https://vanemmerik.ai/supply-chain/ Supply Chain Watch entries: npm. en https://vanemmerik.ai/supply-chain/2026-10-25/#agents-md-downloads-folder-hijack vea-sc-2026-10-25-agents-md-downloads-folder-hijack Mon, 26 Oct 2026 00:52:00 +0000 Forever Security reports finding a malicious AGENTS.md in a customer's Downloads folder, which was also the coding agent's working directory; the agent read it and tried to install an unvetted npm package named function-color. The researchers reproduced the technique against OpenAI Codex and showed a CLAUDE.md variant that redirected Claude Code's API traffic to a server they controlled. It relies on a browser dropping the file into Downloads and the user then starting an agent there, and the researchers say there is nothing for the vendors to patch. The takeaway for teams is to start agents only in the project they should work on and to review unfamiliar agent instruction files. https://vanemmerik.ai/supply-chain/2026-10-25/#happy-dom-esm-alias-code-injection vea-sc-2026-10-25-happy-dom-esm-alias-code-injection Sun, 25 Oct 2026 16:05:00 +0000 CVE-2026-115895 (GHSA-834v-8h66-3h79, CVSS 8.8) is an incomplete fix for the earlier CVE-2026-33943: happy-dom's ESM compiler pastes an unvalidated named-import alias into generated code, so attacker-supplied module source can reach Node's process and fs APIs. It only applies when enableJavaScriptEvaluation is turned on and untrusted HTML or modules are processed, which rules out most test-runner use. The advisory metadata lists 21.0.4 as patched, though its body text says no fix was available when reported. No exploitation is reported. What to do: Upgrade happy-dom to 21.0.4 or later, and keep enableJavaScriptEvaluation off for any untrusted content (for example server-side rendering or scraping). https://vanemmerik.ai/supply-chain/2026-10-25/#npm-ionic-cordova-malware-cluster vea-sc-2026-10-25-npm-ionic-cordova-malware-cluster Sun, 25 Oct 2026 16:05:00 +0000 On Oct 25 the GitHub Advisory Database (mirrored in OSV) published a batch of malware advisories for npm packages posing as Ionic/Cordova plugins and Instagram, TikTok, YouTube and SoundCloud helpers, including appit-cordova-admob, appit-cordova-plugin-ionic, cordova-plugin-geofence-appit, ionic-insta-search, ionic-tiktok-scraper, insta-api-wrapper and sound-cloud-loader-api. All versions are listed as malicious and the advisories say any machine that installed them should be treated as compromised. Payload, download counts and whether this is typosquatting or a hijacked publisher are not public yet. What to do: Check lockfiles for these names; if present, remove them and rotate secrets from a clean machine. https://vanemmerik.ai/supply-chain/2026-10-24/#emudhra-trust-store-updates vea-sc-2026-10-24-emudhra-trust-store-updates Sat, 24 Oct 2026 21:53:00 +0000 The eight eMudhra intermediate CA keys disclosed on Oct 20 were generated so weakly that anyone can recover them, which means a network attacker could mint certificates those intermediates sign; exposure dates back to April 2025, though no misuse has been found. Browsers block them already, but package managers, CI jobs and API clients that carry their own CA bundle keep trusting the chain until updated. Fixed bundles: certifi 2026.10.19, pip 26.2.2, uv 0.13.4, Node.js 22.23.4/24.22.1/26.12.1, Go 1.27.3/1.26.10, rustls-webpki 0.103.16, webpki-roots 1.0.10, composer/ca-bundle 1.4.16/1.6.0, plus Ubuntu, Debian, Alpine, Fedora and Wolfi ca-certificates. Bun, FreeBSD and Java's JDK cacerts were still unfixed or unconfirmed on Oct 23, and container images keep the old roots until rebuilt. What to do: Bump certifi, pip, uv, Node.js, Go and Rust webpki crates to the fixed versions, rebuild container images on patched base images, and check Java and Bun services separately; the system bundle should contain no emSign entries after updating. https://vanemmerik.ai/supply-chain/2026-10-24/#x402-sdk-spending-limit-flaws vea-sc-2026-10-24-x402-sdk-spending-limit-flaws Sat, 24 Oct 2026 10:08:00 +0000 V12 reported three flaws in the x402 agent-payment SDKs, published Oct 22-23. The TypeScript fetch and axios clients had no default spending cap, so a hostile API could ask an agent to sign away its full balance; @x402/svm 2.0.0 to 2.22.0 accepted a Solana token approval as payment; and the sign-in extension could sign a login for another site. TypeScript packages are fixed in 2.23.0 (current is 2.28.0); the Python and Go clients were fixed in their Aug 18 releases, with exact versions not stated. There is no CVE or GHSA, npm audit does not flag the old releases, and no attacks have been reported. What to do: If your agents pay with x402, move the @x402 packages to 2.23.0 or later (and the Python/Go clients to current releases) and set an explicit per-request spending limit. https://vanemmerik.ai/supply-chain/2026-10-23/#nodejs-oct-2026-security-release vea-sc-2026-10-23-nodejs-oct-2026-security-release Sat, 24 Oct 2026 03:05:00 +0000 Node's Oct 21 security release fixed 10 CVEs across the 22.x, 24.x and 26.x lines. The worst, an out-of-bounds write in the bundled Brotli decoder, is no longer theoretical: on Oct 23 Imperva reported code execution on the official Node.js 24.22.0 Linux arm64 build, including through Express 5.0-5.3 and body-parser 2.0-2.3 request handling, though not on every attempt. Three high-severity TLS and DNS bugs in the same release let certificates match the wrong host or let a NUL byte truncate a hostname. No in-the-wild exploitation reported yet; Node 20.x and older are end-of-life and get no fix. What to do: Move to 26.12.1, 24.22.1 or 22.23.4 everywhere, including base images, CI runners and serverless runtimes; replace any Node 20.x. Until then, limit untrusted Brotli traffic at the edge. https://vanemmerik.ai/supply-chain/2026-10-23/#electron-emudhra-intermediate-cve-2026-115570 vea-sc-2026-10-23-electron-emudhra-intermediate-cve-2026-115570 Sat, 24 Oct 2026 03:05:00 +0000 eMudhra said on Oct 22 it will leave the global TLS certificate business after eight of its intermediate CA keys were found to be easily guessable. Electron published fixes that stop trusting the affected intermediates; until then, an attacker on the network holding a certificate from one of them could impersonate servers to Electron apps through Chromium networking or Node's tls, https and fetch. Rated CVSS 7.4; no known exploitation. What to do: Bump electron to a fixed release for your major line and ship an app update, especially for apps that auto-update or call internal APIs over TLS.