrike ARTEX against South Korean finance, a WhatsApp-to-SYSTEM intrusion write-up, GitHub changelog product items, and CISA ICS rows. Sansec's visible 2026 index still tops out at 25 August.

2026-10-09

NEBULA fake AI SDK packages, Tensorlake follow-up

AS303: seven npm packages posing as a NebulaAI SDK, published from burner accounts nebulallms through nebulallms4 (CloudSEK, 8 October). preinstall drops a modified KNTRAT to a fake conhost.exe path and beacons to 65.87.7.132. api-nebula and llm-nebula were still installable when CloudSEK checked. No named victim. MAL-2026-17531 and five earlier malware ids. Not a typosquat of a real package. https://www.cloudsek.com/blog/nebula-fake-ai-sdk-npm-packages-windows-rat
AS302 gained the same-day SafeDep, Aikido, and Socket write-ups. The npm version endpoint for 0.5.144 returned 404 on 9 October. latest is 0.5.145, published 20:24 UTC on 8 October. Maintainers merged pull request 1016 at 04:32 UTC. MAL-2026-17650 covers 0.5.144. SafeDep's salt match ties the payload to the keyv wave; the publish stays its own story. https://safedep.io/tensorlake-npm-compromise-mini-shai-hulud
No other new operation. Tracked posts since 8 October were product notes, a podcast episode, a Midnight Blizzard telemetry recap that does not touch a registry, CISA advisory AA26-281A (network intrusion, not a package or CI compromise), and KEV or ICS rows.

2026-10-08

Tensorlake npm hostage-token worm

AS302: tensorlake@0.5.144 (StepSecurity, 8 October; npm registry time 01:12 UTC; still latest at collection). Thirteen commits on main of tensorlakeai/tensorlake, e90c47b through 6386121, authored as Shanshan Wang (cooleel). The first was a web-UI upload. cooleel then dispatched the TypeScript SDK release workflow (Actions run 37706134202). The package has a real provenance attestation of that build. preinstall skips CI, downloads Bun, and runs an obfuscated stealer. Stolen npm tokens republish the victim's packages. Stolen GitHub tokens commit a Claude SessionStart hook and a VS Code folderOpen task as claude@users.noreply.github.com. gh-token-monitor deletes the home directory or Windows profile if the stolen GitHub token is revoked. Compromise of the named account is not established. No GHSA or OSV id, and no named downstream victim. New technique T0216 for the wipe. https://www.stepsecurity.io/blog/tensorlake-npm-compromised-hostage-token-worm
AS60 gained the 7 October Socket note of 16 further Firefox Add-ons (Rabby and OKX clones). Socket assesses this is the same August campaign, not a new operation. Mozilla had unpublished them as of 5 October. https://socket.dev/blog/firefox-crypto-wallet-stealers
AS28 gained Unit 42's August ChainDrop analysis and the 8 October note on Web3 command-and-control in that worm. Same keyv / cacheable operation. https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/
AS35 gained the same 8 October Unit 42 note for the PolinRider section (Web3 C2 across npm, Go, and Packagist). Not a new package. https://unit42.paloaltonetworks.com/web3-cloud-supply-chain-attacks/
No other new operation. Tracked posts since 7 October were product notes, CRA commentary, a ransomware affiliate write-up (Gentlemen), CISA KEV adds for Citrix NetScaler (already noted) and Zammad, and a package-detection paper.

2026-10-07

Second-lab notes on four existing incidents

AS25 gained the 6 Oct ReversingLabs recap of indexed-btree. Same runtime loader, not a new package. Command-and-control was still up when they wrote. https://www.reversinglabs.com/blog/npm-dependency-installation-security-measure-defeated
AS297 gained the 5 Oct Checkmarx Zero write-up of MALFEX. Same operator. The title phrase about signing their work is branding (publisher handles, git author, README name), not a code-signing identity. MAL-2026-17320 covers only cdn-img-fetch 1.0.0 and 1.0.1. https://checkmarx.com/zero-post/malfex-npm-malware-campaign-three-payloads-and-an-adversary-that-signs-their-work/
AS85 gained the 28 Sep OX Security count of the same Baileys channel-follow campaign: 101 packages, about 490,000 downloads, 16 removed as of that date. git tag added for the GitHub-hosted channel list. https://www.ox.security/blog/phantomsub-malicious-npm-campaign-secretly-adds-users-to-whatsapp-spam-channels/
AS190 gained the OpenInfra Europe notice that Nordix Artifactory was compromised on 31 Aug 2026 through CVE-2026-82329. Downloads from artifactory.nordix.org between 28 Aug and 15 Sep 2026 should be treated as potentially tampered. https://openinfraeurope.org/
No new operation. Other tracked posts since 6 Oct were product notes, a git-history how-to, ICS advisories, or the Citrix NetScaler KEV add CVE-2026-88779.

2026-10-06

RubyGems crypto-shell gems and SubQuery 5.8.3

AS300: reqthrottle_3474 published 42 malicious RubyGems on 5 October (SafeDep; OpenSourceMalware, profile name Ghost Dev). Sixteen names are typosquats; the rest pose as crypto utilities. extconf.rb runs at gem install, skips CI and sandboxes, then either opens a reverse shell to 45.138.12.177 or downloads a wallet-theft kit. MAL-2026-17598 covers eth-keystore-utils. No confirmed downstream victim in either report.
AS301: @subql/common@5.8.3 (StepSecurity, 5 October; GHSA-9333-3c4x-x3h5, MAL-2026-17571). Unsigned commits on a short-lived branch, account ianhe8x, were not merged to main. The release workflow curls an unverified tarball from ci-artifacts.dev and the published package starts a credential collector on install and on import. Compromise of the named person is not established. The embedded secret-dumping workflow was not observed on a victim repo. Investigation still open in subquery/subql issue 3047.
Other tracked feeds in this window were already mapped or not a supply-chain attack: Socket GlassWorm theme cluster already on AS55; Socket customer, podcast, CTF, and package-manager posts; GitHub changelog product notes; CISA KEV adds for Citrix NetScaler and Zammad; CrowdStrike product posts; Aikido listicles; Wiz product posts; Rust and RubyGems release notes; Morphisec commentary; Sansec had no post newer than the mapped Brevo write-up; GTIG feed last built 30 September. Aikido's GitLab incoming-email write-up is their own test of a product bug, not an in-the-wild publish.

