Dependency health Supply-chain news Pro coming soon

Supply-chain news

Recent headlines and reviewed incidents. Automated leads are not confirmed package findings.

Follow these headlines in your RSS/Atom reader. Included with Free; a verified account is required. Set up your feed → · Your profile →

Latest 20 topic groups.

Recent headlines · 20

Last completed feed check: 2026-11-07T03:14:34.781Z.

3 sources could not be refreshed

Infostealers, CISA Alerts & Advisories, CERT-FR. They will be retried on the next poll.

News topics ordered by latest coverage; first recorded report, key topic, publisher and linked coverage
Latest · UTCFirst reportKey topicPublisher

SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks ↗Vulnerabilities · BleepingComputer · 2026-11-07 00:00 UTC

VulnerabilitiesBleepingComputer

OpenSSH flaw exploited in the wild just hours after disclosure (CVE-2026-123158) ↗CVE-2026-123158 · Help Net Security · 2026-11-06 22:30 UTC

2 more reports

First recorded report: Help Net Security · 2026-11-06T12:49:41.000Z

Related coverage:

Hackers Target OpenSSH SSHole Flaw Within Hours of Disclosure, Gain Root on Honeypot ↗
The Hacker News · 2026-11-06 15:21 UTC

CVE-2026-123158 (*sshole): OpenSSH Password Authentication Bypass on Alpine Linux ↗
StepSecurity Blog · 2026-11-06 22:30 UTC

Article mentions: CVE-2026-123158

No unambiguous tracked-package match.

CVE-2026-123158Help Net Security

OpenSSF Community Day Europe 2026: Driving Systemic Security and Operational Resilience in Open Source ↗OpenSSF Blog · 2026-11-06 21:40 UTC

—OpenSSF Blog

Agents reveal secrets when offered to team up with each other ↗AI security · The Register Security · 2026-11-06 21:39 UTC

AI securityThe Register Security

Turning Up the Heat: Inside the Attacks on Europe’s Refrigeration System ↗Unit 42 by Palo Alto Networks · 2026-11-06 21:15 UTC

—Unit 42 by Palo Alto Networks

The Agents Have Now Found Your Secrets On GitHub: ARTEX Is Abusing Public Secrets Right Now ↗AI security · GitGuardian Blog · 2026-11-06 21:09 UTC

AI securityGitGuardian Blog

Addressing protocol security gaps in multi-tenant Kubernetes ↗AWS Security Blog · 2026-11-06 21:08 UTC

—AWS Security Blog

Chainalysis says hackers stole credentials and tokens for all of its customers ↗Ars Technica Security · 2026-11-06 20:56 UTC

—Ars Technica Security

Free Certified Patch for Critical Rails Active Storage Vulnerability ↗Vulnerabilities · Socket Blog · 2026-11-06 20:40 UTC

VulnerabilitiesSocket Blog

Checkmarx Joins Claude Marketplace to Advance AI-Powered Application Security ↗AI security · Checkmarx Supply Chain Security · 2026-11-06 20:32 UTC

AI securityCheckmarx Supply Chain Security

OpenAI's new GPT-6 Cyber AI finds 81 Firefox flaws, 948 Linux bugs ↗AI security · BleepingComputer · 2026-11-06 20:24 UTC

AI securityBleepingComputer

Fake security tools on GitHub push backdoors and infostealers ↗Malware · BleepingComputer · 2026-11-06 18:46 UTC

MalwareBleepingComputer

Malicious Files: Find What Supply Chain Attacks Leave Behind in Your GitHub Repositories and on Developer Machines ↗Shai-Hulud · StepSecurity Blog · 2026-11-06 17:11 UTC

1 more reports

First recorded report: StepSecurity Blog · 2026-11-04T15:00:37.000Z

Related coverage:

Shai-Hulud Descendant Surfaces in Malicious Ruby Gem That Steals Credentials and Poisons AI Tools ↗
Socket Blog · 2026-11-06 17:11 UTC

