▋
platform/workstation-compromise-scan/references/recent-threat-notes.md

Recent Threat Notes

Last researched: 2026-05-22. Refresh before running a high-stakes incident response scan.

Sources to refresh first

  • CISA Known Exploited Vulnerabilities JSON: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
  • TanStack npm compromise postmortem: https://tanstack.com/blog/npm-supply-chain-compromise-postmortem
  • SafeDep mass npm/PyPI supply-chain analysis: https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/
  • Socket AntV compromise: https://socket.dev/blog/antv-packages-compromised
  • Socket node-ipc compromise: https://socket.dev/blog/node-ipc-package-compromised
  • Socket SANDWORM_MODE AI-toolchain poisoning: https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning
  • Microsoft Axios npm compromise: https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/

Current events encoded in the scanner

Mini Shai-Hulud / TanStack / Mistral / Guardrails

Primary risk: developer machines and CI that installed or imported compromised npm/PyPI packages around 2026-05-11.

High-confidence IOCs:

  • Payload files: router_init.js, router_runtime.js
  • Persistence files: .claude/router_runtime.js, .claude/setup.mjs, .vscode/setup.mjs, .github/workflows/codeql_analysis.yml
  • Known strings/domains: 79ac49eedf774dd4b0cfa308722bc463cfe5885c, filev2.getsession.org, api.masscan.cloud, git-tanstack.com, litter.catbox.moe, IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner
  • OS persistence: ~/.local/bin/gh-token-monitor.sh, ~/.config/systemd/user/gh-token-monitor.service, ~/Library/LaunchAgents/com.user.gh-token-monitor.plist
  • PyPI versions: mistralai==2.4.6, guardrails-ai==0.10.1
  • PyPI payload artifact: /tmp/transformers.pyz

Use mini-shai-hulud-scan for the full campaign-specific checklist.

AntV / Mini Shai-Hulud wave

Socket reported a 2026-05-19 wave tied to Mini Shai-Hulud affecting the AntV ecosystem and other npm packages, including a large set of compromised versions. The scanner flags common affected families and known package-manager artifacts, but exact bad-version lists should be refreshed from Socket or npm advisory data before making a final call.

Review packages and lockfiles mentioning:

  • @antv/*, size-sensor, echarts-for-react, timeago.js, jest-canvas-mock, jest-date-mock, canvas-nest.js

Escalate when these appear together with Mini Shai-Hulud payload files, suspicious install scripts, GitHub workflow changes, or C2 domains.

Axios / plain-crypto-js

Microsoft and other responders reported a 2026 Axios npm supply-chain compromise with malicious Axios and plain-crypto-js versions.

High-confidence package versions and network IOCs:

  • axios@1.14.1
  • axios@0.30.4
  • plain-crypto-js@4.2.1
  • sfrclak.com
  • 142.11.206.73

node-ipc

Socket reported malicious node-ipc versions on 2026-05-14.

High-confidence package versions and code markers:

  • node-ipc@9.1.6
  • node-ipc@9.2.3
  • node-ipc@12.0.1
  • Historical malicious/suspicious versions: 10.1.1, 10.1.2, 11.0.0, 11.1.0
  • Payload markers: __ntRun, __ntw, node-ipc.cjs

SANDWORM_MODE / MCP poisoning

Socket reported an npm worm targeting AI tools and MCP configs. The scanner looks for the following low-volume indicators in agent/editor config trees:

  • SANDWORM_MODE
  • MCP tool names: index_project, lint_check, scan_dependencies
  • Hidden home-directory MCP servers with server.js
  • Unexpected config edits under .cursor, .windsurf, .claude, .codex, .config, and VS Code/Cursor/Windsurf extension/config directories

Treat these as high-signal only when the config points to an unknown package, hidden directory, or recently created local server.

Nx Console / VS Code extension compromise

Recent reporting tied compromise of developer GitHub repositories to a malicious nrwl.angular-console VS Code extension release.

High-confidence local artifacts:

  • Extension directory: nrwl.angular-console-18.95.0
  • kitty-monitor.plist
  • cat.py inside VS Code/Cursor/Windsurf extension directories

Megalodon / GitHub workflow backdoors

SafeDep reported malicious GitHub workflow backdoors in public repositories. Refresh the latest report before relying on exact names. Current scanner patterns look for common reported markers:

  • Workflow/job names such as SysDiag and Optimize-Build
  • Suspicious C2/IP markers including 216.126.225.129
  • Workflow steps that decode base64 and execute shell
  • Unexpected pull_request_target, workflow_run, or elevated token permissions in recently changed workflows

PyPI credential stealers

Current scanner flags known bad versions from recent reports:

  • durabletask==1.4.1, 1.4.2, 1.4.3
  • lightning==2.6.2, 2.6.3
  • telnyx==4.87.1, 4.87.2

Known related IOC:

  • t.m-kosche.com

CISA KEV snapshot on 2026-05-22

The CISA feed version observed on 2026-05-22 was 2026.05.22, released 2026-05-22T18:00:11.5035Z. Recent additions included Drupal Core SQL injection (CVE-2026-9082), Langflow origin validation/RCE (CVE-2025-34291), Trend Micro Apex One traversal (CVE-2026-34926), Microsoft Defender issues (CVE-2026-41091, CVE-2026-45498), Microsoft Exchange XSS (CVE-2026-42897), and Cisco Catalyst SD-WAN authentication bypass (CVE-2026-20182).

Use KEV as a prioritization source. A KEV entry is not evidence of compromise by itself; correlate it with installed/reachable software, logs, network exposure, and exploit artifacts.