2026-10-05

CI/CD threat matrix tab

New tab /cicd.html. Technique names follow Mercari Security Team's Common Threat Matrix for CI/CD Pipeline (Hiroki Suezawa, CODE BLUE 2021, https://github.com/rung/threat-matrix-cicd). Descriptions are ours. The source repo has no license, so the mitigation tables were not copied.
36 catalogued incidents mapped where the write-up describes that pipeline behavior. A cicd-saas tag alone was not enough. Nine techniques have no named case here (IaC injection, SSH to a runner, production-config edits, implanted runner images, admin approver changes, cross-repo secret-manager access, cloud metadata from the runner, monorepo folder creds, pipeline DoS).
AS298: April 2022 stolen Heroku and Travis CI OAuth tokens used to clone private GitHub repos, including npm's (GitHub advisory, Travis bulletin, Heroku incident 2413). AS299: October 2023 Diamond Sleet and Onyx Sleet exploited TeamCity CVE-2023-42793 (Microsoft). Not added: TeamCity CVE-2024-27198, which is a disclosure and researcher proof, not a victim campaign in the sources read.

2026-10-05

MALFEX npm campaign added

AS297 MALFEX (CloudSEK, 30 Sep; full report in their PDF). One operator, August 2023 through September 2026, at least twelve npm packages. function-flag, cdn-img-fetch, and function-color were still unadvised and installable; Arm A droppers (tlxbnhd, tldriver, mxdriver) already had MAL-2026-16383/16384/16385. Install scripts fetch a Windows PE served as image/png, then a signed AutoIt3 interpreter and an overlord-client build with live Solana-memo C2. Arm B stages a Node stealer from the operator GitHub repo cavecrew/proj. Platforms npm/windows/git/workstation. No confirmed downstream victim in the report. Gaps left for blockchain dead-drop C2, content-type staging, latest-tag rollback, and Windows scheduled-task persistence.
AS55 gained the 2 Oct Socket theme-cluster write-up (same GlassWorm loader, not a new operation). AS27 gained the 2 Oct SafeDep recap of the Mandiant assistant-hijack case.
Other tracked feeds in this window were already mapped or not a supply-chain attack: OpenSourceMalware Show #23, ReversingLabs retrospective of known campaigns, StepSecurity sckit, Aikido listicles, Wiz product posts, GitHub changelog platform features, Rust 1.99.0, RubyGems 4.0.22, CISA KEV adds (Citrix, Zammad, FortiMail), GTIG Citrix and ShinyHunters notes, Checkmarx CRA guidance, CrowdStrike product and ClickFix posts. Socket's GPT-6 Astra item is a simulated CTF, not an in-the-wild publish. Morphisec's RSS channel had no items.

2026-10-03

Every incident re-checked for secondary platform surfaces

Walked all 295 stories against the write-up text. 118 platform tags added across ~110 incidents. Workstation on every case where the developer machine or build server is in the chain (AS1 Webmin build server, AS11/AS15/AS46 maintainer takeovers that harvest from the machine, AS74 Nx, AS193 PAT cloning). Update channel on SolarWinds, NotPetya/M.E.Doc, HandBrake, Monero CLI, TradingView ad, Linux Mint ISO, vsftpd. Windows/Linux/macOS on cross-platform payloads. Git on GitHub-hosted stages and lure repos. CI SaaS where the CI identity was the publish path.
Five malformed platforms lists fixed (indentation made one list parse as a single string). All tags now validate against the vocabulary.
Not stamped: cloud and Kubernetes mentions that are stolen loot or attacker IPs, Codeberg as an attacker host on DirtyBlanket is still recorded as a code host because the worm was served from it. No Buildkite or GCP incident exists.

2026-10-03

Stage tags added where the write-up names that system

New platform IDs: workstation, circleci, gitlab-ci, azure-pipelines, buildkite, gitlab, bitbucket, codeberg, aur, aws, gcp, azure, kubernetes, update-channel.
Applied only where the incident write-up says that system was the supply-chain step, not where it was stolen loot. AUR on AS200–AS202 and AS295. CircleCI on AS14 and the Team PCP victim set (AS17, with GitLab CI, Azure Pipelines, Jenkins, Bitbucket). Workstation on AS5, AS14, AS28, AS192. Update channel on signed-update and installer cases (CCleaner, ShadowHammer, Notepad++, DAEMON Tools, FossHub, PEAR, PureScript, VestaCP, fwupd, Microsoft counterfeit installers, corepack.org, MacSync).
Not applied: AWS/GCP/Azure/Kubernetes mentions that are stolen credentials or attacker IPs. Codeberg on DirtyBlanket is the attacker download host, not a compromised project. No Buildkite or GCP incident in the corpus. Those IDs are in the vocabulary only. Pipeline charts sit at the bottom of each stage box.

2026-10-03

Five-year timelines under each pipeline stage

/pipeline.html now has a 5-year incident chart under each stage, same axis on every column. The number on a bar is the count. Bar height is scaled within that column so a small stage is still readable. Ten-year blocks were not used: they would hide the 2015–2019 to 2025–2029 jump.

2026-10-03

MacSync signed fake Claude Desktop installers added (AS296, T0215)

AS296 MacSync (OpenSourceMalware verified report, 19 Sep; initial intel Jamf Threat Labs): the lookalike download site claude-desktop.com serves signed and notarized fake app installers (Claude Desktop, TeleGlass, RelayArc, Antigravity lures) as DMGs. A stage-one helper.sh inside each DMG pulls a JSON C2 config from a jsdelivr-mirrored GitHub repo (daynotest/daynoteupd[a|t]), stages the DayNote Mach-O payload from anchorpost13.com / download-storage.com, and beacons to onyxsable8.com. Every DMG is signed by the OSMAN ASTUR Developer ID (Team ID 8T6UCTT38A) — an identity the attacker enrolled, not a stolen vendor certificate — so Gatekeeper installs with no warning. New technique T0215 (enroll attacker-owned code-signing identity) added with technique-origin entry, distinct from T0208 (compromise code-signing identity). Platforms macos/ai-agents.
Re-walked every track:true source. The rest of this window was already mapped or is not supply-chain: OpenSourceMalware Show #23 covers the ShinyHunters and KillSec arrests (hosts state neither group has been active in software supply chain) and the Bitget exchange-backend heist (SlowMist attributes initial access to a security-product zero-day, no software-supply-chain intrusion); PolinRider A/B testing (.woff2 renamed to 500/900/300, moved into legitimate folders, then given a .llf extension) attached to AS45; the Baileys campaign topping 100 npm packages attached to AS85; Aikido Shai-Hulud republish after 111 days is the same campaign as AS48/AS49; Checkmarx Cyber Resilience Act post is compliance guidance; GitHub changelog items are platform features (stateless App installation tokens, Copilot API support, security-advisory comment APIs, macOS 14 runner retirement); Socket feed items (Laravel Lang, Coruna art-template, Go decimal, node-ipc, @antv wave) all map to existing stories; SafeDep newest items are Sckit/MemTensor on AS39 plus the DirtyBlanket and Mini Shai-Hulud follow-ups already mapped; Rust blog, RubyGems blog, CISA, Sansec, CrowdStrike, Wiz, Google Threat Intelligence, and ReversingLabs show nothing new in this window.

