https://threatline.ai/feeds/brief/atom.xml What changed each day that matters: new additions to CISA's known exploited list, exploitation reported before CISA, supply chain compromises, and critical flaws in products attackers target. 2026-10-24T10:48:42.330Z https://threatline.ai/brief/2026-10-23 2026-10-23T23:59:59Z <h2>Added to CISA's known exploited list</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-110447"><b>CVE-2026-110447</b> Collabora Online – Built-in CODE Server OS Command Injection Vulnerability</a><span>Collabora Collabora Online – Built-in CODE Server · Critical 9.2 · CISA: check for compromise · Federal deadline 2026-10-26 · Fixed in 26.4.303</span></li><li><a href="https://threatline.ai/cve/CVE-2026-114625"><b>CVE-2026-114625</b> Arista VeloCloud Orchestrator SQL Injection Vulnerability</a><span>Arista VeloCloud Orchestrator · Critical 9.9 · CISA: check for compromise · Federal deadline 2026-10-26 · Fixed in 5.2.3.18</span></li></ul> <h2>Reported exploited, not on CISA's list yet</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-106173"><b>CVE-2026-106173</b> A improper limitation of a pathname to a restricted directory (&#39;path traversal&#39;) vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via specially cra</a><span>Fortinet FortiSIEM · Critical 9.4 · Exploitation reported by 4 outlets, first by <a href="https://bsky.app/profile/cyfar.ca/post/3mykkos6r2t2w" rel="noopener noreferrer nofollow">Bluesky: exploited in the wild</a></span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/litellm-1.107.0-2026-10"><b>Malicious release</b> LiteLLM 1.107.0 on PyPI was a malicious release</a><span>litellm 1.107.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18205"><b>Malicious release</b> @tekmidian/pai 1.0.9, 1.0.8, 1.0.10 on npm was a malicious release</a><span>@tekmidian/pai 1.0.9, 1.0.8, 1.0.10</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18218"><b>Malicious release</b> qowa 0.1.0 on PyPI was a malicious release</a><span>qowa 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18219"><b>Malicious release</b> onsokets 0.1.0 on PyPI was a malicious release</a><span>onsokets 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18220"><b>Malicious release</b> skillward 0.1.1, 0.1.2 on npm was a malicious release</a><span>skillward 0.1.1, 0.1.2</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18221"><b>Malicious release</b> kestreljob 0.1.0 on PyPI was a malicious release</a><span>kestreljob 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18222"><b>Malicious release</b> badgertask 0.1.0 on PyPI was a malicious release</a><span>badgertask 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18223"><b>Malicious release</b> brambletask 0.1.0 on PyPI was a malicious release</a><span>brambletask 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18224"><b>Malicious release</b> brookworker 0.1.0 on PyPI was a malicious release</a><span>brookworker 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18225"><b>Malicious release</b> cobbleload 0.1.0 on PyPI was a malicious release</a><span>cobbleload 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18226"><b>Malicious release</b> ferretqueue 0.1.0 on PyPI was a malicious release</a><span>ferretqueue 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18227"><b>Malicious release</b> flintqueue 0.1.0 on PyPI was a malicious release</a><span>flintqueue 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18228"><b>Malicious release</b> jobwharf 0.1.0 on PyPI was a malicious release</a><span>jobwharf 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18229"><b>Malicious release</b> juniperrun 0.1.0 on PyPI was a malicious release</a><span>juniperrun 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18230"><b>Malicious release</b> larchworker 0.1.0 on PyPI was a malicious release</a><span>larchworker 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18231"><b>Malicious release</b> loadferry 0.1.0 on PyPI was a malicious release</a><span>loadferry 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18232"><b>Malicious release</b> marshrunner 0.1.0 on PyPI was a malicious release</a><span>marshrunner 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18233"><b>Malicious release</b> otterload 0.1.0 on PyPI was a malicious release</a><span>otterload 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18234"><b>Malicious release</b> reedworker 0.1.0 on PyPI was a malicious release</a><span>reedworker 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18235"><b>Malicious release</b> runpier 0.1.0 on PyPI was a malicious release</a><span>runpier 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18236"><b>Malicious release</b> sedgehaul 0.1.0 on PyPI was a malicious release</a><span>sedgehaul 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18237"><b>Malicious release</b> slatejob 0.1.0 on PyPI was a malicious release</a><span>slatejob 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18238"><b>Malicious release</b> taskquay 0.1.0 on PyPI was a malicious release</a><span>taskquay 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18239"><b>Malicious release</b> thistlerun 0.1.0 on PyPI was a malicious release</a><span>thistlerun 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18240"><b>Malicious release</b> thornqueue 0.1.0 on PyPI was a malicious release</a><span>thornqueue 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18241"><b>Malicious release</b> workslip 0.1.0 on PyPI was a malicious release</a><span>workslip 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18242"><b>Malicious release</b> sitecard 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious release</a><span>sitecard 0.1.0, 0.1.1, 0.1.2, 0.1.3, 0.1.6, 0.1.7, 0.1.8, 0.1.9, 0.1.10, 0.1.11, 0.1.12, 0.1.13, 0.1.14</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18243"><b>Malicious release</b> @k18k/entrypoint-sdk-darwin-arm64 0.2.0 on npm was a malicious release</a><span>@k18k/entrypoint-sdk-darwin-arm64 0.2.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18244"><b>Malicious release</b> @k18k/entrypoint-sdk-darwin-x64 0.2.0, 0.2.1 on npm was a malicious release</a><span>@k18k/entrypoint-sdk-darwin-x64 0.2.0, 0.2.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18245"><b>Malicious release</b> @k18k/entrypoint-sdk-linux-x64 0.2.0, 0.2.1 on npm was a malicious release</a><span>@k18k/entrypoint-sdk-linux-x64 0.2.0, 0.2.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18246"><b>Malicious release</b> orqiva-runtime-win32-x64 0.1.0 on npm was a malicious release</a><span>orqiva-runtime-win32-x64 0.1.0</span></li></ul> https://threatline.ai/brief/2026-10-22 2026-10-22T23:59:59Z <h2>Reported exploited, not on CISA's list yet</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-114625"><b>CVE-2026-114625</b> Arista VeloCloud Orchestrator SQL Injection Vulnerability</a><span>Arista VeloCloud Orchestrator · Critical 9.9 · CISA: check for compromise · Federal deadline 2026-10-26 · Fixed in 5.2.3.18 · Zero-day reported by 5 outlets, first by <a href="https://bsky.app/profile/securityonline.bsky.social/post/3myhxwvbcy32s" rel="noopener noreferrer nofollow">Bluesky: exploited in the wild</a></span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-18152"><b>Malicious release</b> acousticpack 0.1.0 on PyPI was a malicious release</a><span>acousticpack 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18153"><b>Malicious release</b> hookgantry 0.1.0 on PyPI was a malicious release</a><span>hookgantry 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18154"><b>Malicious