Article mentions: Shai-Hulud

injection · Checked after news was detected

Shai-HuludStepSecurity Blog

QNAP says hackers breaching NAS devices in Plex2Shell attacks ↗Leaks & breaches · BleepingComputer · 2026-11-06 17:04 UTC

Leaks & breachesBleepingComputer

Big Tech sues over California plan to limit kids’ scrolling ↗Malwarebytes Labs · 2026-11-06 15:06 UTC

—Malwarebytes Labs

OpenAI Launches GPT-6 Cyber After AI Helps Find 81 Firefox Flaws, 948 Linux Exploits ↗AI security · The Hacker News · 2026-11-06 14:58 UTC

AI securityThe Hacker News

From Sigstore to CRA readiness: Sylva’s journey with OpenSSF ↗OpenSSF Blog · 2026-11-06 14:44 UTC

—OpenSSF Blog

In Other News: Trezor Implant, LLMJacking Bills Hit $1M, SAP Flaws Weaponized Within Days ↗Vulnerabilities · SecurityWeek · 2026-11-06 14:40 UTC

VulnerabilitiesSecurityWeek

TSMC Mulls Making Advanced AI Memory Chips, Information Says ↗AI security · Bloomberg Technology · 2026-11-06 14:29 UTC

AI securityBloomberg Technology

Why Europe's Freezer Hacks Spread So Far, So Fast ↗Dark Reading · 2026-11-06 14:00 UTC

—Dark Reading
Reviewed incident reports · 7

Last reviewed 2026-10-08. Selected historical incidents; a past compromise does not establish that a current release is compromised.

· RubyGems · Ruby

Researchers link RubyGems spam campaign to OpenAI agents ↗

In a September update on the May 2026 campaign, RubyGems said it removed more than 500 malicious packages. Nightingale Collective attributes the activity to OpenAI agents; RubyGems says it cannot confirm that attribution. Attempts to obtain other users’ API keys were identified, but RubyGems found no evidence they succeeded.

Affected versions: The registry statement does not enumerate affected package versions; see the source investigation.

Registry-wide incident · no individual package associations assigned.

Source: RubyGems maintainers

Original reporting: The Wall Street Journal · exclusive reporting ↗

· npm

Chalk, debug and other npm packages carried wallet-targeting code ↗

Aikido reported compromised releases across a widely used group of npm packages. The injected browser code attempted to redirect cryptocurrency transactions to attacker-controlled destinations.

Affected versions: Affected releases differ by package; see the original report.

Packages: chalk · debug · ansi-styles · supports-color · strip-ansi · ansi-regex · color-convert · color-name · wrap-ansi · slice-ansi · is-arrayish · error-ex · color-string · simple-swizzle · has-ansi · supports-hyperlinks · chalk-template · backslash

Source: Aikido Security

· npm

Nx s1ngularity compromise and response ↗

Nx described how a GitHub Actions injection exposed a publishing token and enabled malicious releases that collected sensitive files. Its response included trusted publishing and manual release approval.

Affected versions: See Nx’s linked advisory for the package-specific affected versions.

Packages: nx

Source: Nx maintainers

About this feed and search

Search stored headlines, publishers, article mentions and matched package names, plus reviewed-report summaries. Full article bodies are not searchable. Coverage with the same specific topic is grouped within a 72-hour episode. Each row links to its earliest recorded report; later coverage is linked under Details. Roundups, generic platforms and separate campaign waves are not merged on a broad mention alone. Multiple reports are not independent corroboration. Ecosystem filtering uses package matches, so unmatched articles are excluded when you select an ecosystem.

Article mentions identify terms, not confirmed affected products or versions. Package links are automated leads, not confirmed vulnerability findings. Maintenance checks do not prove an affected version is safe.