2026-10-02

Unlinked preview of a five-stage supply-chain cut

/pipeline.html is not in the nav. It sorts existing platform and realm tags into development environment, code repository, CI/CD, artifact/container, and deployment/cloud/exec. Nothing was retagged. The page states where that cut is thin.

2026-10-02

DirtyBlanket npm worm and VHX Harvester vast.ai panel added (AS295, AS294, T0214)

AS295 DirtyBlanket (SafeDep, 29 Sep): nine npm packages from one throwaway account (eight Express lookalikes, one React) whose preinstall hook fetches stage one through the Internet Archive Wayback Machine (network sees trusted web.archive.org, script unversioned and swappable), pulls the worm from Codeberg, installs the open-source CHAOS RAT as a fake systemd font service over a Tor hidden service (renamed config keys, InsecureSkipVerify, immutable root binary), then propagates via SSH keys against known_hosts peers, poisoned AUR package pushes, and npm tokens publishing infected versions before restoring the original package.json. Platforms npm/linux/git.
AS294 VHX Harvester (CloudSEK TOPHIT Part 2, 29 Sep): the @prime0 npm typosquat infrastructure (85 packages beaconing to 69.48.229.140:8080) hosts an offensive panel that, against the vast.ai GPU marketplace, enumerated 297 hosts, scanned 13,368 endpoints, exfiltrated metadata from 416 services, deployed 25 bridge agents, and reached one root shell on a Jupyter notebook; a misconfiguration exposed the full agent source with hardcoded credentials. New technique T0214 (rent co-located containers to scan an isolated network) added with technique-origin entry; stored XSS into the Caddy auth proxy error logs and npm typosquats as a cloud-recon vector recorded as gaps, not force-mapped.
SafeDep's PolinRider Ethereum-C2 post (30 Sep) attached to AS45 — same campaign, dead-drop C2 in Ethereum transaction recipients, 35 repos with the loader at HEAD, no new incident.
Re-walked every track:true source. Everything else this window was already mapped or is defensive/product content: Socket GPT-6 Astra AISI report on AS65, Mini Shai-Hulud re-enablement on AS197, Firefox Google ATO on AS141, MemTensor on AS39, PolinRider Packagist on AS35; ReversingLabs retrospective, LLM pen-testing, agentic-permissions, AI-cyber-spending essays and Twilio on AS38; Checkmarx btree on AS25, React2Shell2/CRA/n8n product and vulnerability posts; OpenSourceMalware show episodes and PolinRider A/B testing on AS35; CrowdStrike PhantomRaven on AS26, Forrester and data-classification posts; Morphisec AMTD, polymorphic, ransomware-delivery and FortiBleed essays, RevStealer on AS290; Wiz Blue Agent, Infostealer Incursion, Forrester, WIN/AI-engine posts, Artifactory on AS190; Google Threat Intelligence feed (BREEZE COMET, Flows clusters, UNC6671 vishing, Ghost DPAPI, GTIG AI tracker) is credential/endpoint activity, not software-supply-chain attacks; Batten Down Your Packages is mitigation guidance for already-mapped incidents; GitHub changelog platform features (custom runner settings, Node 20 retirement, SSH security improvements, proof-of-presence, stage-only npm tokens); CISA KEV adds and token-protection publications; Sansec (no new research since the ClickFix explainer on AS289/AS194); Rust blog Cargo maintainer announcement; RubyGems blog (no new security items in 2026).

2026-10-01

OSC&R named only on the matrix page; talks are boxes

Guidance, incidents, stories, techniques, and origins no longer frame the site as OSC&R. The matrix page still says the catalogue uses OSC&R and maps incidents onto it.
Conference talks use the same responsive box grid as platforms.

2026-10-01

Platform index is a responsive grid of boxes

/platforms/ is no longer a stack of full-width cards. Each platform is a box with its incident count. The grid wraps from one column on a phone to as many as fit.

2026-10-01

Homepage no longer shows mitigation, detection, or platform counts

Those numbers had no page that explained the items. Mitigations and detections are IDs on technique pages only. The platform chart and /platforms/ lists stay; the bare count does not.

2026-10-01

Stop calling OSC&R out in site chrome

Banner, footer, homepage, and About no longer explain OSC&R or say it is one part of the catalogue. The matrix page says the catalogue uses OSC&R and maps incidents onto it.

2026-09-30

Autonomous AI-agent crypto-theft fleet added (AS293, T0213)

