# Threat Watch by Helix — Supply chain

> Live security incidents: actively exploited vulnerabilities, breaches and supply-chain attacks — patch status, fixed versions and what to do, curated by Helix Cyber.

All endpoints are public JSON/XML/text with CORS enabled; no auth. Poll changes.json at most hourly with If-None-Match (every response carries an ETag).

## Categories

Every incident has exactly one `category`.
- Vulnerabilities (`patch`): 1786 incidents, 40 live. Flaws in software you may run — which versions are affected, the fixed release, and what to do first. Page https://helix.ml/threat-watch?c=patch · RSS https://helix.ml/threat-watch/c/patch/feed.xml · JSON Feed https://helix.ml/threat-watch/c/patch/feed.json · changes https://helix.ml/threat-watch/c/patch/changes.json · llms.txt https://helix.ml/threat-watch/c/patch/llms.txt
- Breaches (`breach`): 987 incidents, 5 live. Attacks on companies and services. Nothing to patch on your side; rotate credentials and watch for follow-on phishing if you are a customer. Page https://helix.ml/threat-watch?c=breach · RSS https://helix.ml/threat-watch/c/breach/feed.xml · JSON Feed https://helix.ml/threat-watch/c/breach/feed.json · changes https://helix.ml/threat-watch/c/breach/changes.json · llms.txt https://helix.ml/threat-watch/c/breach/llms.txt
- Supply chain (`supply-chain`): 13 incidents, 10 live. Compromised packages, releases, build pipelines and certificates. Check what you depend on and what you trust. Page https://helix.ml/threat-watch?c=supply-chain · RSS https://helix.ml/threat-watch/c/supply-chain/feed.xml · JSON Feed https://helix.ml/threat-watch/c/supply-chain/feed.json · changes https://helix.ml/threat-watch/c/supply-chain/changes.json · llms.txt https://helix.ml/threat-watch/c/supply-chain/llms.txt

## Data

- All incidents: https://helix.ml/threat-watch/incidents.json
- One incident: https://helix.ml/threat-watch/i/<slug>.json (timeline, sources, `agentBrief` markdown)
- Update stream: https://helix.ml/threat-watch/changes.json
- Fields: severity (critical|high|medium|low|unknown), patchStatus (patched|partial|unpatched|no-fix-needed|unknown), status (live|closed), exploited, stacks, tags, cveIds, affectedVersions, fixedVersions, actions.
- Incidents marked `auto: true` were generated from an authoritative catalog (CISA KEV, Have I Been Pwned) and not yet reviewed by an editor.

## Use with your AI

Poll changes.json hourly with ETag; for each new change, fetch the incident JSON, compare `stacks`, `product`, `affectedVersions` and `cveIds` against the systems and dependencies you manage, and alert only when one matches. Follow `actions`.

## Live incidents (10)

### [critical] LiteLLM: malicious 1.107.0 release on PyPI/Docker steals credentials and includes dormant C2
https://helix.ml/threat-watch/i/litellm-malicious-1-107-0-release-on-pypi-docker-steals-credentials-and-includes-dormant-c2 · Supply chain · no-fix-needed · since 2026-10-21
On 2026-10-21 a malicious version 1.107.0 of LiteLLM was published to PyPI and Docker Hub/GHCR via a compromised release pipeline. Attackers used stolen GitHub CLI OAuth tokens—apparently harvested from logs of an internet-exposed LiteLLM internal deployment—to push commits from a lookalike Berri-AI repo and trigger/approve a release. The payload installs cook.pth, cook.py and sitecustomize.py that run on interpreter startup, harvesting browser, cloud (AWS/GCP/Azure), SSH/GPG and AI-provider credentials, querying the LiteLLM PostgreSQL credentials table, and exfiltrating AES-encrypted data to www.litellm[.]dev/healthcheck; a dormant second-stage C2 via GitHub dead drop was never activated. Anyone who installed 1.107.0 or pulled affected Docker tags is affected. Malicious PyPI version quarantined ~13:20 UTC, Docker images removed ~13:53 UTC; tokens revoked; last safe version is v1.106.2.
Fixed: v1.106.2 (last known safe)
Do: Assume credential compromise if LiteLLM 1.107.0 was installed or affected Docker tags pulled: rotate all LLM provider API keys (OpenAI, Anthropic, Cohere, etc.), cloud credentials (AWS/GCP/Azure), SSH/GPG keys, and browser passwords/cookies on affected hosts; Downgrade/pin to v1.106.2 and verify site-packages for cook.pth, cook.py, sitecustomize.py and /tmp/.pc_once_* markers; check logs and egress for connections to www.litellm[.]dev; Audit LiteLLM Proxy PostgreSQL LiteLLM_CredentialsTable access and rotate all stored provider keys; Check whether any second-stage was fetched from the GitHub dead-drop domain (letters9813/pythonclient-test) and inspect for post-exploitation; Review exposure of internal LiteLLM deployments and log redaction of tokens in proxied response bodies