release</b> pipegrip 0.1.0 on PyPI was a malicious release</a><span>pipegrip 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18155"><b>Malicious release</b> acoustichub 0.1.0 on PyPI was a malicious release</a><span>acoustichub 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18156"><b>Malicious release</b> asrdock 0.1.0 on PyPI was a malicious release</a><span>asrdock 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18157"><b>Malicious release</b> asrloom 0.1.0 on PyPI was a malicious release</a><span>asrloom 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18158"><b>Malicious release</b> audiokit 0.1.0 on PyPI was a malicious release</a><span>audiokit 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18159"><b>Malicious release</b> benchbridge 0.1.0 on PyPI was a malicious release</a><span>benchbridge 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18160"><b>Malicious release</b> benchworks 0.1.0 on PyPI was a malicious release</a><span>benchworks 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18161"><b>Malicious release</b> evalstream 0.1.0 on PyPI was a malicious release</a><span>evalstream 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18162"><b>Malicious release</b> modelworks 0.1.0 on PyPI was a malicious release</a><span>modelworks 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18163"><b>Malicious release</b> phonemeforge 0.1.0 on PyPI was a malicious release</a><span>phonemeforge 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18164"><b>Malicious release</b> phonemeprobe 0.1.0 on PyPI was a malicious release</a><span>phonemeprobe 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18165"><b>Malicious release</b> soundsocket 0.1.0 on PyPI was a malicious release</a><span>soundsocket 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18166"><b>Malicious release</b> speakbench 0.1.0 on PyPI was a malicious release</a><span>speakbench 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18167"><b>Malicious release</b> speaksocket 0.1.0 on PyPI was a malicious release</a><span>speaksocket 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18168"><b>Malicious release</b> speechprobe 0.1.0 on PyPI was a malicious release</a><span>speechprobe 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18169"><b>Malicious release</b> ttsdock 0.1.0 on PyPI was a malicious release</a><span>ttsdock 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18170"><b>Malicious release</b> ttsflow 0.1.0 on PyPI was a malicious release</a><span>ttsflow 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18171"><b>Malicious release</b> ttsprobe 0.1.0 on PyPI was a malicious release</a><span>ttsprobe 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18172"><b>Malicious release</b> ttsweaver 0.1.0 on PyPI was a malicious release</a><span>ttsweaver 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18173"><b>Malicious release</b> vocabbench 0.1.0 on PyPI was a malicious release</a><span>vocabbench 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18174"><b>Malicious release</b> vocabblend 0.1.0 on PyPI was a malicious release</a><span>vocabblend 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18175"><b>Malicious release</b> voicekit 0.1.0 on PyPI was a malicious release</a><span>voicekit 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18176"><b>Malicious release</b> voxweaver 0.1.0 on PyPI was a malicious release</a><span>voxweaver 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18183"><b>Malicious release</b> @conduitops/logview-archive 1.0.1 on npm was a malicious release</a><span>@conduitops/logview-archive 1.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18184"><b>Malicious release</b> formatting-subtitles 1.0.2 on npm was a malicious release</a><span>formatting-subtitles 1.0.2</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18185"><b>Malicious release</b> log-rotate-testmetest 1.0.1 on npm was a malicious release</a><span>log-rotate-testmetest 1.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18186"><b>Malicious release</b> net-codec-testmetest 1.0.1 on npm was a malicious release</a><span>net-codec-testmetest 1.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18187"><b>Malicious release</b> simplewave 0.0.2 on npm was a malicious release</a><span>simplewave 0.0.2</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18188"><b>Malicious release</b> 1h1 1.0.0 on PyPI was a malicious release</a><span>1h1 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18189"><b>Malicious release</b> aanthropic 1.0.0 on PyPI was a malicious release</a><span>aanthropic 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18190"><b>Malicious release</b> @liauto/darwin-x64 0.1.1-b3 on npm was a malicious release</a><span>@liauto/darwin-x64 0.1.1-b3</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18191"><b>Malicious release</b> @pkgship/frpc-darwin-amd64 0.71.1 on npm was a malicious release</a><span>@pkgship/frpc-darwin-amd64 0.71.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18192"><b>Malicious release</b> agentic-awesome-skills 19.0.0, 19.9.0, 19.6.0 on npm was a malicious release</a><span>agentic-awesome-skills 19.0.0, 19.9.0, 19.6.0, 18.12.0, 18.9.0, 18.11.0, 19.4.0, 19.10.1, 18.14.0, 18.13.0, 19.0.1, 18.10.0, 19.2.0, 19.7.0, 19.1.0, 19.3.0, 19.5.0, 19.12.1, 19.13.0, 19.12.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18194"><b>Malicious release</b> @lumen-labs-dev/whisper-node 0.5.1 on npm was a malicious release</a><span>@lumen-labs-dev/whisper-node 0.5.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18195"><b>Malicious release</b> darknode-cli 2.46.2, 2.46.1, 2.46.0 on npm was a malicious release</a><span>darknode-cli 2.46.2, 2.46.1, 2.46.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18197"><b>Malicious release</b> x402-prompt-injection-scan 0.1.4 on npm was a malicious release</a><span>x402-prompt-injection-scan 0.1.4</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18198"><b>Malicious release</b> @pkgship/frpc-linux-amd64 0.71.1 on npm was a malicious release</a><span>@pkgship/frpc-linux-amd64 0.71.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18199"><b>Malicious release</b> @pkgship/frps-linux-amd64 0.71.1 on npm was a malicious release</a><span>@pkgship/frps-linux-amd64 0.71.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18200"><b>Malicious release</b> @seggy116/next-diff 0.3.0 on npm was a malicious release</a><span>@seggy116/next-diff 0.3.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18203"><b>Malicious release</b> journey-teste-shellhello 0.2.0 on PyPI was a malicious release</a><span>journey-teste-shellhello 0.2.