Selected vulnerability advisories · 12

Sources and package mappings checked 2026-10-08. This is a manually reviewed selection of historical advisories, not a current exploitation ranking or complete CVE database. The news headlines above update separately.

An identity match is a reason to investigate, not confirmation that your installed release is vulnerable. Manifest checks do not establish runtime configuration or resolve every transitive dependency.

VulnerabilityProduct / package relationship
React Server Components denial of service
CVE-2026-23864 ↗

React maintainers

React Server Components server packages

Server Components deployments only; plain client-side React is not implicated. The January 2026 advisory describes follow-up DoS fixes in 19.0.4, 19.1.5 and 19.2.4. These are historical fixes for this advisory, not a guarantee against later vulnerabilities; follow current upstream guidance.

react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack
React Server Components remote code execution
CVE-2025-55182 ↗

React maintainers

React Server Components server packages

The original RCE advisory identifies 19.0.0, 19.1.0, 19.1.1 and 19.2.0 in the three server packages. Client-only React is outside this scope. Later advisories require further patches; the initial RCE fix does not certify a release against other vulnerabilities.

react-server-dom-webpack · react-server-dom-parcel · react-server-dom-turbopack
ZeroLogon
CVE-2020-1472 ↗

Microsoft / CVE Program

Windows / Netlogon

Host and domain-controller assessment required.

Outside package-only scan coverage
Log4Shell
CVE-2021-44228 ↗

Apache Logging Services

Apache Log4j Core

Applies to specific log4j-core releases, not log4j-api alone. Check resolved and bundled dependencies against Apache’s affected-version ranges.

org.apache.logging.log4j:log4j-core
ICMAD
CVE-2022-22536 ↗

SAP / CVE Program

SAP NetWeaver / related SAP services

Requires SAP product and deployment inventory.

Outside package-only scan coverage
ProxyLogon
CVE-2021-26855 ↗

Microsoft / CVE Program

Microsoft Exchange Server

Check the Exchange deployment; a NuGet package name cannot establish exposure.

Outside package-only scan coverage
Spring4Shell
CVE-2022-22965 ↗

Spring maintainers

Spring Framework

Historical affected branches include 5.3.0–5.3.17 and 5.2.19 and earlier. Exploitability depends on runtime and deployment; consult Spring’s advisory.

org.springframework:spring-webmvc · org.springframework:spring-webflux · org.springframework:spring-beans
Confluence RCE
CVE-2022-26134 ↗

Atlassian / CVE Program

Atlassian Confluence

Requires Confluence Server or Data Center version inventory.

Outside package-only scan coverage
vCenter RCE
CVE-2021-21972 ↗

VMware / CVE Program

VMware vCenter Server

Requires infrastructure product and version inventory.

Outside package-only scan coverage
Chrome use-after-free
CVE-2022-0609 ↗

Google / CVE Program

Google Chrome

Check the installed browser; JavaScript package names do not identify its version.

Outside package-only scan coverage
Follina
CVE-2022-30190 ↗

Microsoft / CVE Program

Windows MSDT

Requires Windows patch and configuration assessment.

Outside package-only scan coverage
PetitPotam
CVE-2021-36942 ↗

Microsoft / CVE Program

Windows LSA / EFSRPC

Requires Windows and domain configuration assessment.

Outside package-only scan coverage
Runtime advisories on OpenCVE

Browse CVEs by vendor and product. Runtime CVEs do not automatically apply to every package in that ecosystem; verify affected versions and configurations.

.NET Framework ↗.NET ↗Java / Oracle JDK ↗Node.js ↗Ruby ↗Python ↗Go ↗Rust ↗
News sources · 81 configured feeds

The news worker checks for due feeds one minute after each completed run. Individual feeds use one-, two- or ten-minute intervals; slow requests can delay a check. Clear tracked-package mentions trigger priority checks; they do not establish that an installed version is vulnerable. Sources without an RSS link and Feedspot’s directory are browsing resources. Reviewed reports above remain curated.