AS293 CloudSEK AI-Agent-Driven Offensive Operation (19 Aug): an exposed operator staging host serving the full working home folder (21,442 directories, 142,262 files) revealed two campaigns driven by an autonomous AI-agent fleet — Claude Code, Codex, and open-source Hermes and pi agents in full-auto mode with every safety approval disabled, tasked and monitored entirely over Telegram. Campaign 1: internet-wide opportunistic exploitation (12,048 compromise records, 8,996 sites, fastjson2 deserialization RCE kit, FOFA-corpus recon). Campaign 2: targeted crypto/DeFi theft (clone sites of a DeFi codebase — the one legitimate unmodified site returned 403 and leaked nothing; 2,250 real EVM/Solana wallet addresses with derivation paths; live paid Helius/QuickNode RPC keys extracted from client-side bundles and confirmed working in production). Platforms ai-agents/windows/linux; new technique T0213 (Orchestrate AI-agent fleet as the intrusion workforce) added with technique-origin entry — distinct from T0210 (poisoned agent config) and T0152 (hijacked live session). Deserialization RCE and blockchain C2 recorded as gaps, not force-mapped.
Re-walked every track:true source. Everything else this window was already mapped or is defensive/product content: SafeDep Jev/Gryph agent-detection and Mini Shai-Hulud reinfection on AS197, sckit/MemTensor on AS39, OpenAI-agents RubyDoc proxy on AS37; ReversingLabs npm/Twilio campaign on AS38, Claude Code Security/agentic-permissioning/ AI-cyber-spending essays; Checkmarx btree on AS25, JSX-to-SVG/React2Shell2 CVE product posts; OpenSourceMalware WeaselBiscuit on AS32, PolinRider A/B testing on AS35, show episodes; Morphisec polymorphic/fortibleed/signed-sealed essays and product posts; Wiz Artifactory on AS190, AWS sign-up/LiteLLM Off Guard/agent-intent engine and honeypot product/research; Google Threat Intelligence topics feed (ShinyHunters Oracle PeopleSoft/PeopleSoft war, GTIG AI tracker, UNC7005/UNC5976 phishing) is credential/endpoint activity, not software-supply-chain attacks; GitHub changelog platform features (proof-of-presence, stage-only npm tokens, workflow execution protections, credential inventory exports); CISA KEV catalog adds and token-protection publications; Sansec ClickFix clipboard hijacker (endpoint, same class as AS289/AS194); Rust and RubyGems blog items (Cargo CVE advisories, May spam-publishing campaign update already on AS37); CrowdStrike ClickFix explainer and SafeMind product posts.

2026-09-29

Virtualizor BGP-hijack update attack and Microsoft counterfeit installers added (AS291, AS292)

AS291 Virtualizor/Softaculous BGP hijack (BleepingComputer, 28–30 Aug; Softaculous advisory): a BGP route hijack of a Hetzner IP block rerouted Virtualizor update/billing requests to attacker servers, delivering a malicious update package with persistence at /etc/systemd/system/java-jre-update.service; Softaculous now signs all packages. Platforms linux/windows; new technique T0212 (Subvert network routing to intercept update traffic) added with technique-origin entry, plus T0180/T0121 for the supply-chain stage and T0159/T0148/T0184 on the host.
AS292 Microsoft counterfeit-installer campaign (Microsoft Defender Experts, 1 Sep): vendor-look-alike download sites (.com.cn/.hl.cn, Razer/Edge/Kaspersky/Baidu et al., moderate-confidence Silver Fox/Yinhu) deliver installer archives whose families (app_setup.*, zinst.*, zintall.*, intsoft.*, innstll.*) keep the same filename while contents regenerate server-side per download, defeating URL/hash reputation; randomized-path stage-one with stable hash, fabricated version metadata with unfilled TODO placeholder, repurposed TrueUpdate runtime fetching from Alibaba Cloud OSS. Platforms windows/cdn; T0136/T0110/T0207 for the distribution stage, T0159/T0148/T0176/T0184 on the victim machine. Server-side regeneration recorded as a gap, not force-mapped.
Re-walked every track:true source. Everything else this window was already mapped (Aikido Shai-Hulud 111-day reactivation and Clean-Release resurfaces on AS48/AS16, OX PhantomSub Baileys spam-subscribe on AS85, ReversingLabs OpenAI/HF mob-agent postmortem on AS16/TanStack + AS26/PhantomRaven references, StepSecurity sckit/MemTensor on AS39, CloudSEK BRIDGEHEAD/TXTBOOK/LiteLLM on AS114/AS115/AS17, Wiz Artifactory on AS190, Aikido Graphalgo on AS40, Aikido XCSSET Flutter on AS116, Socket PolinRider Packagist on AS35, Morphisec polymorphic/fortibleed essays and product posts, GitHub changelog platform security defaults, CISA advisories, RubyGems/Rust blog items) or is defensive research, show episodes, and advisory items, already classified.

2026-09-27

RevStealer fake-Claude Electron stealer added (AS290)

AS290 RevStealer (Morphisec Threat Labs, 31 Aug): Windows infostealer inside trojanized Electron apps distributed from GitHub repositories and game-cheat sites; notable lure a fake “Claude Opus 5 Free Desktop” project impersonating Anthropic and advertising free access to a paid model. Platforms git/windows/ai-agents; T0110/T0136/T0197 for the distribution stage, T0159/T0184 for the victim machine. Encrypted exfil and self-deletion recorded as gaps, not force-mapped.
Re-walked every track:true source. Everything else this window was already mapped (SafeDep actions-cool reinfection on AS197, Checkmarx npm btree on AS25, CrowdStrike PhantomRaven September follow-up and PyPI twin on AS26, SafeDep OpenAI-agents RubyDoc proxy on AS37, sckit MemTensor 23 Sept on AS39, PolinRider Packagist on AS35, tw-pkgprobe-7731 on AS38, WeaselBiscuit on AS32, Brevo Cloudflare Worker on AS19, Rust targeted-attacks on AS18) or is product posts, show episodes, defensive research, and advisory items, already classified.

2026-09-26

DEF CON 29–33 supply-chain and AI talks scanned

Walked DEF CON 29, 31, 32, and 33 speaker pages, and the DEF CON 30 presentation index (speakers page 404s). Added 16 talks to content/portal/talks.yaml. Technique IDs only where the abstract describes that technique.
Mapped: GitHub Actions Worm (T0122/T0169), VS Code Workspace Trust (T0152), XZ backdoor story (T0111/T0121), Grand Theft Actions (T0132/T0111), OH-MY-DC (T0183), CloudQuarry (T0103), tj-actions reconstruction (T0122), abandoned S3 buckets (T0205).
Recorded, not mapped: pickle/ONNX/TorchScript model-file talks, Gemini calendar promptware, Copilot data-void C2, solar firmware supply chain, SAST-scanner RCE in CI. No technique names a malicious model file or a scanner-as-execution primitive.
Reviewed and left out: IDE product bugs (Worming through IDEs), tractor/farm device talks, browser-extension API bugs, Defender update hijack, Windows Downdate, Llama 3 red-team process. Not this field.
Black Hat USA/EU/Asia 2021–2025 not added. Schedule pages are Cloudflare-blocked from here, and the extract that gets through returns session times without titles. USA 2026 remains the only Black Hat walk with named talks.