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18204"><b>Malicious release</b> @factiii/runner 0.28.0 on npm was a malicious release</a><span>@factiii/runner 0.28.0</span></li></ul> <h2>Critical flaws in products attackers have targeted</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-110264"><b>CVE-2026-110264</b> Integer Overflow or Wraparound in GitLab</a><span>GitLab GitLab · Critical 10 · Fixed in 18.11.13</span></li><li><a href="https://threatline.ai/cve/CVE-2026-114612"><b>CVE-2026-114612</b> LiteLLM: Privilege Escalation to Proxy Admin via Cross-Domain Reuse of the Salt Key</a><span>BerriAI litellm · Critical 9.9 · Fixed in 1.100.4</span></li></ul> https://threatline.ai/brief/2026-10-21 2026-10-21T23:59:59Z <h2>Reported exploited, not on CISA's list yet</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-109618"><b>CVE-2026-109618</b> PHP: RCE via OOM corruption</a><span>PHP Group PHP · Critical 9.2 · Fixed in 8.2.35 · Zero-day reported by 25 outlets, first by <a href="https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell" rel="noopener noreferrer nofollow">Aikido</a> · WAF rule: Cloudflare WAF</span></li><li><a href="https://threatline.ai/cve/CVE-2026-109619"><b>CVE-2026-109619</b> PHP: RCE via stale global state</a><span>PHP Group PHP · Critical 9.2 · Fixed in 8.2.35 · Zero-day reported by 23 outlets, first by <a href="https://www.aikido.dev/blog/critical-vulnerabilities-in-php-php2shell" rel="noopener noreferrer nofollow">Aikido</a> · WAF rule: Cloudflare WAF</span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/connectwise-cloud-backup-2026-10"><b>Compromised service</b> ConnectWise Cloud Backup apps abused to reach Microsoft 365 tenants</a><span>ConnectWise Cloud Backup</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18122"><b>Malicious release</b> moveworks-capi-starter 0.0.0, 0.2.0 on PyPI was a malicious release</a><span>moveworks-capi-starter 0.0.0, 0.2.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18124"><b>Malicious release</b> journey-test-helloshell 0.2.0 on PyPI was a malicious release</a><span>journey-test-helloshell 0.2.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18126"><b>Malicious release</b> zzhelloworld_socktest 0.1.9, 0.1.5, 0.1.6 on RubyGems was a malicious release</a><span>zzhelloworld_socktest 0.1.9, 0.1.5, 0.1.6, 0.2.0, 0.1.7, 0.2.1, 0.1.8</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18127"><b>Malicious release</b> @sudobility/indexer_client 0.0.146 on npm was a malicious release</a><span>@sudobility/indexer_client 0.0.146</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18128"><b>Malicious release</b> @sudobility/shaperouter_client 0.0.14 on npm was a malicious release</a><span>@sudobility/shaperouter_client 0.0.14</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18129"><b>Malicious release</b> @sudobility/testomniac_client 0.0.131 on npm was a malicious release</a><span>@sudobility/testomniac_client 0.0.131</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18130"><b>Malicious release</b> @sudobility/wildduck_client 2.3.102 on npm was a malicious release</a><span>@sudobility/wildduck_client 2.3.102</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18131"><b>Malicious release</b> iterquarry 2.1.1, 2.1.2, 2.1.3 on PyPI was a malicious release</a><span>iterquarry 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.2.0, 2.2.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18132"><b>Malicious release</b> libseal 1.1.0, 1.1.1, 1.1.2 on PyPI was a malicious release</a><span>libseal 1.1.0, 1.1.1, 1.1.2, 1.1.3</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18133"><b>Malicious release</b> journey-test-hellospy 0.1.1 on PyPI was a malicious release</a><span>journey-test-hellospy 0.1.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18134"><b>Malicious release</b> aurenatts 0.1.0 on PyPI was a malicious release</a><span>aurenatts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18135"><b>Malicious release</b> batchspar 0.1.0 on PyPI was a malicious release</a><span>batchspar 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18136"><b>Malicious release</b> brummatts 0.1.0 on PyPI was a malicious release</a><span>brummatts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18137"><b>Malicious release</b> codecraze 0.1.0 on PyPI was a malicious release</a><span>codecraze 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18138"><b>Malicious release</b> crenelatts 0.1.0 on PyPI was a malicious release</a><span>crenelatts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18139"><b>Malicious release</b> dictanovaasr 0.1.0 on PyPI was a malicious release</a><span>dictanovaasr 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18140"><b>Malicious release</b> grommatts 0.1.0 on PyPI was a malicious release</a><span>grommatts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18141"><b>Malicious release</b> melcuratts 0.1.0 on PyPI was a malicious release</a><span>melcuratts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18142"><b>Malicious release</b> orchestril 0.1.0 on PyPI was a malicious release</a><span>orchestril 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18143"><b>Malicious release</b> phonoviatts 0.1.0 on PyPI was a malicious release</a><span>phonoviatts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18144"><b>Malicious release</b> prosodinetts 0.1.0 on PyPI was a malicious release</a><span>prosodinetts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18145"><b>Malicious release</b> quillonatts 0.1.0 on PyPI was a malicious release</a><span>quillonatts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18146"><b>Malicious release</b> shellgrip 0.1.0 on PyPI was a malicious release</a><span>shellgrip 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18147"><b>Malicious release</b> solivoxtts 0.1.0 on PyPI was a malicious release</a><span>solivoxtts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18148"><b>Malicious release</b> tessivatts 0.1.0 on PyPI was a malicious release</a><span>tessivatts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18149"><b>Malicious release</b> vellutts 0.1.0 on PyPI was a malicious release</a><span>vellutts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18150"><b>Malicious release</b> voxilaratts 0.1.0 on PyPI was a malicious release</a><span>voxilaratts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18151"><b>Malicious release</b> zennittts 0.1.0 on PyPI was a malicious release</a><span>zennittts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18177"><b>Malicious release</b> data-pipeline-testmetest 2.0.1 on npm was a malicious release</a><span>data-pipeline-testmetest 2.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18178"><b>Malicious release</b> event-emitter-testmetest 1.0.6, 1.0.7, 4.1.0 on npm was a malicious release</a><span>event-emitter-testmetest 1.0.6, 1.0.7, 4.1.0, 5.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18179"><b>Malicious release</b> log-sink-testmetest 1.0.1 on npm was a malicious release</a><span>log-sink-testmetest 1.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18180"><b>Malicious release</b> pixel-map-testmetest 0.0.1, 0.0.2, 0.0.3 on npm was a malicious release</a><span>pixel-map-testmetest 0.0.1, 0.0.2, 0.0.3</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18181"><b>Malicious release</b> test-brotli-testmetest 1.0.0 on npm was a malicious release</a><span>test-brotli-testmetest 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18182"><b>Malicious release</b> test-brotli2-testmetest 1.0.0 on npm was a malicious release</a><span>test-brotli2-testmetest 1.0.0</span></li></ul> <h2>Critical flaws in products attackers have targeted</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-89035"><b>CVE-2026-89035</b> MikroTik RouterOS 7.24.5 WebFig Session Token Replay Authentication Bypass</a><span>MikroTik RouterOS · Critical 9.1</span></li></ul> https://threatline.ai/brief/2026-10-20 2026-10-20T23:59:59Z <h2>Added to CISA's known exploited list</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-106931"><b>CVE-2026-106931</b> EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability</a><span>EG Secure Solutions SiteGuard Server Edition · High 7.8 · CISA: check for compromise · Federal deadline 2026-10-23</span></li><li><a href="https://threatline.ai/cve/CVE-2026-96656"><b>CVE-2026-96656</b> Plex Media Server External Control of File Name or Path Vulnerability</a><span>Plex Media Server · High 8.6 · CISA: check for compromise · Federal deadline 2026-10-23 · Fixed in 1.43.3.10861</span></li><li><a href="https://threatline.ai/cve/CVE-2026-96654"><b>CVE-2026-96654</b> Plex Media Server Improper Neutralization of Encoded URI Schemes in a Web Page Vulnerability</a><span>Plex Media Server · Medium 6.9 · Federal deadline 2026-10-23 · Fixed in 1.43.3.10861</span></li><li><a href="https://threatline.ai/cve/CVE-2026-96652"><b>CVE-2026-96652</b> Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability</a><span>Plex Media Server · Medium 4.3 · Federal deadline 2026-11-03 · Fixed in 1.43.3.10861</span></li><li><a href="https://threatline.ai/cve/CVE-2026-96655"><b>CVE-2026-96655</b> Plex Media Server Server-Side Request Forgery (SSRF) Vulnerability</a><span>Plex Media Server · Medium 4.3 · Federal deadline 2026-11-03 · Fixed in 1.43.3.10861</span></li><li><a href="https://threatline.ai/cve/CVE-2026-110936"><b>CVE-2026-110936</b> Siemens Software Center Uncontrolled Search Path Element Vulnerability</a><span>Siemens Software Center · Medium 6.7 · Federal deadline 2026-11-03</span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-18061"><b>Malicious release</b> ccl-global-shopping 99.9.1 on npm was a malicious release</a><span>ccl-global-shopping 99.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18062"><b>Malicious release</b> sc-wizard 99.9.1 on npm was a malicious release</a><span>sc-wizard 99.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18063"><b>Malicious release</b> fanarena-common 99.9.1 on npm was a malicious release</a><span>fanarena-common 99.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18064"><b>Malicious release</b> sc-announcer 99.9.1 on npm was a malicious release</a><span>sc-announcer 99.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18091"><b>Malicious release</b> @platform-services/hrm-mfe-core 99.9.1 on npm was a malicious release</a><span>@platform-services/hrm-mfe-core 99.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18092"><b>Malicious release</b> test-workalendar-internal 0.0.1, 0.0.2, 0.0.3 on PyPI was a malicious release</a><span>test-workalendar-internal 0.0.1, 0.0.2, 0.0.3</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18093"><b>Malicious release</b> workcalender 17.1.0.dev0 on PyPI was a malicious release</a><span>workcalender 17.1.0.dev0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18094"><b>Malicious release</b> pafex 2.3 on PyPI was a malicious release</a><span>pafex 2.3</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18095"><b>Malicious release</b> resion 22.0.1 on PyPI was a malicious release</a><span>resion 22.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18096"><b>Malicious release</b> workalender 17.1.0.dev0 on PyPI was a malicious release</a><span>workalender 17.1.0.dev0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18097"><b>Malicious release</b> research-probe-6150c1c915 0.1.0 on PyPI was a malicious release</a><span>research-probe-6150c1c915 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18098"><b>Malicious release</b> security-research-startup-snapshot-810764b303 0.1.0 on PyPI was a malicious release</a><span>security-research-startup-snapshot-810764b303 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18101"><b>Malicious release</b> semmver 1.0.0 on PyPI was a malicious release</a><span>semmver 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18102"><b>Malicious release</b> semveer 1.0.0 on PyPI was a malicious release</a><span>semveer 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18103"><b>Malicious release</b> semverr 1.0.0 on PyPI was a malicious release</a><span>semverr 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18104"><b>Malicious release</b> semvver 1.0.0 on PyPI was a malicious release</a><span>semvver 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18105"><b>Malicious release</b> @securihackbot/depconf-stage-1792484738 1.0.0 on npm was a malicious release</a><span>@securihackbot/depconf-stage-1792484738 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18106"><b>Malicious release</b> memories-core-web 99.0.0 on npm was a malicious release</a><span>memories-core-web 99.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18107"><b>Malicious release</b> nwfp-build-config 1.0.0, 0.0.0-stage on npm was a malicious release</a><span>nwfp-build-config 1.0.0, 0.0.0-stage</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18109"><b>Malicious release</b> rs-lookout-sandbox-poc 1.0.1 on npm was a malicious release</a><span>rs-lookout-sandbox-poc 1.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18110"><b>Malicious release</b> facewareretargeter 9.9.9 on PyPI was a malicious release</a><span>facewareretargeter 9.9.9</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18111"><b>Malicious release</b> hijiko-pilaka 1.0.0 on PyPI was a malicious release</a><span>hijiko-pilaka 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18112"><b>Malicious release</b> hijok-lampam 1.0.0 on PyPI was a malicious release</a><span>hijok-lampam 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18113"><b>Malicious release</b> jiklpo-tsunari-kay 1.0.0 on PyPI was a malicious release</a><span>jiklpo-tsunari-kay 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18114"><b>Malicious release</b> trijigo-kalip 1.0.0 on PyPI was a malicious release</a><span>trijigo-kalip 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18116"><b>Malicious release</b> debbug 1.0.0 on PyPI was a malicious release</a><span>debbug 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18117"><b>Malicious release</b> deebug 1.0.0 on PyPI was a malicious release</a><span>deebug 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18118"><b>Malicious release</b> semer 1.0.0 on PyPI was a malicious release</a><span>semer 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18119"><b>Malicious release</b> ssemver 1.0.0 on PyPI was a malicious release</a><span>ssemver 1.0.0</span></li></ul> <h2>Critical flaws in products attackers have targeted</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-113252"><b>CVE-2026-113252</b> Improper input validation in ANGLE in Google Chrome on on Windows prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (C</a><span>Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47</span></li><li><a href="https://threatline.ai/cve/CVE-2026-113328"><b>CVE-2026-113328</b> Improper input validation in Privacy in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu</a><span>Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47</span></li><li><a href="https://threatline.ai/cve/CVE-2026-113235"><b>CVE-2026-113235</b> Improper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se</a><span>Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47</span></li><li><a href="https://threatline.ai/cve/CVE-2026-113089"><b>CVE-2026-113089</b> Improper input validation in PrintPreview in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium</a><span>Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47</span></li><li><a href="https://threatline.ai/cve/CVE-2026-113023"><b>CVE-2026-113023</b> Improper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium s</a><span>Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47</span></li><li><a href="https://threatline.ai/cve/CVE-2026-113300"><b>CVE-2026-113300</b> Out of bounds write in Forms in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security sev</a><span>Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47</span></li><li><a href="https://threatline.ai/cve/CVE-2026-113014"><b>CVE-2026-113014</b> Use after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium securit</a><span>Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47</span></li><li><a href="https://threatline.ai/cve/CVE-2026-113189"><b>CVE-2026-113189</b> Use after free in Core in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Medium)</a><span>Google Chrome · Critical 9.6 · Fixed in 156.0.8078.47</span></li></ul> https://threatline.ai/brief/2026-10-19 2026-10-19T23:59:59Z <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17926"><b>Malicious release</b> fabdeploycheck 0.1.1 on PyPI was a malicious release</a><span>fabdeploycheck 0.1.