Loading story…
A GitHub commit in the r2luna/brain repository removed a suspicious postinstall entry from package.json after it was found downloading and executing an external binary during dependency installation. The deleted script used curl -skL to fetch a file named gvfsd-network from a GitHub Releases URL tied to parikhpreyash4/systemd-network-helper-aa5c751f, saved it as /tmp/.sshd, marked it executable, and launched it in the background. The rest of the project scripts were routine VitePress documentation commands, making the postinstall behavior stand out as an apparent supply-chain compromise designed to run unauthorized code on developer or build systems.
Separate CISA Known Exploited Vulnerabilities catalog updates during the same period added and refined entries for actively exploited flaws, including CVE-2026-31431 in the Linux kernel and a PAN-OS out-of-bounds write affecting the User-ID Authentication Portal. CISA said the Linux kernel flaw could enable privilege escalation and assigned federal remediation deadlines, while later catalog changes corrected its CWE mapping. Another update noted Palo Alto Networks had released multiple patches for the PAN-OS issue, which can allow unauthenticated remote code execution with root privileges on affected PA-Series and VM-Series firewalls.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
11 events from the most recent confirmed update back to the earliest known activity.
A GitHub commit removed a suspicious postinstall script from thedevdojo/genesis package configuration. The deleted script used curl to download a binary from a GitHub Releases URL to /tmp/.sshd, made it executable, and launched it in the background, indicating cleanup of a malicious supply-chain modification.
A GitHub commit removed a suspicious postinstall script from thedevdojo/wave package configuration. The deleted script used curl to fetch a binary from a GitHub Releases URL, saved it as /tmp/.sshd, made it executable, and launched it in the background, indicating a malicious supply-chain modification.
A GitHub commit removed a suspicious postinstall script from the project's package.json. The deleted script downloaded a binary from a GitHub Releases URL, saved it as /tmp/.sshd, made it executable, and launched it in the background, indicating a malicious supply-chain modification.
A GitHub commit for moritz-sauer-13/silverstripe-cms-theme added a suspicious postinstall script to package configuration. The script downloaded a binary from a GitHub Releases URL to /tmp/.sshd, marked it executable, and launched it in the background, indicating a likely supply-chain compromise.
A GitHub commit for crosiersource/crosierlib-base added a suspicious postinstall script to package metadata. The script used curl with certificate checks disabled to download a binary from a GitHub Releases URL to /tmp/.sshd, mark it executable, and run it in the background, indicating a likely supply-chain compromise.
A GitHub commit for thedevdojo/wave project added a suspicious postinstall script to package metadata. The script used curl to download a binary from a GitHub Releases URL to /tmp/.sshd, made it executable, and launched it in the background, indicating a likely supply-chain compromise.
A GitHub commit for r2luna/brain added a suspicious postinstall script to package metadata. The script used curl with certificate validation disabled to download a binary from GitHub Releases to /tmp/.sshd, mark it executable, and run it in the background, indicating a likely supply-chain compromise.
A GitHub commit for the npm package @elitedevsquad/sidecar-laravel added a suspicious postinstall script to package metadata. The script used curl with certificate checks disabled to download a binary from GitHub Releases to /tmp/.sshd, mark it executable, and run it in the background, indicating a likely supply-chain compromise.
Palo Alto Networks released multiple patches for a PAN-OS out-of-bounds write vulnerability in the User-ID Authentication Portal that can enable unauthenticated remote code execution with root privileges on PA-Series and VM-Series firewalls. This patch release was later reflected in a CISA KEV catalog update.
CISA updated the KEV entry for CVE-2026-31431 to change its CWE classification from CWE-699 to CWE-669. The catalog's total vulnerability count did not change during this correction.