2026-09-26

DEF CON 34 talks catalogued; two new mappings, four recorded as gaps

Talks are entries in content/portal/talks.yaml, rendered at /talks.html. Not attack stories. A technique ID is set only when the abstract describes that technique.
Mapped: “Your WAF Blocked Us” (Sternberg/Poran/Bobrov) onto T0210 — Sentry Seer poisons Cursor, persistence is config poisoning. “Hacking the Hackers who Hack Hackers” (Morag, FirewallFalcon) onto T0110 and T0197 — Telegram-advertised OSS tool installed outside a registry, ships a backdoor. Not T0109 (no registry upload) and not T0138 (not a commit into someone else's repo).
Recorded, not mapped: OffGuard (LiteLLM MCP auth bypass / sandbox escape / SSRF — no technique for an AI-gateway control plane), One Chain to Own Them All (torch.load of attacker weights, CVE-2026-24747 — not a registry publish), Breaking Local AI Runtimes (llama.cpp/Ollama memory corruption; the abstract says it is not prompt injection), Data Tomb Raider (M365 Copilot parameter-to-prompt — not T0210).
Previously named DEF CON 34 and Black Hat USA 2026 talks are in the same catalog, with per-talk anchors where the speakers page has them. Black Hat entries still point at the schedule index.

2026-09-26

Placeholder domain third-party.com turned live ClickFix server (AS289)

New AS289 (Manifold Security): third-party[.]com — a documentation placeholder in 1,500+ files across 1,700+ repositories (Chromium docs, Sanity/Vercel skills, MCP-server docs) — is not IANA-reserved and was registered by someone else. Since at least June 2026 it has served a Windows-gated ClickFix lure (fake Cloudflare check, clipboard poisoning, Win+R → PowerShell irm elxxvvx[.]xyz/f | iex). macOS/Linux crawlers get a benign decoy, so reputation feeds and static checks see nothing; IPFire listed and de-listed it in July for exactly that reason. Platforms: cdn, ai-agents, windows.
Follow-up (24 Sep, same team) attached: 350,000+ GitHub files cite placeholder domains serving scams — parking pages your-domain[.]com / yoursite[.]com served macOS scareware and counterfeit BBC/ZDF investment-fraud pages in 2 of 16 macOS renders; every static check cleared them.
OSM PolinRider A/B-testing follow-up (26 Sep) attached to AS35: force-pushed fa-solid-500.woff2 (3 Sep) and fa-solid-900.woff2 (25 Sep, all three Binary-Mindz repos within eight minutes) variants evade keyword detections; 853 recovered force-pushes document the 8-month infection.
Socket “Happy Birthday, Shai-Hulud” one-year retrospective (18 Sep) attached to AS48 — same incident, retrospective coverage.

2026-09-25

DEF CON 34 supply-chain talks added as technique origins

Walked the DEF CON 34 talks index. Mapped: “Install Me Maybe: Turning Claimable VS Code Extension IDs into Supply-Chain Attacks” (T0115/T0154), “LGTM: Bypassing an LLM Build Gate When Prompt Injection Fails” (T0207), “The Sandbox is a Suggestion” + “No Prompt Required: Pre-Task RCE in Gemini CLI” + “Hacking Your Life with AI” + “Escaping Copilot Studio’s Sandbox” (T0210), “No Socket, No Privs, No Problem: Weaponizing OCI Registries” + “Compounding Interest: Exploiting the ATM Supply Chain” (T0209).
Conference feeds (Black Hat briefings, DEF CON talks) are now a tracked kind in sources.yaml — origin material, re-read per event.

2026-09-25

Conference talks added as technique origins (Black Hat USA 2026)

Walked the Black Hat USA 2026 briefing schedule. Talks are not incidents — they are added as origin material on the matching techniques, not as attack stories.
Mapped: “GitHub Can Tell You’re Being Hacked” (T0118/T0122 — EDR for GitHub event streams), “The CoreBreak Attack” + “Kinetic Prompt Injection” + “Caging the Agent” (T0210), “Pwning Agentic Browsers with PleaseFix” + “No Tools Required: Post-Injection Exploitation Across AI Agent Frameworks” (T0154), “Turning Enterprise Update Servers Into Backdoor Factories” (T0107), “Burning Tears of PHP’s Memory Hardening” (T0170), ThreatForest / 0-Day Engine (T0120), hardware/UEFI briefings (T0208).
DEF CON 34 schedule unavailable at crawl time; will retry. Conference tracking is now part of the sources model.

2026-09-25

Expanded-scope re-walk: SafeDep reinfection on actions-cool, kilocode research

Re-walked tracked feeds with the wider scope (research/demo/lure patterns now in scope). SafeDep “Mini Shai-Hulud is still infecting” attached to AS197 actions-cool — four months after the tag hijack, six more repos infected 20–24 September; kitty-monitor backdoor, gh-token wiper, stepsecurity.io /etc/hosts blocking.
AS288 kilocode early risk signals added as research (StepSecurity; no exploitation — the pre-attack end of the chain).
OSM/StepSecurity remaining items are show episodes and product posts, already classified.

2026-09-25

Stories now distinguish real incidents, research, and demos

Added a status field to attack stories: incident (default — real-world attack), research (bug/PoC discovery, no confirmed in-the-wild exploitation), demo (author demonstration, no victim).
AS287 added: fwupd dangling S3 bucket + CVE-2020-10759 signature-verification bypass (justinsteven) — tagged research because it is bug discovery, not a real incident.
Tagged research: AS23 repo-jacking demo, AS24 Gato runner research, AS203 Amazon Q prompt injection, AS157 MCP config poisoning. Tagged demo: AS199 ANIMAL (1975, pre-cs), AS212 Ken Thompson compiler demo (1983).
Incidents and stories pages now have Real incidents / Research / Demos filter buttons and badges on cards.

2026-09-25

Zero-reference technique audit: every technique now has an incident or sharp origin

Audited all 109 techniques for references and incident mappings. Five had zero mappings and generic-only sources: T0100 naming conventions, T0101 technology stacks, T0104 coding flaws, T0143 external user accounts, T0190 weak encryption.
Mapped the behaviors onto existing incidents: TXTBOOK/Birsan (T0100), Polyfill.io (T0101), Artifactory CVE chain (T0104), @7nohe + prt-scan + hackerbot-claw (T0143), Velora plain-HTTP C2 + SleeperGem VERIFY_NONE (T0190).
Three techniques had incidents but generic-only refs — incident links added to their origin entries: T0102, T0149 (destructive npm wipe), T0164 (arrayref privileged-repo injection).
Zero techniques remain with neither an incident mapping nor a specific source.