### [critical] npm typosquat cluster (appit-* / ionic-insta-search): malicious packages flagged as malware
https://helix.ml/threat-watch/i/npm-typosquat-cluster-appit-ionic-insta-search-malicious-packages-flagged-as-malware · Supply chain · no-fix-needed · since 2026-10-25
On 2026-10-25 GitHub published four malware advisories (GHSA-fr38-45mf-vcqf, GHSA-5pw8-3xv5-6cmg, GHSA-4fw4-xm5r-mh69, GHSA-9w8h-674f-4x2j) covering npm packages appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search and appit-cordova-admob. All versions (>= 0) are affected, CWE-506 embedded malicious code, no patched versions exist. The advisories state any machine with these packages installed or running should be considered fully compromised, implying credential/key theft and remote control by an outside party. The names mimic legitimate Cordova/Ionic plugins, suggesting a typosquatting or account-compromise campaign targeting Ionic/Cordova developers. No exploitation details or fixed versions are available; removal alone may not eliminate the compromise.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the packages from all projects and lockfiles and rebuild from a clean environment; Audit build machines and developer workstations for persistence, unexpected processes and network connections; Check CI/CD pipelines and published app artifacts for inclusion of these packages and re-sign/rebuild affected apps; Block these package names in npm dependency policies and review dependency trees for similar typosquats

### [high] Electron: compromised eMudhra intermediate certificates allow TLS server impersonation (CVE-2026-115570)
https://helix.ml/threat-watch/i/electron-compromised-emudhra-intermediate-certificates-allow-tls-server-impersonation-cve-2026-115570 · Supply chain · patched · since 2026-10-22 · CVE-2026-111943, CVE-2026-113470, CVE-2026-115557, CVE-2026-115570
A set of eMudhra intermediate CA certificates was compromised and is being blocked by browsers and other TLS clients. Electron releases before the patched versions did not block these intermediates in either Chromium networking or Node.js tls/https/fetch, so an attacker holding a certificate issued via the compromised intermediates and able to intercept network traffic (e.g. on-path/MitM) could impersonate a TLS server to an Electron app. Only apps making TLS network connections are affected; offline apps are not. Go (CVE-2026-111943) and Firefox (CVE-2026-113470) shipped the same mitigation. There are no app-side workarounds; fixed releases are 45.0.0-beta.6, 44.9.1, 43.8.1 and 42.11.16, published 2026-10-22/23.
Fixed: 45.0.0-beta.6; 44.9.1; 43.8.1; 42.11.16
Do: Upgrade Electron to 45.0.0-beta.6, 44.9.1, 43.8.1 or 42.11.16 (or later) and rebuild/redistribute apps, prioritising apps that make TLS connections over untrusted networks; Audit which Electron apps in your estate make network connections and prioritise those handling sensitive data; Verify no pinned or custom certificate logic bypasses the new block; confirm updated builds ship the mitigation in both Chromium and Node.js TLS paths; Monitor for any further eMudhra-related revocations or advisories affecting other TLS clients in your stack

