Supply Chain · Watch Friday · 07 August 2026 End-of-day synthesis 4 watches · 28 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A near-800-package npm dropper campaign lands the same day CodeIgniter ships two critical RCE-class bugs and CISA fast-tracks a LoadMaster command-injection KEV add.

Today's shape was set less by a single incident than by things converging: a near-800-package npm dropper campaign surfaced mid-day, on top of a morning OAuth account-takeover in Statamic and an afternoon batch of critical CodeIgniter bugs. By evening, CISA had also fast-tracked an unauthenticated Progress LoadMaster command-injection bug onto the KEV list.

The npm campaign — tracked as Flooding Dropper by Sonatype, WEL1DROPPER by OpenSourceMalware — skips the usual preinstall/postinstall hook and instead ships a README that talks developers into calling require() directly, then fetches an OS-specific payload from Cloudflare Workers or, as a DNS-TXT fallback, from wel1[.]ru; the Linux payload drops Sliver C2, and macOS artifacts reference Russian financial-institution domains, suggesting a wallet-and-payment target set. That target set rhymes with today's separate crypto-js disclosure: its WordArray.random() generator turns out to be a weak PRNG masquerading as cryptographically secure, and Coinspect confirmed downstream wallet apps used it to generate BIP39 recovery phrases — two unrelated disclosures pointing at the same asset class in one day. CodeIgniter's second disclosure wave landed alongside this morning's OAuth takeover: a SQL injection in deleteBatch() that skips WHERE-clause escaping entirely, and a file-upload validation bypass in is_image/mime_in that's RCE if you save uploads under a web-accessible path with the client filename intact. Treat both CodeIgniter bugs as one release — patch to 4.7.4 rather than cherry-pick.

→ Operational priority for the night audit your npm lockfiles for any package pulled in via a documented require() call rather than a normal import, since that's the social-engineering tell Flooding Dropper depends on, and confirm nothing in your dependency tree still calls crypto-js's random() for anything wallet- or secret-adjacent.

18:00 ET · First Watch

Critical · The Hacker News ·added 18:00 ET

Flooding Dropper campaign publishes ~800 malicious npm packages using a require()-based social-engineering hook instead of install scripts

OpenSourceMalware and Sonatype are independently tracking a fresh npm campaign — WEL1DROPPER / Flooding Dropper — that published close to 800 AI-slopsquatted packages whose README instructs developers to load them with require() rather than relying on preinstall/postinstall hooks, evading scanners tuned to lifecycle-script abuse. The downloader fetches an OS- and architecture-specific payload from three Cloudflare Workers hosts, falls back to Base64-chunked DNS TXT records from wel1[.]ru if HTTPS fails, and on Linux drops Sliver C2; macOS artifacts reference Russian financial-institution domains, and the whole thing looks like an evolution of April's Moika dependency-confusion campaign. Grep your lockfiles for any dependency introduced via a documented require() call instead of a normal import — that's the tell this campaign depends on.

Critical · CISA KEV · Progress LoadMaster ·added 18:00 ET

CISA fast-tracks Progress LoadMaster's unauthenticated command injection onto KEV — three-day remediation window

CISA added CVE-2026-8037, an unauthenticated command-injection bug in Progress LoadMaster's command endpoints, to the Known Exploited Vulnerabilities catalog today with a due date of August 10 — a three-day window that signals active exploitation, not routine housekeeping. LoadMaster appliances are typically internet-facing load balancers, so exposure maps directly to blast radius. Patch per Progress's June bulletin now; BOD 26-04 treats KEV due dates as a floor, not a target.

Critical · GHSA · crypto-js ·added 18:00 ET

crypto-js's WordArray.random() has been a weak PRNG since 2014, and Coinspect confirmed wallet apps used it to generate BIP39 recovery phrases

crypto-js versions before 4.0.0 seed WordArray.random() from Math.random() through a custom PRNG that shrinks a nominal 256-bit request to roughly 2^47 effective possibilities — enumerable on commodity hardware — and the weakness has been present, with one brief gap, since a 2014 commit; Coinspect's investigation confirmed downstream wallet applications used it as the entropy source for BIP39 recovery phrases. Hashing or KDF-processing the output afterward doesn't restore the missing entropy, so any secret-generation code path that ever touched this function is compromised retroactively. If you're on crypto-js < 4.0.0 and have ever generated a key, seed, or recovery phrase with it, rotate that secret — don't just upgrade and move on.