2026-09-25

Fixed blank cards on incident/platform lists (nested anchors)

Incident and platform cards were <a> elements containing platform <a> chips. HTML forbids nested anchors, so the browser closed each card at its first chip and rendered the remaining chips plus technique count as a stray empty anchor — the blank block below every title.
Cards are now <div> wrappers with a full-card overlay link; platform chips stay clickable above the overlay. Zero nested anchors remain.

2026-09-24

Platform-tag audit of the tstromberg batch (43 stories corrected)

Corrected wrong tags from the bulk import: AS212 Ken Thompson 1983 demo was tagged git/GitHub — it predates both; platform is linux.
Fixed: npm packages wrongly tagged git (rand-user-agent, @solana/web3.js), Chrome extensions wrongly tagged vscode (Great Suspender, Nano, Ledger Connect Kit), macOS cases (HandBrake, Monero CLI), PyPI/Gem cases (Top.gg, rest-client, strong_password, ssh-decorate), Unix daemon/source cases (OpenSSH, tcpdump, wu-ftpd, UnrealIRCd, ProFTPD, PEAR, Sendmail, SquirrelMail, monkey.org, tcp-wrappers, util-linux, ircII, Irssi).
Removed false ai-agents tags where the match came from substring hits (colors.js, faker.js, lottie, mailparser, num2words, Intercom, SquirrelMail, sendmail, guardrails-ai).

2026-09-25

actions-cool tags still live; J7Tracker extensions; extra coverage

Rewrote AS197 from SafeDep and Socket: actions-cool/issues-helper and maintain-one-comment tags, hijacked 18 May, were re-enabled 16 Sep still pointing at Mini Shai-Hulud; six public default branches infected 20–24 Sep. Primary URLs: https://safedep.io/mini-shai-hulud-reinfection-github-repositories and https://socket.dev/blog/mini-shai-hulud-actions.
New AS286: Socket J7Tracker/VREO/Orbit Tracker Chrome and Firefox extensions stealing Axiom Trade and Padre session/wallet data (https://socket.dev/blog/chrome-firefox-crypto-data-theft).
Attached Aikido MemTensor URL variant to AS39; Anthropic alignment assessment and Socket follow-up to AS65; Rust 17 Sep crate-owner targeting advisory to AS18.
Skipped GitLab incoming-email research (vuln, not in-the-wild), GTIG CI/CD hardening guidance, OSM show

2026-09-24

Renamed to supply-chain-incidences-catalogue; homepage is now a stats dashboard

Repository renamed ai-anant/OSCAR → ai-anant/supply-chain-incidences-catalogue (GitHub redirects the old name). Pages moved with it: https://ai-anant.github.io/supply-chain-incidences-catalogue/.
OSC&R matrix moved to its own /matrix.html page. Homepage now shows stats (incidents, techniques, observed vs identified, platforms), incidents-per-year bar chart, most-used techniques, incidents per platform, era split, and frequently-seen actor/malware names.
Brand updated to SCIC; nav has Home + OSC&R Matrix; all repo URLs in helpers/README updated.

2026-09-24

tstromberg/supplychain-attack-data: 90 new incidents with first-party sources

Walked all 182 attack records in the dataset. 31 overlapping records attached to existing stories (Shai-Hulud waves, tj-actions/reviewdog, Ultralytics, node-ipc, jscrambler, telnyx, LiteLLM, Velora, Cline, GlassWorm, Notepad++, Qix drainer).
90 remaining records became AS196–AS285 — each only because a first-party source (vendor advisory, project incident report, researcher write-up, primary mailing list) exists. Aggregator-only and source-less records (ANIMAL 1975 pre-cs, Ken Thompson demo) still came in via primary papers.
Corpus now 284 stories.

2026-09-24

DAEMON Tools signed-installer backdoor plus Wiz/GTIG attaches

AS195 DAEMON Tools (Kaspersky; GTIG UNC6863). Wiz SITF framework post attached to CircleCI, Ultralytics, Sha1-Hulud as extra coverage.
GTIG UNC1069 ClickFix/FinTech post is social-engineering, not a package registry incident — not duplicated as a new story.
GitHub Blog supply-chain section is hardening/changelog (Dependabot cooldown, npm/Actions defenses), not new named incidents.

2026-09-24

Wiz PAT campaign, GTIG Batten Down, Notepad++ update hijack

Wiz CIRT GitHub PAT mass-clone campaign as AS193. LiteLLM Wiz post is product CVEs (default keys/MCP), not the Team PCP package incident — not duplicated.
GTIG “Batten Down Your Packages” attached to Team PCP and axios; SolarWinds and 3CX GTIG posts on AS6/AS2; AI tracker on AS27.
New AS194 Notepad++ update hijack (project incident note + GTIG). CISA supply-chain search page 2 still Nx/Axios/SBOM/ICS only.
GitHub Changelog remaining items are platform features (stage-only npm tokens, Actions cache-mode), not named incidents.

2026-09-24

Socket leftover articles plus Wiz/CISA/GTIG SSC

Remaining Socket research one-offs grouped as AS182–AS189 so every leftover URL is on a story.
Wiz arrayref post on AS18; Artifactory in-the-wild as AS190.
CISA Axios alert on AS22; CISA Nx Console/Megalodon alert on AS91 plus new AS192 Nx Console 18.95.0.
GTIG UNC1069 axios/WAVESHAPER.V2 write-up on AS22.

2026-09-24

CrowdStrike PhantomRaven and Morphisec Hades attached

Attached CrowdStrike PhantomRaven write-up to AS26 and Morphisec Hades/TeamPCP campaign recap to AS30 and AS17.
CrowdStrike threat-intel archive is mostly nation-state actor primers, not package SSC. Morphisec remaining posts are ransomware/AMTD product. Wiz/CISA/GTIG/GitHub Changelog still need a filtered SSC pass.

