{"category":"supply-chain","changes":[{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware","incidentTitle":"npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-v2r2-x76j-6fcx","status":"live","title":"Typosquat malware cluster expands with new packages: insta-reel-search, ionic-tiktok-scraper, ionic-sound-cloud-loader-api, sound-cloud-loader-api, insta-api-wrapper","url":"https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware","incidentTitle":"npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://github.com/advisories/GHSA-fr38-45mf-vcqf","status":"live","title":"npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware","url":"https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://www.stepsecurity.io/blog/emudhra-emsign-ca-compromise-python-pip-ci-cd-update","status":"live","title":"Guidance published for Python/pip/CI-CD users on compromised eMudhra intermediate CA keys","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://www.aikido.dev/blog/emudhra-ca-compromise","status":"live","title":"eMudhra CA compromise: analysis shows eight weak private keys, one guessable in at most 256 tries (key value 4)","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/369","status":"live","title":"oss-security follow-up clarifies Comodo AAA root trust-bit removal: dropped from TLS/browser trust but still usable for S/MIME","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/372","status":"live","title":"Python ssl module distrusts the compromised eMudhra intermediate certificates (CVE-2026-115557)","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"supply-chain","date":"2026-10-25","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"advisory","patchStatus":"patched","severity":"high","sourceUrl":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-emudhra-info-ScS22A1r?vs_f=Cisco%20Security%20Advisory%26vs_cat=Security%20Intelligence%26vs_type=RSS%26vs_p=Cisco%20Informational%20for%20Emergency%20Distrust%20of%20eMudhra%20Root%20and%20Intermediate%20Certificate%20Authorities%26vs_k=1","status":"live","title":"Cisco issues emergency distrust of compromised eMudhra root and intermediate CAs","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"supply-chain","date":"2026-10-23","incident":"io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe","incidentTitle":"IO::Compress::Brotli (Perl): bundled brotli decoder out-of-bounds write allows memory disclosure, crashes, or potential RCE when decompressing untrusted data (CVE-2026-115936)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://seclists.org/oss-sec/2026/q4/367","status":"live","title":"IO::Compress::Brotli (Perl): bundled brotli decoder out-of-bounds write allows memory disclosure, crashes, or potential RCE when decompressing untrusted data (CVE-2026-115936)","url":"https://helix.ml/threat-watch/i/io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe"},{"body":null,"category":"supply-chain","date":"2026-10-22","incident":"electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570","incidentTitle":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://github.com/advisories/GHSA-jr5w-w6x2-84p9","status":"live","title":"Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)","url":"https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570"},{"body":null,"category":"supply-chain","date":"2026-10-17","incident":"pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8","incidentTitle":"Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)","kind":"disclosure","patchStatus":"partial","severity":"high","sourceUrl":"https://github.com/advisories/GHSA-78g4-xqwv-q3g8","status":"live","title":"Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)","url":"https://helix.ml/threat-watch/i/pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8"},{"body":null,"category":"supply-chain","date":"2026-10-10","incident":"black-github-action-installs-unvalidated-required-version-from-pyproject-toml-enabling-rce-cve-2026-114134","incidentTitle":"Black: GitHub Action installs unvalidated required-version from pyproject.toml enabling RCE (CVE-2026-114134)","kind":"disclosure","patchStatus":"patched","severity":"high","sourceUrl":"https://github.com/advisories/GHSA-cg8m-r9f2-5wm2","status":"closed","title":"Black: GitHub Action installs unvalidated required-version from pyproject.toml enabling RCE (CVE-2026-114134)","url":"https://helix.ml/threat-watch/i/black-github-action-installs-unvalidated-required-version-from-pyproject-toml-enabling-rce-cve-2026-114134"},{"body":null,"category":"supply-chain","date":"2026-09-08","incident":"pub-dev-universal-file-viewer-0-1-5-flutter-package-contains-xcsset-macos-malware","incidentTitle":"pub.dev: universal_file_viewer 0.1.5 Flutter package contains XCSSET macOS malware","kind":"disclosure","patchStatus":"no-fix-needed","severity":"medium","sourceUrl":"https://www.aikido.dev/blog/compromised-flutter-package-on-pub-dev-contains-xcsset-malware","status":"closed","title":"pub.dev: universal_file_viewer 0.1.5 Flutter package contains XCSSET macOS malware","url":"https://helix.ml/threat-watch/i/pub-dev-universal-file-viewer-0-1-5-flutter-package-contains-xcsset-macos-malware"},{"body":null,"category":"supply-chain","date":"2026-09-07","incident":"npm-ecosystem-shai-hulud-worm-payloads-resurface-dormant-hash-republished-after-111-days-and-tensorlake-compromised-with","incidentTitle":"npm ecosystem: Shai-Hulud worm payloads resurface — dormant hash republished after 111 days and tensorlake compromised with a novel variant (no CVE)","kind":"disclosure","patchStatus":"no-fix-needed","severity":"critical","sourceUrl":"https://www.aikido.dev/blog/shai-hulud-npm-resurfaces","status":"closed","title":"npm ecosystem: Shai-Hulud worm payloads resurface — dormant hash republished after 111 days and tensorlake compromised with a novel variant (no CVE)","url":"https://helix.ml/threat-watch/i/npm-ecosystem-shai-hulud-worm-payloads-resurface-dormant-hash-republished-after-111-days-and-tensorlake-compromised-with"}],"feeds":{"changes":"https://helix.ml/threat-watch/c/supply-chain/changes.json","json":"https://helix.ml/threat-watch/c/supply-chain/feed.json","llms":"https://helix.ml/threat-watch/c/supply-chain/llms.txt","page":"https://helix.ml/threat-watch?c=supply-chain","rss":"https://helix.ml/threat-watch/c/supply-chain/feed.xml"},"generatedAt":"2026-10-25T11:12:50Z","site":"https://helix.ml/threat-watch"}