Critical · GHSA · CodeIgniter ·added 18:00 ET

CodeIgniter ships a second same-day wave: unescaped SQL injection in deleteBatch() and a file-upload extension bypass that's RCE in common configurations

Two critical CodeIgniter bugs landed together: deleteBatch() silently ignores the escape flag on WHERE-clause binds, so any app that passes user input to where() before a batch delete is SQL-injectable through a code path that looks safe; separately, is_image/mime_in validation can be bypassed to upload a PHP file, which is remote code execution if the app saves uploads under the client filename in a web-accessible directory. A related high-severity bug means UploadedFile::move() without an explicit filename argument is also path-traversable in older versions. Upgrade to 4.7.4 across the board rather than cherry-picking individual CVEs; if you can't patch immediately, stop trusting client-supplied filenames and audit every deleteBatch() call for a preceding where().

High · GHSA · go-git ·added 18:00 ET

go-git ships two path-escape bugs — malicious reference names and worktree symlinks can both write outside the intended directory

Two related go-git bugs both let a malicious Git server or crafted repository content escape the boundary the library is supposed to enforce: reference names like refs/heads/../../config can resolve to files outside .git's reference storage, and worktree operations don't check whether an existing symlink resolves a supposedly-safe path into .git itself. Both need filesystem-backed storage — storage/memory and go-billy/memfs users are unaffected — and both need an attacker who controls a Git server or repository content the victim clones or fetches from. If you use go-git against untrusted remotes with filesystem-backed storage, upgrade before pulling from anything you don't control.

High · GHSA · pymdown-extensions ·added 18:00 ET

pymdown-extensions has exponential-backtracking ReDoS in four default-enabled inline processors

A single line of untrusted Markdown under 50 bytes drives markdown.markdown() into unbounded CPU through any of four inline processors — caret, tilde, betterem, and magiclink — that all fire in pymdown-extensions' default configuration; the caret/tilde/betterem regression traces to a December 2024 emphasis-pattern rewrite that replaced a linear match with an exponentially-backtracking one. Any service that renders user-submitted Markdown with default pymdown-extensions settings is a same-day DoS target once this pattern circulates. Patch, and in the meantime rate-limit or timeout Markdown rendering calls regardless.

High · GHSA · jsii-diff ·added 18:00 ET

jsii-diff's npm: package argument is shell command injection if you control the CLI arguments

jsii-diff's npm:<package-specifier> argument, used to pull a comparison package straight from npm, gets passed to a shell without sanitizing a semicolon, so npm:"lodash; touch /tmp/123" runs arbitrary commands with the tool's own permissions. This matters wherever CI pipelines construct that argument from anything resembling user input — a PR title, a branch name, an external contributor's package.json. Upgrade to 1.131.0, and until then treat jsii-diff's argument list as trusted-input-only.

Medium · GHSA · pypdf ·added 18:00 ET

pypdf has two more resource-exhaustion bugs in font-width and ToUnicode parsing

Two pypdf bugs, both fixed in 6.15.0: a crafted /ToUnicode stream with unusually large values drives large memory consumption during text extraction, and a crafted CID font width range does the same for runtime and memory. Neither is a data-exposure or RCE bug, but any service that extracts text from untrusted PDFs is a DoS target until patched. Upgrade to 6.15.0.

Medium · GHSA · Hono ·added 18:00 ET

Hono's memo() SSR cache leaks one user's rendered output to the next request, plus a ReDoS in its language-negotiation middleware

Hono's memo() helper for server-side rendering caches output across requests without keying on request identity, so in a multi-user SSR deployment one user's rendered fragment can be served to a different user — a cross-user data-disclosure bug, not just a caching correctness issue. Separately, the built-in language middleware's Accept-Language parsing has algorithmic-complexity DoS reachable pre-authentication. Audit any use of memo() for per-user or per-session content before you trust it, and patch both.

