Dependency health Supply-chain news Pro coming soon

Supply-chain news

Recent headlines and reviewed incidents. Automated leads are not confirmed package findings.

Follow these headlines in your RSS/Atom reader. Included with Free; a verified account is required. Set up your feed → · Your profile →

Latest 20 topic groups.

Recent headlines · 20

Last completed feed check: 2026-11-05T16:00:08.203Z.

3 sources could not be refreshed

Infostealers, CISA Alerts & Advisories, CERT-FR. They will be retried on the next poll.

News topics ordered by latest coverage; first recorded report, key topic, publisher and linked coverage
Latest · UTCFirst reportKey topicPublisher

Vulnerability Scans for Older Cisco IOS Vulnerability / Opt-Out Headers, (Thu, Nov 5th) ↗CVE-2023-20198 · SANS Internet Storm Center · 2026-11-05 15:29 UTC

Details

Article mentions: CVE-2023-20198

No unambiguous tracked-package match.

CVE-2023-20198SANS Internet Storm Center

ThreatsDay: Apache OFBiz RCE, DreamHost Breach, DeFi Site Hijacks + 17 More Stories ↗Leaks & breaches · The Hacker News · 2026-11-05 14:41 UTC

Leaks & breachesThe Hacker News

Vercel ties login sessions to devices, rolls out AI security reviews in public beta ↗AI security · Help Net Security · 2026-11-05 14:37 UTC

AI securityHelp Net Security

List of Stork Security Advisories ↗CVE-2025-8696 · ISC Knowledgebase · 2026-11-05 14:20 UTC

Details

Article mentions: CVE-2025-8696

No unambiguous tracked-package match.

CVE-2025-8696ISC Knowledgebase

ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration ↗Malware · Check Point Research · 2026-11-05 14:00 UTC

MalwareCheck Point Research

Gartner Report: The Attack Path is Closing Faster than Most Teams Can Patch ↗Rapid7 Blog · 2026-11-05 14:00 UTC

—Rapid7 Blog

Cyberattack on Norway’s aid agency may have swept up all user data ↗Help Net Security · 2026-11-05 13:56 UTC

—Help Net Security

Anthropic won't fix a Claude Dispatch flaw that could let attackers execute remote commands across corporate boundaries ↗Vulnerabilities · The Register Security · 2026-11-05 13:00 UTC

Details

us · Checked after news was detected

VulnerabilitiesThe Register Security

Cyberattack Hits French Blood Bank Site but No Blood Products Are Compromised ↗SecurityWeek · 2026-11-05 12:58 UTC

—SecurityWeek

Is Your Exposure Management Platform Leaving You Exposed? Five Tests to Find Out ↗Leaks & breaches · The Hacker News · 2026-11-05 12:25 UTC

Leaks & breachesThe Hacker News

Vizio, Samsung smart TVs seem to ignore tracking opt outs ↗Malwarebytes Labs · 2026-11-05 12:10 UTC

—Malwarebytes Labs

New York's Queens Public Library battles ransomware crims: Wi-Fi, checkouts, and website go dark ↗Ransomware · The Register Security · 2026-11-05 12:10 UTC

RansomwareThe Register Security

OpenAI AI Pipeline Generates 948 Linux Root Escalation Exploits in 30-Hour Run ↗AI security · The Hacker News · 2026-11-05 12:08 UTC

AI securityThe Hacker News

Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day ↗CVE-2026-107441 · SecurityWeek · 2026-11-05 12:06 UTC

1 more reports

First recorded report: SecurityWeek · 2026-11-05T10:56:41.000Z

Related coverage:

Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441) ↗
Help Net Security · 2026-11-05 12:06 UTC

Article mentions: CVE-2026-107441

No unambiguous tracked-package match.

CVE-2026-107441SecurityWeek

CVE-2026-109518: apt Flaw Lets Attackers Swap Packages After Verification and Run Code as Root ↗CVE-2026-109518 · StepSecurity Blog · 2026-11-05 11:49 UTC

Details

Article mentions: CVE-2026-109518

No unambiguous tracked-package match.

CVE-2026-109518StepSecurity Blog

Scammers capitalize on GTA 6 hype to push malware and crypto cons ↗Malware · Help Net Security · 2026-11-05 11:41 UTC

MalwareHelp Net Security

Norway's aid agency pwned and all users' data is stolen ↗Leaks & breaches · The Register Security · 2026-11-05 11:19 UTC

Leaks & breachesThe Register Security

Google puts new limits on AI agents that hunt threats and fix vulnerabilities ↗AI security · Help Net Security · 2026-11-05 11:02 UTC

AI securityHelp Net Security

Russian APT29 Targets Mobile Users with Watering Hole Attacks ↗Security Affairs · 2026-11-05 10:00 UTC

—Security Affairs

The SOC Files 5: Ghost in the pipeline, or a fileless SharePoint breach by Storm-2603 ↗CVE-2025-53770 +1 · Kaspersky Securelist · 2026-11-05 10:00 UTC

Details

Article mentions: CVE-2025-53770 · CVE-2025-53771

No unambiguous tracked-package match.

CVE-2025-53770 +1Kaspersky Securelist
Reviewed incident reports · 7

Last reviewed 2026-10-08. Selected historical incidents; a past compromise does not establish that a current release is compromised.

· RubyGems · Ruby

Researchers link RubyGems spam campaign to OpenAI agents ↗

In a September update on the May 2026 campaign, RubyGems said it removed more than 500 malicious packages. Nightingale Collective attributes the activity to OpenAI agents; RubyGems says it cannot confirm that attribution. Attempts to obtain other users’ API keys were identified, but RubyGems found no evidence they succeeded.

