Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Google Project Zero

Microsoft Security Blog

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

fuxa

lang

durabletask

antv

node-ipc

tanstack

lightning

On May 27, 2026, multiple critical supply chain vulnerabilities were disclosed affecting popular packages across npm, PyPI, Composer, Cargo, Maven, and GitHub Actions ecosystems. The FUXA package is vulnerable to unauthenticated remote code execution via path manipulation and script test mode authorization bypass. Several widely used packages including Laravel Lang, durabletask, AntV, node-ipc, TanStack, and lightning have been compromised through malicious republishing or maintainer account compromises, risking credential theft and arbitrary code execution. Additional high-severity issues include authorization bypasses and deserialization vulnerabilities in other packages. Immediate remediation involves upgrading affected packages or auditing and uninstalling compromised ones as recommended. These vulnerabilities underscore ongoing risks in software supply chains and the critical importance of dependency management.

This advisory reports 12 critical supply chain security threats identified on May 27, 2026, spanning multiple ecosystems such as npm, PyPI, Composer, Cargo, Maven, and GitHub Actions. The most severe issues include two critical unauthenticated remote code execution vulnerabilities in FUXA (CVE-2026-43945 and CVE-2026-43947) that allow attackers to execute arbitrary code as root via path manipulation and script test mode authorization bypass. Other critical compromises involve malicious republishing or maintainer account compromises in Laravel Lang (Composer), durabletask (PyPI), AntV (npm), node-ipc (npm), TanStack (npm), and lightning (PyPI), leading to risks of credential theft and arbitrary code execution. Additional high-severity vulnerabilities include authorization bypasses in Armoli Technology Cargo Tracking System (Cargo), deserialization vulnerabilities in Log4j 1.x JMSSink (Maven), origin validation errors in Langflow (PyPI), and a GitHub Actions zero-day in Argo CD. The advisory recommends upgrading affected packages, auditing dependencies, or uninstalling compromised packages to mitigate these threats.

Detailed information about 12 npm/PyPI/supply-chain threats today (2026-05-27): CVE-2026-43945 (FUXA), CVE-2026-43947 (FUXA), Laravel Lang, durabletask, AntV, n

12 npm/PyPI/supply-chain threats today (2026-05-27): CVE-2026-43945 (FUXA), CVE-2026-43947 (FUXA), Laravel Lang, durabletask, AntV, node-ipc, TanStack, lightning, ... - Live Threat Intelligence - Threat Radar | OffSeq.com