Medium · GHSA · various ·added 18:00 ET

Four more disclosures worth a skim: Netty, API Platform Core, SvelteKit, Nuxt

Netty's RedisArrayAggregator can retain partial aggregate state after hitting its max-elements limit, a correctness bug with DoS potential in Redis-protocol proxies. API Platform Core doesn't type-check relation IRIs, so a related resource can be denormalized as the wrong type — a type-confusion bug worth auditing if you accept client-supplied IRIs. SvelteKit's content-negotiation logic has an O(n²) ReDoS reachable via the Accept header, pre-authentication. Nuxt's dev server leaks the project root path and a workspace UUID through its Chrome DevTools workspace endpoint — dev-only exposure, but audit before shipping dev builds anywhere reachable. None urgent in isolation; batch the upgrades.

12:00 ET · Forenoon Watch

High · GHSA · GitPython ·added 12:00 ET

GitPython discloses six advisories in one batch — four distinct paths to command execution or arbitrary file write via unguarded option forwarding

GHSA published six GitPython advisories at once: four separate paths where caller-controlled strings reach `git` as raw CLI options with no guard (clone/fetch/pull/push, Repo.init via --template clone hooks, IndexFile.from_tree/reset/merge_tree read-tree options, and a short-option-token-smuggling bypass of the existing check_unsafe_options guard itself), plus a .gitmodules submodule-name path traversal and an arbitrary file read via --pathspec-from-file. Any code that forwards a user- or repo-controlled URL, branch name, or option into GitPython's high-level API — CI runners, PR-diffing bots, dependency-update tools — is a plausible RCE or arbitrary-write vector, and the smuggling bug means the existing allowlist mitigation doesn't actually hold. Audit every GitPython call site touching untrusted input and upgrade to the patched release before trusting the guard again.

High · GHSA · Craft CMS ·added 12:00 ET

Craft CMS ships a second wave of advisories — two authenticated RCE paths and a password-reset flow that skips re-authentication

Following this morning's unauthenticated OAuth account-takeover disclosure, GHSA published a dozen more Craft CMS advisories: authenticated RCE via a Twig-sandbox escape into Yii framework internals, a second authenticated RCE via a condition.config JSON-cleanse bypass in the element-search handler, and a password-reset flow that lets any authenticated user reset their own password without re-entering the current one — chainable toward admin takeover. The rest of the batch is authorization and disclosure bugs (missing requireAdmin()/requirePermission() checks, stored XSS via unescaped draft names, secret env vars leaking into sandboxed Twig). Treat this as one coordinated release: patch to the latest 5.x/6.x point release rather than cherry-picking individual CVEs.

High · GHSA · PDF.js ·added 12:00 ET

PDF.js executes arbitrary JavaScript on a malicious PDF by default, and a popular Angular wrapper bundles a vulnerable fork invisible to scanners

Mozilla's PDF.js runs embedded JavaScript from an opened PDF when enableScripting is true — the default — and no CSP disallows it, so a crafted PDF gets arbitrary JS execution in the viewer's context. ngx-extended-pdf-viewer embeds a forked copy of pdf.js rather than depending on pdfjs-dist, so this CVE doesn't surface to dependency scanners that only read package.json — a real blind spot if you inherited the wrapper without auditing what it vendors. Set a CSP that blocks scripting in any PDF.js-based viewer regardless of enableScripting, and grep your lockfile for vendored or forked pdf.js copies, not just the canonical package.

High · GHSA · PHP_CodeSniffer ·added 12:00 ET

PHP_CodeSniffer's gitblame/hgblame/svnblame reports execute injected commands via a crafted filename

Versions before 3.13.6 and 4.0.2 build a shell command from the filename being blamed without sanitizing it, so a repository containing a maliciously-named file triggers command injection the moment someone runs the Gitblame, Hgblame, or Svnblame report — a realistic CI scenario for any project that lints PRs from external contributors. Upgrade to 3.13.6 / 4.0.2, and until then avoid running these specific report types against untrusted checkouts.

High · GHSA · LangGraph ·added 12:00 ET

LangGraph's Postgres/SQLite stores match namespace prefixes across segment boundaries, letting one tenant's memory leak into another's

LangGraph persists hierarchical namespaces as a dot-joined string, so a prefix match against ("memories", "alice") also matches ("memories", "alice2") — the store isn't actually segmenting on tuple boundaries. In a multi-tenant agent-memory deployment, which is the exact pattern LangGraph is commonly used for, that's cross-tenant data disclosure, not just a correctness bug. If you're running the Postgres or SQLite store with per-user or per-customer namespaces, patch before continuing to treat namespace isolation as a security boundary.