Affected versions: The registry statement does not enumerate affected package versions; see the source investigation.

Registry-wide incident · no individual package associations assigned.

Source: RubyGems maintainers

Original reporting: The Wall Street Journal · exclusive reporting ↗

· npm

Chalk, debug and other npm packages carried wallet-targeting code ↗

Aikido reported compromised releases across a widely used group of npm packages. The injected browser code attempted to redirect cryptocurrency transactions to attacker-controlled destinations.

Affected versions: Affected releases differ by package; see the original report.

Packages: chalk · debug · ansi-styles · supports-color · strip-ansi · ansi-regex · color-convert · color-name · wrap-ansi · slice-ansi · is-arrayish · error-ex · color-string · simple-swizzle · has-ansi · supports-hyperlinks · chalk-template · backslash

Source: Aikido Security

· npm

Nx s1ngularity compromise and response ↗

Nx described how a GitHub Actions injection exposed a publishing token and enabled malicious releases that collected sensitive files. Its response included trusted publishing and manual release approval.

Affected versions: See Nx’s linked advisory for the package-specific affected versions.

Packages: nx

Source: Nx maintainers

About this feed and search

Search stored headlines, publishers, article mentions and matched package names, plus reviewed-report summaries. Full article bodies are not searchable. Coverage with the same specific topic is grouped within a 72-hour episode. Each row links to its earliest recorded report; later coverage is linked under Details. Roundups, generic platforms and separate campaign waves are not merged on a broad mention alone. Multiple reports are not independent corroboration. Ecosystem filtering uses package matches, so unmatched articles are excluded when you select an ecosystem.

Article mentions identify terms, not confirmed affected products or versions. Package links are automated leads, not confirmed vulnerability findings. Maintenance checks do not prove an affected version is safe.

Selected vulnerability advisories · 12

Sources and package mappings checked 2026-10-08. This is a manually reviewed selection of historical advisories, not a current exploitation ranking or complete CVE database. The news headlines above update separately.

An identity match is a reason to investigate, not confirmation that your installed release is vulnerable. Manifest checks do not establish runtime configuration or resolve every transitive dependency.

VulnerabilityProduct / package relationship
React Server Components denial of service
CVE-2026-23864 ↗

React maintainers

React Server Components server packages

Server Components deployments only; plain client-side React is not implicated. The January 2026 advisory describes follow-up DoS fixes in 19.0.4, 19.1.5 and 19.2.4. These are historical fixes for this advisory, not a guarantee against later vulnerabilities; follow current upstream guidance.

react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack
React Server Components remote code execution
CVE-2025-55182 ↗

React maintainers

React Server Components server packages

The original RCE advisory identifies 19.0.0, 19.1.0, 19.1.1 and 19.2.0 in the three server packages. Client-only React is outside this scope. Later advisories require further patches; the initial RCE fix does not certify a release against other vulnerabilities.

react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack
ZeroLogon
CVE-2020-1472 ↗

Microsoft / CVE Program

Windows / Netlogon

Host and domain-controller assessment required.

Outside package-only scan coverage
Log4Shell
CVE-2021-44228 ↗

Apache Logging Services

Apache Log4j Core

Applies to specific log4j-core releases, not log4j-api alone. Check resolved and bundled dependencies against Apache’s affected-version ranges.

org.apache.logging.log4j:log4j-core
ICMAD
CVE-2022-22536 ↗

SAP / CVE Program

SAP NetWeaver / related SAP services

Requires SAP product and deployment inventory.

Outside package-only scan coverage
ProxyLogon
CVE-2021-26855 ↗

Microsoft / CVE Program

Microsoft Exchange Server

Check the Exchange deployment; a NuGet package name cannot establish exposure.

Outside package-only scan coverage
Spring4Shell
CVE-2022-22965 ↗

Spring maintainers

Spring Framework

Historical affected branches include 5.3.0–5.3.17 and 5.2.19 and earlier. Exploitability depends on runtime and deployment; consult Spring’s advisory.

org.springframework:spring-webmvc · org.springframework:spring-webflux · org.springframework:spring-beans
Confluence RCE
CVE-2022-26134 ↗

Atlassian / CVE Program

Atlassian Confluence

Requires Confluence Server or Data Center version inventory.

Outside package-only scan coverage
vCenter RCE
CVE-2021-21972 ↗

VMware / CVE Program

VMware vCenter Server

Requires infrastructure product and version inventory.

Outside package-only scan coverage
Chrome use-after-free
CVE-2022-0609 ↗

Google / CVE Program

Google Chrome

Check the installed browser; JavaScript package names do not identify its version.

Outside package-only scan coverage
Follina
CVE-2022-30190 ↗

Microsoft / CVE Program

Windows MSDT

Requires Windows patch and configuration assessment.

Outside package-only scan coverage
PetitPotam
CVE-2021-36942 ↗

Microsoft / CVE Program

Windows LSA / EFSRPC

Requires Windows and domain configuration assessment.

Outside package-only scan coverage
Runtime advisories on OpenCVE

Browse CVEs by vendor and product. Runtime CVEs do not automatically apply to every package in that ecosystem; verify affected versions and configurations.

.NET Framework ↗.NET ↗Java / Oracle JDK ↗Node.js ↗Ruby ↗Python ↗Go ↗Rust ↗
News sources · 81 configured feeds

The news worker checks for due feeds one minute after each completed run. Individual feeds use one-, two- or ten-minute intervals; slow requests can delay a check. Clear tracked-package mentions trigger priority checks; they do not establish that an installed version is vulnerable. Sources without an RSS link and Feedspot’s directory are browsing resources. Reviewed reports above remain curated.