### [high] IO::Compress::Brotli (Perl): bundled brotli decoder out-of-bounds write allows memory disclosure, crashes, or potential RCE when decompressing untrusted data (CVE-2026-115936)
https://helix.ml/threat-watch/i/io-compress-brotli-perl-bundled-brotli-decoder-out-of-bounds-write-allows-memory-disclosure-crashes-or-potential-rce-whe · Supply chain · patched · since 2026-10-23 · CVE-2026-111497, CVE-2026-115936
The CPAN Security Group disclosed CVE-2026-115936: IO::Compress::Brotli versions from 0.004001 before 0.023 bundle a copy of the brotli library (1.0.4 through 1.2.0) containing an out-of-bounds write in the decoder (CVE-2026-111497). Because the module compiles the bundled brotli rather than linking the system library, upgrading system brotli does not remediate. Any application decompressing untrusted data via unbro or the decompress method is exposed: a crafted brotli stream can corrupt decoder state, disclose memory, crash the process, or potentially execute arbitrary code. Version 0.023, released 2026-10-23, updates the bundled brotli to 1.2.1 and fixes the issue. No in-the-wild exploitation reported.
Fixed: 0.023
Do: Upgrade IO-Compress-Brotli to 0.023 or later and rebuild/redeploy dependent applications; Audit Perl codebases and dependencies for use of IO::Compress::Brotli, especially paths decompressing untrusted input; Until patched, restrict or sandbox processing of untrusted brotli-compressed data

### [critical] npm: Four malicious packages (@sudobility/indexer_client, agentic-awesome-skills, opencode-skills-collection, @pkgship/frpc-darwin-amd64) flagged as malware with no patched versions
https://helix.ml/threat-watch/i/npm-four-malicious-packages-sudobility-indexer-client-agentic-awesome-skills-opencode-skills-collection-pkgship-frpc-dar · Supply chain · no-fix-needed · since 2026-10-22
On 2026-10-22 GitHub added four malware advisories (CWE-506, embedded malicious code) covering npm packages @sudobility/indexer_client 0.0.146, agentic-awesome-skills (versions 18.9.0–19.13.0, ~20 listed), opencode-skills-collection (4.0.56–4.1.20, ~21 listed), and @pkgship/frpc-darwin-amd64 0.71.1. All are rated critical with no patched versions; GitHub's standard wording warns any machine with the package installed or running should be considered fully compromised, with secrets and keys exposed to an outside entity. Anyone who installed or runs these packages is affected. No fixes exist; remediation is removal plus credential rotation and host forensics.
Do: Remove the packages from all projects and lockfiles and block these names/versions in your registry proxy or allowlist; Rotate all secrets, API keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild affected machines or containers from trusted images; treat hosts as potentially fully compromised; Audit CI/CD and developer workstations for installs of these packages and review logs for post-install execution or exfiltration

### [critical] PyPI: typosquatted packages 1h1 and aanthropic download and execute malware during install (no CVE)
https://helix.ml/threat-watch/i/pypi-typosquatted-packages-1h1-and-aanthropic-download-and-execute-malware-during-install-no-cve · Supply chain · no-fix-needed · since 2026-10-22
Two typosquatted PyPI packages, 1h1 and aanthropic (version 1.0.0), were published to the GitHub Advisory Database on 2026-10-22 as part of the '2026-10-semvver' malware campaign. Both packages download and execute a remote executable during installation, with infostealer-style malicious intent (CWE-506). The same malware binary hash appears in both advisories' VirusTotal references. Anyone who pip-installed either package — likely developers mistyping 'anthropic' or similar names — has executed malware on their machine. There are no patched versions; the packages are simply malicious and should never be used. Removal from PyPI and advisory publication are the mitigations.
Do: Check pip logs, lockfiles, and CI history for any install of 1h1 or aanthropic 1.0.0 and treat any machine that installed them as compromised; Rebuild affected machines/CI runners from trusted images and rotate all credentials, tokens, and secrets accessible from them; Audit environments for the malware binary hash e6d96b5500b232bea67f6f9046cfbc22d29a515c42d2af9523a15ebe8a7c4ab7; Pin dependencies and verify package names carefully to avoid typosquatting; use hash-pinned requirements; Enable PyPI/GitHub Dependabot malware alerts and block these package names in dependency firewalls