<p>Today, May 27, 2026, we've identified 12 critical security threats across npm, PyPI, and supply-chain ecosystems. These vulnerabilities, detected in the past 24 hours, pose significant risks to software development.</p> <table><thead> <tr> <th>#</th> <th>Package / Advisory</th> <th>Ecosystem</th> <th>Severity</th> <th>Fix</th> </tr> </thead><tbody> <tr> <td>1</td> <td>FUXA · CVE-2026-43945</td> <td>npm</td> <td>CRITICAL</td> <td>Update</td> </tr> <tr> <td>2</td> <td>FUXA · CVE-2026-43947</td> <td>npm</td> <td>CRITICAL</td> <td>Update</td> </tr> <tr> <td>3</td> <td>Laravel Lang Supply Chain Advisory</td> <td>Composer</td> <td>CRITICAL</td> <td>Uninstall / Audit</td> </tr> <tr> <td>4</td> <td><code>durabletask</code></td> <td>PyPI</td> <td>CRITICAL</td> <td>Uninstall / Audit</td> </tr> <tr> <td>5</td> <td>AntV Supply Chain Attack</td> <td>npm</td> <td>CRITICAL</td> <td>Uninstall / Audit</td> </tr> <tr> <td>6</td> <td><code>node-ipc</code></td> <td>npm</td> <td>CRITICAL</td> <td>Uninstall / Audit</td> </tr> <tr> <td>7</td> <td>TanStack Packages</td> <td>npm</td> <td>CRITICAL</td> <td>Uninstall / Audit</td> </tr> <tr> <td>8</td> <td><code>lightning</code></td> <td>PyPI</td> <td>CRITICAL</td> <td>Uninstall / Audit</td> </tr> <tr> <td>9</td> <td>FUXA · CVE-2026-43946</td> <td>npm</td> <td>HIGH</td> <td>Update</td> </tr> <tr> <td>10</td> <td><code>yeoman-environment</code> · CVE-2026-42089</td> <td>npm</td> <td>HIGH</td> <td>6.0.1</td> </tr> <tr> <td>11</td> <td>Armoli Technology Cargo Tracking System · CVE-2023-2065</td> <td>Cargo</td> <td>HIGH</td> <td>Update</td> </tr> <tr> <td>12</td> <td>Log4j 1.x JMSSink · CVE-2022-23302</td> <td>Maven</td> <td>HIGH</td> <td>Migrate away / Update</td> </tr> <tr> <td>13</td> <td>Langflow · CVE-2025-34291</td> <td>PyPI</td> <td>HIGH</td> <td>Update</td> </tr> <tr> <td>14</td> <td>Argo CD · CVE-2022-24348</td> <td>GitHub Actions</td> <td>HIGH</td> <td>Upgrade</td> </tr> </tbody></table> <h1>FUXA Vulnerable to Pre-auth RCE via Path Manipulation &amp; Configuration Injection</h1> <p><strong>Ecosystem</strong>: npm <strong>CVE</strong>: CVE-2026-43945 <strong>Severity</strong>: CRITICAL This vulnerability chain in FUXA (v.1.3.0-2706) allows unauthenticated remote attackers to achieve Full Remote Code Execution (RCE) as root, even in secure configurations. <strong>Action Required</strong>: Upgrade to a version that addresses this vulnerability. <a href="https://github.com/advisories/GHSA-p69w-mmfv-xrfj">Source</a></p> <h1>FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass</h1> <p><strong>Ecosystem</strong>: npm <strong>CVE</strong>: CVE-2026-43947 <strong>Severity</strong>: CRITICAL A vulnerability in FUXA's <code>POST /api/runscript</code> endpoint allows unauthenticated attackers to execute arbitrary code via test mode if a server-side script exists. <strong>Action Required</strong>: Upgrade to a version that addresses this vulnerability. <a href="https://github.com/advisories/GHSA-rg3m-cfq7-g6h6">Source</a></p> <h1>Laravel Lang Supply Chain Advisory</h1> <p><strong>Ecosystem</strong>: Composer <strong>Severity</strong>: CRITICAL Hundreds of historical Laravel Lang Packagist releases were republished with malicious code, risking credential theft and secret exfiltration. <strong>Action Required</strong>: Remove or audit any Laravel Lang packages installed from Packagist. Use trusted sources for dependencies. <a href="https://snyk.io/blog/laravel-lang-supply-chain-advisory/">Source</a></p> <h1>The AntV Supply Chain Campaign Expands: Microsoft's durabletask PyPI Package Compromised</h1> <p><strong>Ecosystem</strong>: PyPI <strong>Severity</strong>: CRITICAL The AntV supply chain attack campaign has compromised <code>durabletask</code>, a Microsoft-associated Python package on PyPI, potentially exposing users to malicious code. <strong>Action Required</strong>: Remove or audit any <code>durabletask</code> packages installed from PyPI. Use trusted sources for dependencies. <a href="https://snyk.io/blog/durabletask-pypi-supply-chain-attack/">Source</a></p> <h1>Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account</h1> <p><strong>Ecosystem</strong>: npm <strong>Severity</strong>: CRITICAL A compromised npm maintainer account led to the automated release of over 300 malicious package versions in the AntV ecosystem as part of the Mini Shai-Hulud campaign. <strong>Action Required</strong>: Audit your dependencies for any AntV packages. Remove or revert to known good versions. <a href="https://snyk.io/blog/mini-shai-hulud-antv-npm-supply-chain-attack/">Source</a></p> <h1>Malicious node-ipc versions published to npm in suspected maintainer account compromise</h1> <p><strong>Ecosystem</strong>: npm <strong>Severity</strong>: CRITICAL Multiple malicious versions of the popular <code>node-ipc</code> npm package were published to the npm registry, posing a risk to users. <strong>Action Required</strong>: Audit your dependencies for <code>node-ipc</code>. Remove or revert to known good versions. <a href="https://snyk.io/blog/malicious-node-ipc-versions-published-npm/">Source</a></p> <h1>TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack</h1> <p><strong>Ecosystem</strong>: npm <strong>Severity</strong>: CRITICAL The Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 /* packages, chaining GitHub Actions vulnerabilities to achieve supply chain attacks with valid SLSA Build Level 3 attestations. <strong>Action Required</strong>: Audit your dependencies for <a href="/u/tanstack">u/tanstack</a>* packages. Remove or revert to known good versions. <a href="https://snyk.io/blog/tanstack-npm-packages-compromised/">Source</a></p> <h1>lightning PyPI Compromise: A Bun-Based Credential Stealer in Python</h1> <p><strong>Ecosystem</strong>: PyPI <strong>Severity</strong>: CRITICAL A malicious release of the <code>lightning</code> PyPI package includes a credential-stealing Bun payload that runs on import, potentially compromising user credentials. <strong>Action Required</strong>: Remove or audit any <code>lightning</code> packages installed from PyPI. Use trusted sources for dependencies. <a href="https://snyk.io/blog/lightning-pypi-compromise-bun-based-credential-stealer/">Source</a></p> <h1>FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue</h1> <p><strong>Ecosystem</strong>: npm <strong>CVE</strong>: CVE-2026-43946 <strong>Severity</strong>: HIGH An authorization bypass in FUXA's <code>/api/getTagValue</code> endpoint allows unauthenticated access to tag values when the referenced script does not exist. <strong>Action Required</strong>: Upgrade to a version that addresses this vulnerability. <a href="https://github.com/advisories/GHSA-fwcm-rqvw-j3p7">Source</a></p> <h1>yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation</h1> <p><strong>Ecosystem</strong>: npm <strong>CVE</strong>: CVE-2026-42089 <strong>Severity</strong>: HIGH <code>yeoman-environment</code> versions <code>&gt;= 2.9.0</code> and <code>&lt; 6.0.1</code> can install arbitrary packages without confirmation, leading to potential code execution during CLI bootstrap. <strong>Action Required</strong>: Upgrade to version 6.0.1 or later. <a href="https://github.com/advisories/GHSA-vv9j-gjw2-j8wp">Source</a></p> <h1>CVE-2023-2065 - Authorization Bypass Through User-Controlled Key vulnerability in Armoli Technology Cargo Tracking System allows Authent</h1> <p><strong>Ecosystem</strong>: Cargo <strong>CVE</strong>: CVE-2023-2065 <strong>Severity</strong>: HIGH An authorization bypass vulnerability in Armoli Technology Cargo Tracking System allows for authentication abuse and bypass. <strong>Action Required</strong>: Upgrade to a version that addresses this vulnerability. <a href="https://nvd.nist.gov/vuln/detail/CVE-2023-2065">Source</a></p> <h1>CVE-2022-23302 - JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce</h1> <p><strong>Ecosystem</strong>: Maven <strong>CVE</strong>: CVE-2022-23302 <strong>Severity</strong>: HIGH Log4j 1.x's JMSSink is vulnerable to deserialization of untrusted data, potentially leading to remote code execution if configured with an attacker-accessible LDAP service. <strong>Action Required</strong>: Upgrade to Log4j 2.x or migrate away from JMSSink. <a href="https://nvd.nist.gov/vuln/detail/CVE-2022-23302">Source</a></p> <h1>CVE-2025-34291 - Langflow Origin Validation Error Vulnerability</h1> <p><strong>Ecosystem</strong>: PyPI <strong>CVE</strong>: CVE-2025-34291 <strong>Severity</strong>: HIGH Langflow contains an origin validation error vulnerability due to permissive CORS configuration, allowing malicious webpages to perform cross-origin requests with credentials and potentially achieve system compromise. <strong>Action Required</strong>: Upgrade to a version that addresses this vulnerability. <a href="https://nvd.nist.gov/vuln/detail/CVE-2025-34291">Source</a></p> <h1>Lessons learned from the Argo CD zero-day vulnerability (CVE-2022-24348)</h1> <p><strong>Ecosystem</strong>: GitHub Actions <strong>CVE</strong>: CVE-2022-24348 <strong>Severity</strong>: HIGH This vulnerability in Argo CD highlights the risks of supply chain attacks and the importance of securing CI/CD pipelines. <strong>Action Required</strong>: Upgrade Argo CD to a patched version. <a href="https://snyk.io/blog/argo-cd-zero-day-cve-2022-24348-lessons-supply-chain/">Source</a></p> <p>Automated daily digest — feedback welcome. Repo: <a href="https://github.com/Deam0on/wakellm">https://github.com/Deam0on/wakellm</a></p> 