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17927"><b>Malicious release</b> fabtoolkit 0.1.2, 0.1.1, 0.1.0 on PyPI was a malicious release</a><span>fabtoolkit 0.1.2, 0.1.1, 0.1.0, 0.2.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17928"><b>Malicious release</b> @fcsmc/commercial-analytics 99.9.1 on npm was a malicious release</a><span>@fcsmc/commercial-analytics 99.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17929"><b>Malicious release</b> @fmr-ap149494/apex-base-component 99.9.1 on npm was a malicious release</a><span>@fmr-ap149494/apex-base-component 99.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17943"><b>Malicious release</b> vinted-mocked-apis 99.0.0 on PyPI was a malicious release</a><span>vinted-mocked-apis 99.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18045"><b>Malicious release</b> asurion 99.0.0 on PyPI was a malicious release</a><span>asurion 99.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18065"><b>Malicious release</b> animate-tailwind-kit 3.0.1, 3.0.4 on npm was a malicious release</a><span>animate-tailwind-kit 3.0.1, 3.0.4</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18066"><b>Malicious release</b> animate-twcss-bridge 2.0.6 on npm was a malicious release</a><span>animate-twcss-bridge 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18067"><b>Malicious release</b> animate-twcss-pack 2.0.6 on npm was a malicious release</a><span>animate-twcss-pack 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18068"><b>Malicious release</b> animatecss-tailwind-binary 2.0.6 on npm was a malicious release</a><span>animatecss-tailwind-binary 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18069"><b>Malicious release</b> animatecss-tailwind-graphic 2.0.6 on npm was a malicious release</a><span>animatecss-tailwind-graphic 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18070"><b>Malicious release</b> animatecss-tailwind-helper 2.0.6 on npm was a malicious release</a><span>animatecss-tailwind-helper 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18071"><b>Malicious release</b> animatecss-tailwind-luminary 2.0.6, 2.0.7 on npm was a malicious release</a><span>animatecss-tailwind-luminary 2.0.6, 2.0.7</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18072"><b>Malicious release</b> animatecss-tailwind-plugin 2.0.6 on npm was a malicious release</a><span>animatecss-tailwind-plugin 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18073"><b>Malicious release</b> animatecss-tailwind-presets 1.0.0, 2.0.3 on npm was a malicious release</a><span>animatecss-tailwind-presets 1.0.0, 2.0.3</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18074"><b>Malicious release</b> animatecss-tailwind-vectrix 2.0.6, 2.0.7 on npm was a malicious release</a><span>animatecss-tailwind-vectrix 2.0.6, 2.0.7</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18075"><b>Malicious release</b> signalledger-bridge 2.0.6 on npm was a malicious release</a><span>signalledger-bridge 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18076"><b>Malicious release</b> signalledger-diagnostics 2.0.6 on npm was a malicious release</a><span>signalledger-diagnostics 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18077"><b>Malicious release</b> tailwind-animaflow-kit 2.0.6 on npm was a malicious release</a><span>tailwind-animaflow-kit 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18078"><b>Malicious release</b> tailwind-animate-kit 2.0.6, 2.0.7, 2.0.8 on npm was a malicious release</a><span>tailwind-animate-kit 2.0.6, 2.0.7, 2.0.8</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18079"><b>Malicious release</b> tailwind-animatecss-kit 2.0.6 on npm was a malicious release</a><span>tailwind-animatecss-kit 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18080"><b>Malicious release</b> tailwind-animationlab 2.0.6 on npm was a malicious release</a><span>tailwind-animationlab 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18081"><b>Malicious release</b> tailwind-css-keyframes 1.0.7 on npm was a malicious release</a><span>tailwind-css-keyframes 1.0.7</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18082"><b>Malicious release</b> tailwind-fabric 3.0.1, 3.0.4 on npm was a malicious release</a><span>tailwind-fabric 3.0.1, 3.0.4</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18083"><b>Malicious release</b> tailwind-keyframes 2.0.6 on npm was a malicious release</a><span>tailwind-keyframes 2.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18084"><b>Malicious release</b> tailwind-kinetic 2.0.6, 2.0.8 on npm was a malicious release</a><span>tailwind-kinetic 2.0.6, 2.0.8</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18085"><b>Malicious release</b> tailwindcss-animate-catalog 2.0.6, 2.0.7 on npm was a malicious release</a><span>tailwindcss-animate-catalog 2.0.6, 2.0.7</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18086"><b>Malicious release</b> tailwindcss-animatemotion 1.0.7 on npm was a malicious release</a><span>tailwindcss-animatemotion 1.0.7</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18087"><b>Malicious release</b> tailwindcss-effect-lab 0.0.0-stage, 1.6.7 on npm was a malicious release</a><span>tailwindcss-effect-lab 0.0.0-stage, 1.6.7</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18088"><b>Malicious release</b> tailwindcss-keyframe-kit 3.0.0, 3.0.1, 3.0.2 on npm was a malicious release</a><span>tailwindcss-keyframe-kit 3.0.0, 3.0.1, 3.0.2</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18089"><b>Malicious release</b> tailwindcss-motionanimate 1.0.1 on npm was a malicious release</a><span>tailwindcss-motionanimate 1.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18090"><b>Malicious release</b> tailwindcss-visual-kit 0.0.0-stage, 1.3.6 on npm was a malicious release</a><span>tailwindcss-visual-kit 0.0.0-stage, 1.3.6</span></li></ul> https://threatline.ai/brief/2026-10-18 2026-10-18T23:59:59Z <h2>Reported exploited, not on CISA's list yet</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-106931"><b>CVE-2026-106931</b> EG Secure Solutions SiteGuard Server Edition OS Command Injection Vulnerability</a><span>EG Secure Solutions SiteGuard Server Edition · High 7.8 · CISA: check for compromise · Federal deadline 2026-10-23 · Zero-day reported by 3 outlets, first by <a href="https://bsky.app/profile/mariogalarza.bsky.social/post/3my6ogdxuiq24" rel="noopener noreferrer nofollow">Bluesky: zero-day</a></span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17921"><b>Malicious release</b> leakdeep 2.6.4, 2.5.0, 2.6.6 on PyPI was a malicious release</a><span>leakdeep 2.6.4, 2.5.0, 2.6.6, 2.5.2, 2.6.0, 2.4.1, 2.4.5, 2.6.2, 3.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17922"><b>Malicious release</b> @pkgship/frpc-linux-arm64 0.71.0 on npm was a malicious release</a><span>@pkgship/frpc-linux-arm64 0.71.