2026-09-24

Socket research pages 2–5 plus remaining named campaigns

Walked Socket research pagination (pages 1–5). Overlaps attached to Team PCP, Contagious Interview, axios, GlassWorm, Elf-Stats, SANDWORM, Shai-Hulud, Qix, is, Nx, prettier phishing, Packagist themes.
New AS158–AS181: Chrome/WhatsApp extension floods, npm phishing infra, StegaBin, dYdX, SymPy miner, Rust/Go/NuGet campaigns, imToken, fake VS Code alerts, Toptal, DuckDB, Rspack, Cursor macOS, spearphish, WooCommerce carding, Maven OAuth, Google UUID, Finch, 60 gems, destructive wipe, Black Basta confusion, protestware.
Skipped Socket product/fundraising posts and CVE-only (NestJS RCE). Older one-off typosquat posts on pages 3–4 still thinner than named campaigns; titles are mapped where distinct.

2026-09-24

Checkmarx Zero SSC posts attached or added

Attached btree/keyv/ChainVeil/Vite/GlassWorm/got-fetch Zero posts to existing incidents.
New AS156 Navy Ghost pyrogram PyPI, AS157 MCP config poisoning.
Skipped Zero CVE/product posts (JSX/SVG, React2Shell, n8n, npm v12 commentary).

2026-09-24

Every remaining SafeDep SSC article plus Socket research catalog

SafeDep RSS: remaining malware/confusion posts are now AS120–AS140 (skipped only product/guidance and one analysis that concluded the binary was not malware).
Socket research listing: overlapping posts attached to existing incidents; new AS141–AS155 (extensions, Alibaba RAT, Actions/cPanel, Braintree/Sicoob/Chinese UI NuGet, TrapDoor, Laravel Lang, Go lures, Intercom worm, Chollima Packagist).

2026-09-24

Catalog remaining tracked sources (Aikido, StepSecurity, Rust, RubyGems, Sansec)

Attached Aikido/StepSecurity write-ups onto existing incidents (Graphalgo, 7nohe, arrayref, Keyv, AsyncAPI, Injective, SleeperGem, sckit, Team PCP, Anthropic, Joyfill, mrmustard, is, tj-actions). RubyGems May spam post already on AS37.
New AS116 pub.dev XCSSET (Aikido), AS117 Miri Actions cache (Rust blog), AS118 codfish/semantic-release-action tag hijack (Aikido/Miasma), AS119 OptinMonster plugin chain (Sansec). Added pub.dev platform tag.
Checkmarx Zero recent index is LLM hunting not new SSC campaigns (got-fetch already AS73). CrowdStrike/Morphisec/Wiz/GTIG/CISA/GitHub Changelog remaining posts are non-SSC or already cited (PhantomRaven, Hades, DUSTMAKER). Socket research posts were catalogued in earlier history passes.

2026-09-24

ReversingLabs + CloudSEK catalog

ReversingLabs: attached AsyncAPI trust/provenance post to AS50, ClickFix posts to AS19, Hugging Face/OpenAI agent commentary to AS37, containment post to AS65. Twilio/Shai-Hulud/Red Hat already linked. Remaining RL RSS is product/commentary (Gartner, Spectra, SOC), skipped.
CloudSEK: attached LiteLLM exposure dataset to AS17 (GHAPPIER already on AS34). New AS114 BRIDGEHEAD (WSL→Windows wallet stealer) and AS115 TXTBOOK (T-Bank dependency confusion via DNS TXT).

2026-09-24

SafeDep catalog pass 2: remaining named campaigns

Attached SafeDep tinycolor/Qix posts to AS48 and AS15.
New AS95–AS106 and AS110–AS113: Polymarket, wshu.net, ProcWire, axios Epsilon typosquats, terminal3airport adware, forge-jsx, art-template, node-ipc 2026, Claude Code hooks, sl4x0, Hyatt, prt-scan, @fairwords worm, Strapi plugins, SANDWORM_MODE, hermes-px.
SafeDep product/guidance posts still skipped. Smaller one-off package posts (nyc-config, SLF4J impersonation, cookie-parser, llm-oracle, ixpresso) remain.

2026-09-24

SafeDep catalog: attach overlaps, add six new incidents

Attached 34 SafeDep posts to existing incidents (Team PCP including Bitwarden CLI, Shai-Hulud waves, Miasma, Joyfill, mrmustard, Nx, prettier, Velora, Mastra, Moika, axios, arrayref, Keyv, sckit, 7nohe, PolinRider astro.config).
New AS83–AS94: ulid-xyz, Google bin harvesting, Baileys, @copilot-mcp/apex, nodemon-sudo, fake TradingView, @withgoogle/stitch-sdk, MYRA RAT, Megalodon, durabletask, Cline v2.3.0, Schedaero.
Product/guidance posts (vet, MCP, SBOM, Gryph) skipped. Remaining SafeDep malware-package posts (Polymarket, wshu, Hyatt, sl4x0, …) for the next SafeDep slice.

2026-09-24

OpenSourceMalware catalog: every incident post mapped

Catalogued all 71 OSM RSS posts. Show/landscape/guidance posts skipped. Follow-up posts attached to existing stories (PolinRider, Team PCP, axios, Mini Shai-Hulud, Keyv, ClawHub, Contagious Interview).
New stories AS78–AS82: Velora SDK 9.4.1, CNCF Antrea Jenkins, Contagious Interview git hooks, XPACK extortion, Neutralinojs force-push.
Added jenkins platform tag.

2026-09-24

Add Moika dependency-confusion campaign

Added AS77 Moika (183 npm packages impersonating Sberbank/EMCD internal tooling) from OpenSourceMalware’s Jan–May 2026 campaign review.

2026-09-24

History pass 5: NotPetya, prettier phishing, Nx s1ngularity, hackerbot-claw

Added AS71–AS76: NotPetya via M.E.Doc (ESET), eslint-config-prettier phishing, got-fetch Pycoon (Checkmarx), Nx s1ngularity (nx.dev), hackerbot-claw (StepSecurity), Aspect Security npm install-time stealers (OSM).
Sources: ESET WeLiveSecurity, StepSecurity, Checkmarx Zero, Nx post-mortem, OpenSourceMalware.

2026-09-24

History pass 4: Anthropic PyPI agent, Joyfill, mrmustard, SleeperGem, is, Mastra

Added AS65–AS70: Anthropic eval agent on live PyPI, Joyfill npm RAT, mrmustard 0.7.4, SleeperGem RubyGems, npm is 3.3.1/5.0.0, @mastra/easy-day-js.
Sources: Anthropic, StepSecurity, Aikido, OpenSourceMalware.