Medium · GHSA · Mermaid ·added 12:00 ET

Mermaid ships five advisories — two prototype-pollution paths, two DoS loops, one CSS injection that escapes the diagram sandbox

GHSA batched five Mermaid issues: architecture-beta and general config-setter prototype pollution (both let a diagram author write onto Object.prototype), unbounded-tick DoS in radar diagrams and an infinite-loop DoS in XY charts, and a CSS-injection bug where sibling combinators escape the #mermaid-X selector prefix and style page elements outside the rendered SVG. All five require rendering an untrusted diagram definition — the common case is a markdown renderer or wiki that lets users embed Mermaid syntax. Patch, and if you can't yet, don't render Mermaid from untrusted input outside a sandboxed iframe.

Medium · GHSA · Statamic ·added 12:00 ET

Statamic's second disclosure wave: pre-auth stored XSS, weak file-upload validation, two authorization gaps, and a data-destruction path via Antlers

Same-day follow-on to this morning's OAuth account-takeover disclosure: unauthenticated stored XSS in the default form-notification email template, frontend forms skipping the file-type restrictions the Control Panel enforces, two missing-authorization bugs (restricted-entry disclosure via the navigation endpoint, user-existence disclosure via the registration-wizard endpoint), and unsafe method invocation through Antlers template resolution that can destroy content and assets. None reach RCE on their own, but the XSS and file-upload gaps are exploitable pre-authentication. Patch to the release that fixes this morning's OAuth issue — it's the same train.

Medium · GHSA · node-re2 ·added 12:00 ET

node-re2 has an out-of-bounds heap read disclosing adjacent memory, plus an uncatchable process abort, both in replace/split

re2 infers a character's byte length from its UTF-8 leading byte; a Buffer that ends mid-multi-byte-character makes replace/split read past the buffer into adjacent heap memory and hand it back to JavaScript — a memory-disclosure primitive from untrusted input. A separate bug in the same code path aborts the whole Node process, uncatchably, when a replacement result exceeds V8's max string length, turning malformed input into a DoS. If you pass untrusted strings or buffers to re2's replace/split, upgrade before doing so.

Medium · GHSA · Smarty ·added 12:00 ET

Smarty's Security sandbox has two escape paths: a stream-wrapper bypass and a symlink traversal out of trusted directories

Even with Security::$streams disabled, Smarty 5.8.0 templates can still read local files through PHP's stream: resource wrapper — the stream restriction doesn't actually cover it. Separately, a symlink inside a trusted template directory can point outside secure_dir and Smarty's Security policy won't catch the traversal. Both let a template author, not necessarily an admin, read files the sandbox is supposed to block; patch if you serve user-authored templates through Smarty's Security class.

Medium · GHSA · various ·added 12:00 ET

Five smaller disclosures worth a skim: DOMPurify, h2, jsoup, AWS CLI, Silverstripe

DOMPurify's IN_PLACE mode can leave a hook-removed element's detached descendants executable (XSS) if you use custom hooks that remove nodes — audit any IN_PLACE-plus-custom-hook combination. Ruby's h2 accepts duplicate Host headers and forwards all of them, enabling request smuggling if anything downstream treats the first or last Host inconsistently. jsoup's Cleaner can misparse a tag name ending in a control character and let disallowed markup through a Safelist. AWS CLI's EMR SSH helper commands (emr ssh / emr socks) disable host-key verification by default — worth checking if you use them anywhere security-sensitive. Silverstripe's CMS breadcrumbs render unescaped in the page-list view, an authenticated XSS. None are urgent in isolation; batch the upgrades.

Context · GHSA · Contao ·added 12:00 ET

Contao: two low-severity disclosures — job-download path traversal and crawler credential leakage to external hosts

An authenticated backend user with access to one job can path-traverse the job-attachment download endpoint to read arbitrary files; separately, Contao's crawler fails to scope confidential HTTP client options and can leak them to external domains it crawls. Both are low-severity per GHSA's own rating — worth patching on your normal cycle, not worth an out-of-band deploy.