### [critical] npm: four malicious packages (@conduitops/logview-archive, formatting-subtitles, simplewave, log-rotate-testmetest) execute attacker-controlled code at install time (no CVE)
https://helix.ml/threat-watch/i/npm-four-malicious-packages-conduitops-logview-archive-formatting-subtitles-simplewave-log-rotate-testmetest-execute-att · Supply chain · no-fix-needed · since 2026-10-22
GitHub Advisory Database published four npm malware advisories on 2026-10-22, each critical with no patched versions. @conduitops/logview-archive uses a postinstall hook to fetch and run a package from an attacker-controlled plain-HTTP bare-IP registry (139.196.94.195:8080) hidden behind base64+XOR masking. formatting-subtitles hides shell commands inside a fake JS comment in prepare.js, beaconing to webhook.site and executing unpinned content from a mutable GitHub Gist. simplewave exfiltrates os.hostname() to an oast.fun Interactsh collector on install. log-rotate-testmetest abuses binding.gyp command expansion to run a ROT+AES-GCM+brotli-obfuscated payload under Bun. Any developer or CI machine installing these versions gets arbitrary code execution or data exfiltration; no vendor fix exists since the packages are malware.
Do: Search dependency locks, CI logs and caches for the four package/version pairs and remove them from all manifests and lockfiles; Treat any machine or CI runner that installed them as compromised: rotate credentials, tokens and keys accessible to those environments and rebuild from clean images; Block egress to 139.196.94.195:8080, webhook.site/9e8c8742-3102-4716-aa8b-e150e9e84fe7, api.github.com/gists/da04f14c93acbe9a7aef827be0a2e91c and oast.fun in build environments; Disable or restrict npm lifecycle scripts (e.g. npm config set ignore-scripts true, --ignore-scripts in CI) and audit any package requiring install scripts; Prefer pinned, provenance-verified dependencies from internal registries/proxies and scan for typosquat package names

### [high] Pillow: bundled libopenjp2 heap-buffer-overflow write reachable from Image.open().load() (OSV-2025-219 / GHSA-78g4-xqwv-q3g8)
https://helix.ml/threat-watch/i/pillow-bundled-libopenjp2-heap-buffer-overflow-write-reachable-from-image-open-load-osv-2025-219-ghsa-78g4-xqwv-q3g8 · Supply chain · partial · since 2026-10-17
Pillow wheels from 11.1.0 through 12.3.0 bundle a libopenjp2 (2.5.3/2.5.4) containing a heap-buffer-overflow write in opj_j2k_read_sod (OSV-2025-219), introduced in OpenJPEG in June 2024 — notably, older OpenJPEG 2.5.2 is safe. The flaw is reachable from Image.open(fp); im.load() with default settings, and because the wheel bundles its own copy, patched host OS libraries do not help. A public ASan PoC demonstrates the overflow through Pillow's own decoder. Attackers can craft a JPEG 2000 codestream that triggers memory corruption even when uploaded as avatar.png with image/png Content-Type, since Image.open() sniffs magic bytes. Fixed in Pillow 13.0.0; the upstream OpenJPEG fix (91d08b11, Feb 2026) remains unreleased. No in-the-wild exploitation reported.
Fixed: pillow 13.0.0
Do: Upgrade Pillow to 13.0.0 (or pin to <=11.0.0 if downgrade is feasible); Until upgraded, pass an explicit formats= list excluding JPEG2000 to Image.open() and validate on the detected format, not client Content-Type or filename; Reject or sandbox untrusted image uploads; consider blocking JPEG 2000 magic bytes (JP2/j2k codestreams) at the application layer; Audit image-processing services for reliance on filename/Content-Type allowlists that Image.open() bypasses; Monitor for an OpenJPEG release carrying 91d08b11 and rebuild any vendored/bundled OpenJPEG accordingly