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-18108"><b>Malicious release</b> rootaccessxvv-bbmarker 1.0.2 on npm was a malicious release</a><span>rootaccessxvv-bbmarker 1.0.2</span></li></ul> https://threatline.ai/brief/2026-10-17 2026-10-17T23:59:59Z <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17912"><b>Malicious release</b> driftwavets 0.1.0 on PyPI was a malicious release</a><span>driftwavets 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17913"><b>Malicious release</b> emberlytts 0.1.0 on PyPI was a malicious release</a><span>emberlytts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17914"><b>Malicious release</b> glassbeakasr 0.1.0 on PyPI was a malicious release</a><span>glassbeakasr 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17915"><b>Malicious release</b> novalithtts 0.1.0 on PyPI was a malicious release</a><span>novalithtts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17916"><b>Malicious release</b> pyrechoasr 0.1.0 on PyPI was a malicious release</a><span>pyrechoasr 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17917"><b>Malicious release</b> quasitonnts 0.1.0 on PyPI was a malicious release</a><span>quasitonnts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17918"><b>Malicious release</b> tonemaptts 0.1.0 on PyPI was a malicious release</a><span>tonemaptts 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17919"><b>Malicious release</b> ukraine69 1.2.0, 1.2.1, 1.2.2 on PyPI was a malicious release</a><span>ukraine69 1.2.0, 1.2.1, 1.2.2, 1.2.3, 1.2.5, 1.2.6, 1.2.7, 1.2.8</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17920"><b>Malicious release</b> voltswannts 0.1.0 on PyPI was a malicious release</a><span>voltswannts 0.1.0</span></li></ul> https://threatline.ai/brief/2026-10-16 2026-10-16T23:59:59Z <h2>Added to CISA's known exploited list</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-102764"><b>CVE-2026-102764</b> BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability</a><span>BeyondTrust Remote Support · Critical 9.3 · CISA: check for compromise · Federal deadline 2026-10-19</span></li><li><a href="https://threatline.ai/cve/CVE-2025-61624"><b>CVE-2025-61624</b> Fortinet Multiple Products Path Traversal Vulnerability</a><span>Fortinet Multiple Products · Medium 5.4 · CISA: check for compromise · Federal deadline 2026-10-19</span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17866"><b>Malicious release</b> pyyi 2.4.1, 2.4.2, 2.4 on PyPI was a malicious release</a><span>pyyi 2.4.1, 2.4.2, 2.4, 2.5.5, 2.5.2, 2.5.0, 2.5.1, 2.5.4, 2.5.3</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17897"><b>Malicious release</b> fromthehotel-poems 0.1.0 on PyPI was a malicious release</a><span>fromthehotel-poems 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17898"><b>Malicious release</b> @flexmr/survey-client 1.0.0, 1.0.12, 3.0.12 on npm was a malicious release</a><span>@flexmr/survey-client 1.0.0, 1.0.12, 3.0.12, 10.0.12, 2.0.12</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17899"><b>Malicious release</b> @flexmr/survey-conversation 1.0.12, 10.0.12, 2.0.12 on npm was a malicious release</a><span>@flexmr/survey-conversation 1.0.12, 10.0.12, 2.0.12, 1.0.0, 3.0.12</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17900"><b>Malicious release</b> marocolor 1.0.0 on PyPI was a malicious release</a><span>marocolor 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17910"><b>Malicious release</b> itsa-react-focuscontainer 16.0.10 on npm was a malicious release</a><span>itsa-react-focuscontainer 16.0.10</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17911"><b>Malicious release</b> itsa-react-maskedinput 16.1.2 on npm was a malicious release</a><span>itsa-react-maskedinput 16.1.2</span></li></ul> https://threatline.ai/brief/2026-10-15 2026-10-15T23:59:59Z <h2>Added to CISA's known exploited list</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-21589"><b>CVE-2026-21589</b> Atlassian Multiple Products Files or Directories Accessible to External Parties Vulnerability</a><span>Atlassian Multiple Products · Critical 9.3 · CISA: check for compromise · Federal deadline 2026-10-18</span></li></ul> <h2>Reported exploited, not on CISA's list yet</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-102764"><b>CVE-2026-102764</b> BeyondTrust Remote Support Authentication Bypass by Spoofing Vulnerability</a><span>BeyondTrust Remote Support · Critical 9.3 · CISA: check for compromise · Federal deadline 2026-10-19 · Zero-day reported by 6 outlets, first by <a href="https://cloud.google.com/blog/topics/threat-intelligence/armory-castle-exploits-beyondtrust/" rel="noopener noreferrer nofollow">Google Threat Intelligence</a></span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17881"><b>Malicious release</b> py-sock2 0.1.0 on PyPI was a malicious release</a><span>py-sock2 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17883"><b>Malicious release</b> py-worm 0.1.0, 2.0.0, 2.0.1 on PyPI was a malicious release</a><span>py-worm 0.1.0, 2.0.0, 2.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17884"><b>Malicious release</b> getpubip 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious release</a><span>getpubip 0.1.0, 0.1.1, 0.1.2</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17885"><b>Malicious release</b> proxyrubika 0.1.0 on PyPI was a malicious release</a><span>proxyrubika 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17886"><b>Malicious release</b> py-wormgpt 1.0.0 on PyPI was a malicious release</a><span>py-wormgpt 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17887"><b>Malicious release</b> proxy-rubikis 0.1.0 on PyPI was a malicious release</a><span>proxy-rubikis 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17889"><b>Malicious release</b> proxyrobika 0.1.0 on PyPI was a malicious release</a><span>proxyrobika 0.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17893"><b>Malicious release</b> buyerdashboard 45.3.4 on npm was a malicious release</a><span>buyerdashboard 45.3.4</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17894"><b>Malicious release</b> idlive-face-capture-web-development 78.8.1 on npm was a malicious release</a><span>idlive-face-capture-web-development 78.8.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17895"><b>Malicious release</b> web-pixels-manager 76.2.4 on npm was a malicious release</a><span>web-pixels-manager 76.2.4</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17896"><b>Malicious release</b> xapi-lib 88.2.5, 88.2.3, 90.2.1 on npm was a malicious release</a><span>xapi-lib 88.2.5, 88.2.3, 90.2.1, 90.3.1</span></li></ul> <h2>Critical flaws in products attackers have targeted</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-110916"><b>CVE-2026-110916</b> Improper input validation in Desktop in Google Chrome prior to 155.0.8059.84 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium secu</a><span>Google Chrome · Critical 9.6 · Fixed in 155.0.8059.84</span></li></ul> https://threatline.ai/brief/2026-10-14 2026-10-14T23:59:59Z <h2>Added to CISA's known exploited list</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-105134"><b>CVE-2026-105134</b> Ahsay AhsayCBS Command Injection Vulnerability</a><span>Ahsay AhsayCBS · Critical 10 · CISA: check for compromise · Federal deadline 2026-10-17</span></li><li><a href="https://threatline.ai/cve/CVE-2026-105133"><b>CVE-2026-105133</b> Ahsay AhsayCBS Improper Authentication Vulnerability</a><span>Ahsay AhsayCBS · Medium 6.9 · Federal deadline 2026-10-17</span></li><li><a href="https://threatline.ai/cve/CVE-2026-76519"><b>CVE-2026-76519</b> Cisco Secure Email Gateway Relative Path Traversal