Context · The Hacker News ·added 12:00 ET

ThreatsDay roundup: Odysseus RCE, Samsung one-click takeover, iCloud backdoor fight, and 27 more stories

The Hacker News' weekly roundup captures the week's shape in one line: a repo can now run before the first prompt, a package can hide among hundreds in a dependency tree, and a harmless-looking PDF can finish an attack chain — that last one rhymes directly with today's PDF.js item. Useful as an index into stories that didn't individually clear this watch's bar.

Context · BleepingComputer ·added 12:00 ET

ClickFix technique delivers a Go-based macOS infostealer targeting crypto wallets, browser passwords, and Keychain data

A ClickFix-style social-engineering campaign — fake ‘paste this to fix an error’ prompts — is dropping a Go-based infostealer on macOS that grabs cryptocurrency assets, browser-stored passwords, Apple Keychain data, and cached credentials. Not a package-repository compromise, but the same delivery pattern — social-engineer a user into running attacker-supplied code — increasingly precedes supply-chain-adjacent credential theft.

06:00 ET · Morning Watch

High · GHSA · league/commonmark ·added 06:00 ET

league/commonmark ships four quadratic-complexity DoS advisories in one batch

GHSA disclosed four separate O(N²) denial-of-service bugs in league/commonmark 2.x (three reaching back to 1.5.0): colliding heading slugs, duplicate footnote definitions, adjacent inline attribute blocks, and a core UTF-8 position-translation rescan that needs no extension at all — each turns a few KB of crafted Markdown into seconds of CPU or hundreds of MB of memory. The three extension-gated bugs (HeadingPermalink, Footnote, Attributes) are opt-in; the core parsing bug is not, so any endpoint that converts untrusted Markdown is exposed by default. Upgrade to 2.9.0, which fixes all four in one release.

High · GHSA · js-yaml ·added 06:00 ET

JS-YAML's !!omap quadratic-DoS fix from 5.x was never backported to the still-maintained 3.x/4.x lines

js-yaml's `!!omap` resolver enforces key uniqueness with a linear scan per element, making a plain `yaml.load()` call on untrusted input O(n²) — no custom schema required, since `!!omap` sits in the default schema. This is the identical weakness already fixed in the 5.x line under CVE-2026-59870 (GHSA-724g-mxrg-4qvm); that fix was never ported back to 3.x or 4.x, which most projects still pin. Upgrade to js-yaml 3.15.1 or 4.3.1 if you're not already on 5.x.

High · GHSA · Nx ·added 06:00 ET

Nx self-hosted remote cache extracts tar archives with no path constraint — arbitrary file write from a malicious or MITM'd cache server

Nx's self-hosted HTTP remote cache, plus the @nx/s3-cache, gcs-cache, azure-cache, and shared-fs-cache packages, extract downloaded cache artifacts without constraining the write path, so a malicious or on-path cache server can return a crafted tar archive that writes outside the cache directory — escalatable to RCE. Nx's default local cache and Nx Cloud are unaffected; only workspaces pointed at `NX_SELF_HOSTED_REMOTE_CACHE_SERVER` or a self-hosted cache package are exposed. Upgrade to nx 22.7.7 / 23.0.2, and migrate off the already-deprecated @nx/*-cache packages (CVE-2025-36852) rather than wait on a patch that isn't coming.

High · GHSA · Statamic ·added 06:00 ET

Statamic OAuth login trusts unverified provider emails — unauthenticated account takeover up to super admin

When Statamic's OAuth login is enabled against a provider that doesn't guarantee verified email addresses, an unauthenticated attacker can sign in as any existing user — including a super admin — by matching on email alone, no password needed. Exposure requires OAuth explicitly enabled against such a provider, but the blast radius on a hit is full account takeover with zero credentials. Upgrade to 5.74.1 / 6.24.0, or restrict OAuth to email-verifying providers until you can.

Context · The Hacker News ·added 06:00 ET

TeamPCP's supply-chain campaign traces back to internet-facing Redis compromises dating to 2020

New analysis links TeamPCP — the threat actor currently active in software supply-chain compromise — to Redis-targeting infrastructure attacks going back to 2020, tied together by overlapping domains, malware deployment paths, and staging infrastructure. Today's supply-chain actors often spend years on unglamorous infrastructure compromise before pivoting upstream; treat exposed Redis instances as a long-tail feeder for future campaigns, not just today's problem.