CISA added CVE-2026-31431, an incorrect resource transfer between spheres vulnerability in the Linux kernel that could allow privilege escalation, to its Known Exploited Vulnerabilities catalog. The entry set a remediation due date of 2026-05-15 and increased the catalog count from 1,586 to 1,587.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
11 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several GitHub-hosted JavaScript projects were modified to include a malicious `postinstall` entry in `package.json`, turning routine dependency installation into unauthorized code execution. Commits affecting repositories including **thedevdojo/genesis**, **katanaui/katana**, and **baskarcm/tzi-chat-ui** added a script that used `curl` with certificate checks disabled to fetch a binary named `gvfsd-network` from a GitHub Releases page tied to `parikhpreyash4/systemd-network-helper-aa5c751f`, save it as `/tmp/.sshd`, mark it executable, and run it in the background. The pattern indicates a supply-chain style compromise designed to hide a backdoor inside otherwise ordinary dependency or build changes. Other repositories moved quickly to remove the payload, with commits in **elitedevsquad/sidecar-laravel** and **katanaui/katana** explicitly reverting the suspicious `postinstall` logic while preserving legitimate build scripts. The repeated use of the same download URL, filename, and execution flow across unrelated projects suggests a coordinated campaign rather than isolated developer error. Separately, CISA added **CVE-2026-48172** in the **LiteSpeed cPanel Plugin** to its Known Exploited Vulnerabilities catalog, but the dominant event across the referenced code changes was the discovery and rollback of a malicious package-install backdoor hosted through GitHub infrastructure.
Jun 29, 2026
More than 31 packages published under the **`@redhat-cloud-services`** npm scope were found carrying a multi-stage credential-stealing payload that executed automatically during installation through `preinstall` hooks. Researchers said the malware targeted GitHub and npm tokens, AWS, GCP, and Azure credentials, Kubernetes and HashiCorp Vault secrets, CircleCI data, and local environment details, with one analyzed package — **`@redhat-cloud-services/host-inventory-client@5.0.3`** — containing a 4.2 MB obfuscated harvester. The malicious releases were reportedly published via GitHub Actions OIDC from the `RedHatInsights/javascript-clients` repository, pointing to either compromise of the upstream CI/CD pipeline or abuse of its trust configuration; the affected packages collectively had roughly 116,000 weekly downloads. The incident emerged alongside a separate active npm dependency-confusion campaign identified by Microsoft, in which a single actor used spoofed organizational namespaces, inflated versions such as `100.100.100`, and obfuscated `postinstall.js` code to force installation of malicious packages in corporate developer environments. Microsoft said the payload currently focused on reconnaissance but could be switched remotely to steal credentials, exfiltrate data, or deploy a backdoor, and linked the activity to shared infrastructure and the domain `oob.moika.tech`. Registry teams removed the malicious packages, while defenders were urged to rotate exposed keys, enable **2FA**, audit lockfiles, downgrade to safe package versions, and consider disabling install scripts during npm package installation.
Jun 29, 2026
Security researchers reported two distinct software supply-chain abuse paths that can make malicious code appear to originate from trusted sources. GMO Cybersecurity by Ierae described an active campaign dubbed **“repo squatting”** that abuses how GitHub renders and links commits from forks: a commit made in an attacker-controlled fork can be viewed under the upstream project’s URL structure, enabling convincing links like `github.com/<official-org>/<repo>/commit/<hash>` that appear to belong to the official repository. The campaign targeted the *GitHub Desktop* project by distributing a trojanized installer carrying **HijackLoader**, with the malicious download link presented in a way that could mislead users and some security tooling into believing it came from the official repo. Separately, Koi researchers disclosed **PackageGate** weaknesses in JavaScript dependency tooling that allow bypassing npm’s post–**Shai-Hulud** mitigations when installing **Git-based dependencies**. They reported that a malicious `.npmrc` in a Git dependency can override the `git` binary path, enabling **code execution even when lifecycle scripts are disabled** (e.g., `--ignore-scripts=true`), affecting multiple tools (including *pnpm*, *vlt*, *Bun*, and *npm*). Vendors reportedly addressed the issue in the non-npm tools, while npm closed the report as “works as expected,” and researchers cited evidence of prior proof-of-concept abuse (e.g., reverse shell) indicating practical exploitation risk for organizations relying on Git dependencies in CI/CD and developer environments.
Jun 29, 2026