Loading story…
Several GitHub-hosted JavaScript projects were modified to include a malicious postinstall entry in package.json, turning routine dependency installation into unauthorized code execution. Commits affecting repositories including thedevdojo/genesis, katanaui/katana, and baskarcm/tzi-chat-ui added a script that used curl with certificate checks disabled to fetch a binary named gvfsd-network from a GitHub Releases page tied to parikhpreyash4/systemd-network-helper-aa5c751f, save it as /tmp/.sshd, mark it executable, and run it in the background. The pattern indicates a supply-chain style compromise designed to hide a backdoor inside otherwise ordinary dependency or build changes.
Other repositories moved quickly to remove the payload, with commits in elitedevsquad/sidecar-laravel and katanaui/katana explicitly reverting the suspicious postinstall logic while preserving legitimate build scripts. The repeated use of the same download URL, filename, and execution flow across unrelated projects suggests a coordinated campaign rather than isolated developer error. Separately, CISA added CVE-2026-48172 in the LiteSpeed cPanel Plugin to its Known Exploited Vulnerabilities catalog, but the dominant event across the referenced code changes was the discovery and rollback of a malicious package-install backdoor hosted through GitHub infrastructure.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
On 2026-05-26, CISA updated its Known Exploited Vulnerabilities Catalog to add CVE-2026-48172, a privilege escalation vulnerability in the LiteSpeed cPanel Plugin. CISA said any cPanel user account could abuse the plugin to execute arbitrary scripts with root privileges and advised organizations to apply mitigations or discontinue use if none are available.
Also on 2026-05-22, follow-up commits in repositories including elitedevsquad/sidecar-laravel and katanaui/katana removed the same malicious postinstall command from package.json. The reversions indicate detection and cleanup of unauthorized code execution logic embedded in package installation scripts.
On 2026-05-22, suspicious commits added npm postinstall scripts to repositories including thedevdojo/genesis, katanaui/katana, and baskarcm/tzi-chat-ui. The script downloaded a binary named gvfsd-network from a GitHub Releases URL, saved it as /tmp/.sshd, made it executable, and launched it in the background, indicating a likely supply-chain compromise.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A GitHub commit in the `r2luna/brain` repository removed a suspicious `postinstall` entry from `package.json` after it was found downloading and executing an external binary during dependency installation. The deleted script used `curl -skL` to fetch a file named `gvfsd-network` from a GitHub Releases URL tied to `parikhpreyash4/systemd-network-helper-aa5c751f`, saved it as `/tmp/.sshd`, marked it executable, and launched it in the background. The rest of the project scripts were routine VitePress documentation commands, making the `postinstall` behavior stand out as an apparent supply-chain compromise designed to run unauthorized code on developer or build systems. Separate CISA Known Exploited Vulnerabilities catalog updates during the same period added and refined entries for actively exploited flaws, including **CVE-2026-31431** in the Linux kernel and a **PAN-OS** out-of-bounds write affecting the User-ID Authentication Portal. CISA said the Linux kernel flaw could enable privilege escalation and assigned federal remediation deadlines, while later catalog changes corrected its CWE mapping. Another update noted Palo Alto Networks had released multiple patches for the PAN-OS issue, which can allow unauthenticated remote code execution with root privileges on affected PA-Series and VM-Series firewalls.
Jun 29, 2026
Security researchers reported two distinct software supply-chain abuse paths that can make malicious code appear to originate from trusted sources. GMO Cybersecurity by Ierae described an active campaign dubbed **“repo squatting”** that abuses how GitHub renders and links commits from forks: a commit made in an attacker-controlled fork can be viewed under the upstream project’s URL structure, enabling convincing links like `github.com/<official-org>/<repo>/commit/<hash>` that appear to belong to the official repository. The campaign targeted the *GitHub Desktop* project by distributing a trojanized installer carrying **HijackLoader**, with the malicious download link presented in a way that could mislead users and some security tooling into believing it came from the official repo. Separately, Koi researchers disclosed **PackageGate** weaknesses in JavaScript dependency tooling that allow bypassing npm’s post–**Shai-Hulud** mitigations when installing **Git-based dependencies**. They reported that a malicious `.npmrc` in a Git dependency can override the `git` binary path, enabling **code execution even when lifecycle scripts are disabled** (e.g., `--ignore-scripts=true`), affecting multiple tools (including *pnpm*, *vlt*, *Bun*, and *npm*). Vendors reportedly addressed the issue in the non-npm tools, while npm closed the report as “works as expected,” and researchers cited evidence of prior proof-of-concept abuse (e.g., reverse shell) indicating practical exploitation risk for organizations relying on Git dependencies in CI/CD and developer environments.
Jun 29, 2026
More than 31 packages published under the **`@redhat-cloud-services`** npm scope were found carrying a multi-stage credential-stealing payload that executed automatically during installation through `preinstall` hooks. Researchers said the malware targeted GitHub and npm tokens, AWS, GCP, and Azure credentials, Kubernetes and HashiCorp Vault secrets, CircleCI data, and local environment details, with one analyzed package — **`@redhat-cloud-services/host-inventory-client@5.0.3`** — containing a 4.2 MB obfuscated harvester. The malicious releases were reportedly published via GitHub Actions OIDC from the `RedHatInsights/javascript-clients` repository, pointing to either compromise of the upstream CI/CD pipeline or abuse of its trust configuration; the affected packages collectively had roughly 116,000 weekly downloads. The incident emerged alongside a separate active npm dependency-confusion campaign identified by Microsoft, in which a single actor used spoofed organizational namespaces, inflated versions such as `100.100.100`, and obfuscated `postinstall.js` code to force installation of malicious packages in corporate developer environments. Microsoft said the payload currently focused on reconnaissance but could be switched remotely to steal credentials, exfiltrate data, or deploy a backdoor, and linked the activity to shared infrastructure and the domain `oob.moika.tech`. Registry teams removed the malicious packages, while defenders were urged to rotate exposed keys, enable **2FA**, audit lockfiles, downgrade to safe package versions, and consider disabling install scripts during npm package installation.
Jun 29, 2026