2026-09-24

History pass 3: NuGet cheats, wallet drainers, ShadowHammer, Agama

Added AS57–AS64: eleven NuGet game-cheat packages, Chrome/Edge wallet drainers, Injective SDK overwrite, 77 Firefox wallet add-ons, fake corepack.org, ASUS ShadowHammer, DarkGPT VS Code extensions, electron-native-notify in Agama (2019).
New platform tags: browser-extensions, macos.
Sources: Socket, Kaspersky Securelist, SafeDep, Koi, npm blog.

2026-09-23

History pass 2: Shai-Hulud, Miasma, GlassWorm, ClawHub, Packagist spyware

Added AS48–AS56: Shai-Hulud first wave (@ctrl/tinycolor), Sha1-Hulud Second Coming, Miasma/@asyncapi, jscrambler 8.14.0, Packagist iOS spyware themes, ClawHub skills, Stardrop, GlassWorm, Elf-Stats.
Sources: Socket and OpenSourceMalware first-party posts.

2026-09-23

Rewrite original stories and backfill older campaigns

Rewrote AS1 Webmin, AS4 PHP (date was wrongly 2023), AS5 CCleaner, AS107 Dependabot, AS108 JuiceStealer, AS109 PyTorch (was tagged as account takeover; it is T0120) with first-party sources and fuller technique maps.
Added AS41–AS47 from OpenSourceMalware and ESLint: Contagious Interview, IndonesianFoods worm, WEL1DROPPER, StubMaker, PolinRider campaign, eslint-scope 2018, VS Code dictionary/tasks droppers.

2026-09-23

Platform group pages (all npm incidents, etc.)

Added /platforms/ with counts per registry/platform and a dedicated list page per slug (e.g. /platforms/npm.html).
Incident chips and the incident-index bar link into those groups.

2026-09-23

Incidents tagged by platform / registry

Every attack story now has a platforms: list (npm, PyPI, RubyGems, Packagist, crates.io, Go, GitHub Actions, Terraform, CDN, AI agents, etc.).
Incident index filters by platform. Vocabulary is content/portal/platforms.yaml.

2026-09-24

sckit MemTensor worm and Graphalgo Terraform/Go

Added AS39 (sckit credential-harvesting launcher in @memtensor/memos-cloud-openclaw-plugin and PyPI MemoryOS 2.0.34, StepSecurity).
Added AS40 (Graphalgo Go malware in Terraform providers and Go modules, Aikido).
Added Aikido blog as a tracked research source.

2026-09-23

tw-pkgprobe-7731 Twilio npm campaign

Added AS38 (tw-pkgprobe-7731 npm package targeting Twilio developers, ReversingLabs).
Added ReversingLabs blog as a tracked research source.

2026-09-23

OpenSourceMalware watch URL is the blog, not the homepage

Tracked URL is now https://opensourcemalware.com/blog (RSS https://opensourcemalware.com/rss.xml). The site root is a threat-search UI.

2026-09-22

GHAPPIER, PolinRider Packagist, mathmain, GemStuffer

Added AS34 (GHAPPIER / @dforge-core/dforge-mcp trusted-publishing loader, CloudSEK).
Added AS35 (PolinRider visanduma/nova-two-factor Packagist via Git, Socket).
Added AS36 (mathmain/mathsbase encrypted npm RAT, SafeDep and JFrog).
Added AS37 (GemStuffer RubyGems / RubyDoc.info YARD --load, SafeDep, RubyGems, RubyHack, JFrog).
Added T0211 (abuse registry-adjacent builders as remote execution).
Added CloudSEK as a tracked research source.

2026-09-21

Public tracked-source list (SafeDep added)

Added content/portal/sources.yaml and /sources.html as the canonical watch list.
SafeDep blog (https://safedep.io/blog/) is now a daily-tracked research source.
Daily intake reads this file; adding a source is an edit to sources.yaml.

2026-09-21

Late-2026 campaigns: runtime loaders, agent configs, registry origins

Added T0209 (compromise package registry or CDN origin) and T0210 (poison AI coding-agent config).
Added AS25–AS33 from first-party research and advisories (Checkmarx, CrowdStrike, Mandiant/Google, Jared Wray, Morphisec, Coder GHSA, OpenSourceMalware, GTIG).
Mapped runtime-hidden npm loaders, hidden HTTP remote deps, valid-provenance publishes, llms.txt package confusion, and CDN origin-pool tampering.

2026-09-21

Where each technique idea came from

Added an origin kind and source URL on every technique, shown on the technique page and on /origins.html.
Five original techniques had no references (T0107, T0134, T0143, T0149, T0161); they now cite ATT&CK, OWASP, SLSA, or Birsan as the analog that justifies them.

2026-09-21

Public changelog, guidance gap-fill, and technique provenance

Added this changelog to the site so portal work is visible without reading git history.
Compared OSC&R to OWASP Top 10 CI/CD, NIST SSDF (SP 800-218), SLSA threat model, CISA SSDF/EO 14028 lineage, and OxSecurity/Cider CI/CD research (the original PBOM authors).
Added T0206 (forge or omit build provenance), T0207 (skip or forge artifact integrity), T0208 (compromise code-signing identity).
Mapped those onto existing stories where they already happened (SolarWinds signing, Codecov unsigned script, Polyfill without SRI).
Documented unused techniques as identified-from research or guidance, not as invented attacks. Matrix and technique pages now say observed vs identified.

2026-09-21

2026 incidents, matrix heat, search hides empty columns

Added AS16–AS22 from primary research (TanStack GHSA, OpenAI, CrowdSec, StepSecurity, CloudSEK, Rust blog, Brevo, Sansec, SafeDep).
Matrix cells show incident counts and heat; search hides non-matches and empty tactic columns.
Mapped previously unused techniques onto those cases where the fit was honest.

2026-09-21

First public site, including the OSC&R corpus

Started from the OSC&R corpus in pbom-dev/OSCAR. Attribution retained (Apache-2.0, NOTICE). This catalogue is not a continuation of that project.
Published matrix, technique pages, and incident mappings on GitHub Pages.
Applied unmerged upstream PRs
Added T0200–T0203, T0205 and stories AS7–AS15.