### [critical] MemTensor (npm @memtensor/memos-cloud-openclaw-plugin, PyPI MemoryOS): packages compromised with 'supplychain.local' Go worm that executes on invocation and self-propagates via package publishing and compromised GitHub Actions (no CVE)
https://helix.ml/threat-watch/i/memtensor-npm-memtensor-memos-cloud-openclaw-plugin-pypi-memoryos-packages-compromised-with-supplychain-local-go-worm-th · Supply chain · no-fix-needed · since 2026-09-23
On 23 September 2026 a threat actor published malicious versions of npm package @memtensor/memos-cloud-openclaw-plugin (>=0.1.21) and PyPI package MemoryOS (>=2.0.34), both of which have substantial benign publishing histories and appear compromised. The malware, tracked as 'supplychain.local', embeds language-native droppers (JavaScript/Python) that launch a hidden platform-specific Go binary ('sckit') from a .sckit directory with a base64-encoded config containing C2 endpoints (skyleen.fr domains). It executes on any invocation of the package (not at install time), harvests NPM_TOKEN/NODE_AUTH_TOKEN from the environment, and the Go worm self-propagates by publishing to other packages and via compromised GitHub Actions. Affected users are anyone invoking these versions; pin to last-known-good versions, rotate tokens, and audit for compromise.
Do: Immediately remove/pin affected versions: npm @memtensor/memos-cloud-openclaw-plugin >=0.1.21 and PyPI MemoryOS >=2.0.34; downgrade to last known-good versions; Rotate all npm/NPM_TOKEN and NODE_AUTH_TOKEN credentials and other secrets that may have been exposed on machines that ran the packages; Hunt for indicators of compromise: hidden .sckit directories, sckit/sckit.exe binaries, $HOME/.openclaw/.cache/runtime state dir, and network connections to *.skyleen.fr hosts; Audit GitHub Actions workflows and package publishing activity for signs of worm propagation or unauthorized publishes; Scan build and CI environments for the worm and review dependency trees for packages published via compromised tokens

### [high] Graphalgo campaign: malicious Terraform providers and Go modules deliver targeted RAT via hash-triggered payload (no CVE)
https://helix.ml/threat-watch/i/graphalgo-campaign-malicious-terraform-providers-and-go-modules-deliver-targeted-rat-via-hash-triggered-payload-no-cve · Supply chain · no-fix-needed · since 2026-09-22
Aikido identified Go malware distributed via two Terraform providers (gocommunity-io/dockerd and typosquat kreuzwenker/docker of the popular kreuzwerker/docker provider) and two Go modules (gocommunity.io/orderedbtree, gogets.dev/btreex), extending the Graphalgo NPM malware campaign first reported by ReversingLabs in February 2026. Hidden entry points activate only when a SHA256 of concatenated containerName and networkID matches a specific value, then AES-decrypt and execute a second-stage RAT from an embedded ZIP. The RAT exfiltrates system info to a Slack workspace and uses dual C2 via Slack channels and Ethereum dead drops on Arbitrum Sepolia with ECDH-encrypted communications. The hash-gating suggests targeted delivery; any developer or CI system pulling these packages is at risk. No vendor fix applies—removal and rotation are the remediation.
Do: Audit Terraform and Go dependency trees for the malicious packages (gocommunity-io/dockerd, kreuzwenker/docker, gocommunity.io/orderedbtree, gogets.dev/btreex) and remove them immediately; If found installed, treat hosts as compromised: rebuild machines/CI runners, rotate credentials, tokens, and Slack tokens accessible from them; Verify the legitimate kreuzwerker/docker Terraform provider is used (correct spelling) and pin provider/module versions and checksums; Scan for artifacts and indicators: the trigger SHA256 b9966e3762e9a0d5d263b8cb3cca07294f81af9714d40ddf4628cb85d74e8ad5, payload ZIP hash 5f892a5424e88a21a3eb3d7f82ebf04d8ac31cdb19ada25153be4165df977d0f, and connections to portfolio-devs/portfolio-testers Slack workspaces; Block or monitor egress to api.slack.com and Arbitrum Sepolia RPC endpoints from build and developer environments; Use dependency/malware scanning (SCA, SBOM) on Go modules and Terraform providers before adoption

Breach data from Have I Been Pwned (haveibeenpwned.com) is licensed CC BY 4.0. Vulnerability data from the CISA KEV catalog and NVD.