Vulnerability</a><span>Cisco Secure Email Gateway · Critical 9.8 · CISA: check for compromise · Federal deadline 2026-10-17</span></li><li><a href="https://threatline.ai/cve/CVE-2026-0322"><b>CVE-2026-0322</b> Palo Alto Networks PAN-OS Code Injection Vulnerability</a><span>Palo Alto Networks PAN-OS · High 8.6 · CISA: check for compromise · Federal deadline 2026-10-17 · Fixed in 12.2.4</span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17868"><b>Malicious release</b> @kre64/hello-npm-test 1.0.0 on npm was a malicious release</a><span>@kre64/hello-npm-test 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17876"><b>Malicious release</b> @xxxfnbs21/hello-demo 0.1.8, 0.1.6, 0.1.5 on npm was a malicious release</a><span>@xxxfnbs21/hello-demo 0.1.8, 0.1.6, 0.1.5, 0.1.3, 0.1.2, 0.1.1, 0.1.0, 0.0.0-stage</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17880"><b>Malicious release</b> seapy-ops 1.0.0, 1.0.1, 1.0.2 on PyPI was a malicious release</a><span>seapy-ops 1.0.0, 1.0.1, 1.0.2, 1.1.0, 1.1.1, 1.1.2, 1.2.1, 1.2.2</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17888"><b>Malicious release</b> @flexmr/utils 1.0.0, 3.0.12, 1.0.12 on npm was a malicious release</a><span>@flexmr/utils 1.0.0, 3.0.12, 1.0.12, 10.0.12, 2.0.12</span></li></ul> <h2>Critical flaws in products attackers have targeted</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-59774"><b>CVE-2026-59774</b> Gitea Org-mode file disclosure and code execution</a><span>Gitea Gitea · Critical 9.8 · Fixed in 1.27.1</span></li><li><a href="https://threatline.ai/cve/CVE-2026-110447"><b>CVE-2026-110447</b> Collabora Online – Built-in CODE Server OS Command Injection Vulnerability</a><span>Collabora Collabora Online – Built-in CODE Server · Critical 9.2 · CISA: check for compromise · Federal deadline 2026-10-26 · Fixed in 26.4.303</span></li></ul> https://threatline.ai/brief/2026-10-13 2026-10-13T23:59:59Z <h2>Added to CISA's known exploited list</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-104935"><b>CVE-2026-104935</b> Ivanti Connect Secure Authentication Bypass by Spoofing Vulnerability</a><span>Ivanti Connect Secure · High 8.6 · CISA: check for compromise · Federal deadline 2026-10-16</span></li><li><a href="https://threatline.ai/cve/CVE-2026-96951"><b>CVE-2026-96951</b> Microsoft Windows Command Injection Vulnerability</a><span>Microsoft Windows · High 8.8 · CISA: check for compromise · Federal deadline 2026-10-16 · Fixed in 20260925.100</span></li></ul> <h2>Reported exploited, not on CISA's list yet</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-108398"><b>CVE-2026-108398</b> .NET Framework Security Feature Bypass Vulnerability</a><span>Microsoft Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 · High 8.8 · Fixed in 2.0.50727.8987 AND 3.0.30729.8982 AND 4.7.4150.0 · Zero-day reported by 3 outlets, first by <a href="https://krebsonsecurity.com/2026/10/microsoft-patches-more-than-1400-security-flaws/" rel="noopener noreferrer nofollow">Krebs on Security</a></span></li></ul> <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17849"><b>Malicious release</b> brass-common 99.9.1 on npm was a malicious release</a><span>brass-common 99.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17851"><b>Malicious release</b> yoodan-github-single-ver-pkg 1.0.1 on npm was a malicious release</a><span>yoodan-github-single-ver-pkg 1.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17861"><b>Malicious release</b> sysdiagd 1.2.1, 1.2.2, 1.2.3 on PyPI was a malicious release</a><span>sysdiagd 1.2.1, 1.2.2, 1.2.3</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17862"><b>Malicious release</b> fontcase 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious release</a><span>fontcase 0.1.0, 0.1.1, 0.1.2</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17863"><b>Malicious release</b> crelic-bqwheel-52f66a3f1d 0.0.1 on PyPI was a malicious release</a><span>crelic-bqwheel-52f66a3f1d 0.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17867"><b>Malicious release</b> @accenturecodefoundry/mfe-pot-shared-ui-scds-core 99.99.2, 99.99.4, 99.99.41 on npm was a malicious release</a><span>@accenturecodefoundry/mfe-pot-shared-ui-scds-core 99.99.2, 99.99.4, 99.99.41, 99.99.43</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17879"><b>Malicious release</b> @flexmr/ui 99.99.99 on npm was a malicious release</a><span>@flexmr/ui 99.99.99</span></li></ul> <h2>Critical flaws in products attackers have targeted</h2><ul class="brief-list"><li><a href="https://threatline.ai/cve/CVE-2026-97229"><b>CVE-2026-97229</b> Integer Overflow or Wraparound in GitLab</a><span>GitLab GitLab · Critical 10 · Fixed in 19.2.8</span></li><li><a href="https://threatline.ai/cve/CVE-2026-110152"><b>CVE-2026-110152</b> Buffer overflow in ANGLE in Google Chrome on on Android prior to 155.0.8059.79 allowed a remote attacker to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium se</a><span>Google Chrome · Critical 9.6 · Fixed in 155.0.8059.79</span></li><li><a href="https://threatline.ai/cve/CVE-2026-109750"><b>CVE-2026-109750</b> Firefox: Site isolation issue in the DOM: Web Authentication component</a><span>Mozilla Firefox · Critical 9.6</span></li><li><a href="https://threatline.ai/cve/CVE-2026-109745"><b>CVE-2026-109745</b> Firefox: Sandbox escape due to uninitialized memory in the DOM: Web Serial component</a><span>Mozilla Firefox · Critical 9.6</span></li><li><a href="https://threatline.ai/cve/CVE-2026-109740"><b>CVE-2026-109740</b> Firefox: Sandbox escape due to incorrect boundary conditions in the Widget: Win32 component</a><span>Mozilla Firefox · Critical 9.6</span></li><li><a href="https://threatline.ai/cve/CVE-2026-110161"><b>CVE-2026-110161</b> Use after free in Network in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via crafted network traffic. (Chromium security severity: Crit</a><span>Google Chrome · Critical 9.6 · Fixed in 155.0.8059.79</span></li><li><a href="https://threatline.ai/cve/CVE-2026-109755"><b>CVE-2026-109755</b> Firefox: Sandbox escape in the DOM: Content Processes component</a><span>Mozilla Firefox · Critical 9.6</span></li><li><a href="https://threatline.ai/cve/CVE-2026-110136"><b>CVE-2026-110136</b> Use after free in PDF in Google Chrome prior to 155.0.8059.79 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)</a><span>Google Chrome · Critical 9.6 · Fixed in 155.0.8059.79</span></li></ul> https://threatline.ai/brief/2026-10-12 2026-10-12T23:59:59Z <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17806"><b>Malicious release</b> ap3-foundations-ui 99.0.1 on npm was a malicious release</a><span>ap3-foundations-ui 99.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17808"><b>Malicious release</b> @s4yhiitestpoc/r2-https-b 1.0.0 on npm was a malicious release</a><span>@s4yhiitestpoc/r2-https-b 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17809"><b>Malicious release</b> minecraftaccfinder 0.1.0, 0.1.1, 0.1.2 on PyPI was a malicious release</a><span>minecraftaccfinder 0.1.0, 0.1.1, 0.1.2, 0.3.0, 0.3.1, 0.4.0, 2.0.0, 3.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17847"><b>Malicious release</b> npp-ml 0.1.7, 0.1.8, 0.1.9 on PyPI was a malicious release</a><span>npp-ml 0.1.7, 0.1.8, 0.1.9, 0.1.10</span></li></ul> https://threatline.ai/brief/2026-10-11 2026-10-11T23:59:59Z <h2>Supply chain compromises</h2><ul class="brief-list"><li><a href="https://threatline.ai/#supply/MAL-2026-17758"><b>Malicious release</b> react-dropzone-v4 99.0.0 on npm was a malicious release</a><span>react-dropzone-v4 99.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17764"><b>Malicious release</b> @s4yhiitestpoc/r2-https 1.0.0 on npm was a malicious release</a><span>@s4yhiitestpoc/r2-https 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17765"><b>Malicious release</b> @s4yhiitestpoc/r3-https 1.0.0, 0.0.0-stage on npm was a malicious release</a><span>@s4yhiitestpoc/r3-https 1.0.0, 0.0.0-stage</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17766"><b>Malicious release</b> @s4yhiitestpoc/scan-https-d 1.0.0 on npm was a malicious release</a><span>@s4yhiitestpoc/scan-https-d 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17767"><b>Malicious release</b> another-very-long-name 2.0.0, 1.0.1, 2.0.1 on npm was a malicious release</a><span>another-very-long-name 2.0.0, 1.0.1, 2.0.1, 1.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17768"><b>Malicious release</b> cloudflare_module 3.0.0, 1.0.1, 1.0.0 on npm was a malicious release</a><span>cloudflare_module 3.0.0, 1.0.1, 1.0.0, 99.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17769"><b>Malicious release</b> deposit-limit-fe 100.100.106, 100.100.101, 100.100.102 on npm was a malicious release</a><span>deposit-limit-fe 100.100.106, 100.100.101, 100.100.102</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17770"><b>Malicious release</b> ksp-app 100.100.100 on npm was a malicious release</a><span>ksp-app 100.100.100</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17771"><b>Malicious release</b> ksp-client-registry 100.100.100, 100.100.101 on npm was a malicious release</a><span>ksp-client-registry 100.100.100, 100.100.101</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17773"><b>Malicious release</b> nested-lib 1.0.0, 1.0.1, 1.1.0 on npm was a malicious release</a><span>nested-lib 1.0.0, 1.0.1, 1.1.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17774"><b>Malicious release</b> nitro-bundled-dep 99.0.1, 2.0.1, 1.1.0 on npm was a malicious release</a><span>nitro-bundled-dep 99.0.1, 2.0.1, 1.1.0, 0.0.1, 1.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17775"><b>Malicious release</b> nitro-cjs-requirer 1.0.0, 0.0.1, 1.1.0 on npm was a malicious release</a><span>nitro-cjs-requirer 1.0.0, 0.0.1, 1.1.0, 2.0.0, 99.0.1, 3.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17776"><b>Malicious release</b> pay-methods-kmf 100.100.102, 100.100.100, 100.100.101 on npm was a malicious release</a><span>pay-methods-kmf 100.100.102, 100.100.100, 100.100.101</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17777"><b>Malicious release</b> react-paginate-v5 99.0.0 on npm was a malicious release</a><span>react-paginate-v5 99.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17778"><b>Malicious release</b> some-very-long-package-name 2.0.0, 1.0.0, 3.0.0 on npm was a malicious release</a><span>some-very-long-package-name 2.0.0, 1.0.0, 3.0.0, 2.0.1, 99.0.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17779"><b>Malicious release</b> airdrop-eligibility-check 0.9.1 on RubyGems was a malicious release</a><span>airdrop-eligibility-check 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17780"><b>Malicious release</b> block-explorer-api 0.9.1 on RubyGems was a malicious release</a><span>block-explorer-api 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17781"><b>Malicious release</b> btc-fee-estimator 0.9.1 on RubyGems was a malicious release</a><span>btc-fee-estimator 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17782"><b>Malicious release</b> crypto-tax-export 0.9.1 on RubyGems was a malicious release</a><span>crypto-tax-export 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17783"><b>Malicious release</b> defi-yield-calculator 0.9.1 on RubyGems was a malicious release</a><span>defi-yield-calculator 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17784"><b>Malicious release</b> dex-router-abis 0.9.1 on RubyGems was a malicious release</a><span>dex-router-abis 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17785"><b>Malicious release</b> erc20-approve-audit 0.9.1 on RubyGems was a malicious release</a><span>erc20-approve-audit 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17786"><b>Malicious release</b> eth-gas-oracle 0.9.1 on RubyGems was a malicious release</a><span>eth-gas-oracle 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17787"><b>Malicious release</b> evm-tx-decoder 0.9.1 on RubyGems was a malicious release</a><span>evm-tx-decoder 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17788"><b>Malicious release</b> gas-refuel-bridge 0.9.1 on RubyGems was a malicious release</a><span>gas-refuel-bridge 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17789"><b>Malicious release</b> hd-wallet-generator 0.9.1 on RubyGems was a malicious release</a><span>hd-wallet-generator 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17790"><b>Malicious release</b> mev-sandwich-detect 0.9.1 on RubyGems was a malicious release</a><span>mev-sandwich-detect 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17791"><b>Malicious release</b> multichain-rpc 0.9.1 on RubyGems was a malicious release</a><span>multichain-rpc 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17792"><b>Malicious release</b> nft-metadata-resolver 0.9.1 on RubyGems was a malicious release</a><span>nft-metadata-resolver 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17793"><b>Malicious release</b> perp-funding-rates 0.9.1 on RubyGems was a malicious release</a><span>perp-funding-rates 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17794"><b>Malicious release</b> seed-phrase-validator 0.9.1 on RubyGems was a malicious release</a><span>seed-phrase-validator 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17795"><b>Malicious release</b> sol-mint-utils 0.9.1 on RubyGems was a malicious release</a><span>sol-mint-utils 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17796"><b>Malicious release</b> staking-apr-fetcher 0.9.1 on RubyGems was a malicious release</a><span>staking-apr-fetcher 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17797"><b>Malicious release</b> ton-jetton-tools 0.9.1 on RubyGems was a malicious release</a><span>ton-jetton-tools 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17798"><b>Malicious release</b> tron-trc20-utils 0.9.1 on RubyGems was a malicious release</a><span>tron-trc20-utils 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17799"><b>Malicious release</b> wallet-balance-scanner 0.9.1 on RubyGems was a malicious release</a><span>wallet-balance-scanner 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17800"><b>Malicious release</b> wallet-hd-derive 0.9.1 on RubyGems was a malicious release</a><span>wallet-hd-derive 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17801"><b>Malicious release</b> web3-signer-kit 0.9.1 on RubyGems was a malicious release</a><span>web3-signer-kit 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17802"><b>Malicious release</b> xrp-ledger-utils 0.9.1 on RubyGems was a malicious release</a><span>xrp-ledger-utils 0.9.1</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17803"><b>Malicious release</b> hridoy-ultimate 8.0.0 on npm was a malicious release</a><span>hridoy-ultimate 8.0.0</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17848"><b>Malicious release</b> orderly-plugin-liquidity-heatmap 1.0.0, 1.0.1, 1.0.2 on npm was a malicious release</a><span>orderly-plugin-liquidity-heatmap 1.0.0, 1.0.1, 1.0.2, 1.0.3, 1.0.4, 1.0.6</span></li><li><a href="https://threatline.ai/#supply/MAL-2026-17878"><b>Malicious release</b> util-foriepft 1.0.0 on npm was a malicious release</a><span>util-foriepft 1.0.0</span></li></ul>