Today, May 27, 2026, we've identified 12 critical security threats across npm, PyPI, and supply-chain ecosystems. These vulnerabilities, detected in the past 24 hours, pose significant risks to software development.
 # Package / Advisory Ecosystem Severity Fix
 1 FUXA · CVE-2026-43945 npm CRITICAL Update
 2 FUXA · CVE-2026-43947 npm CRITICAL Update
 3 Laravel Lang Supply Chain Advisory Composer CRITICAL Uninstall / Audit
 4 durabletask PyPI CRITICAL Uninstall / Audit
 5 AntV Supply Chain Attack npm CRITICAL Uninstall / Audit
 6 node-ipc npm CRITICAL Uninstall / Audit
 7 TanStack Packages npm CRITICAL Uninstall / Audit
 8 lightning PyPI CRITICAL Uninstall / Audit
 9 FUXA · CVE-2026-43946 npm HIGH Update
 10 yeoman-environment · CVE-2026-42089 npm HIGH 6.0.1
 11 Armoli Technology Cargo Tracking System · CVE-2023-2065 Cargo HIGH Update
 12 Log4j 1.x JMSSink · CVE-2022-23302 Maven HIGH Migrate away / Update
 13 Langflow · CVE-2025-34291 PyPI HIGH Update
 14 Argo CD · CVE-2022-24348 GitHub Actions HIGH Upgrade
 FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection
 Ecosystem: npm CVE: CVE-2026-43945 Severity: CRITICAL This vulnerability chain in FUXA (v.1.3.0-2706) allows unauthenticated remote attackers to achieve Full Remote Code Execution (RCE) as root, even in secure configurations. Action Required: Upgrade to a version that addresses this vulnerability. Source
 FUXA Vulnerable to Unauthenticated Remote Code Execution via Script Test Mode Authorization Bypass
 Ecosystem: npm CVE: CVE-2026-43947 Severity: CRITICAL A vulnerability in FUXA's POST /api/runscript endpoint allows unauthenticated attackers to execute arbitrary code via test mode if a server-side script exists. Action Required: Upgrade to a version that addresses this vulnerability. Source
 Laravel Lang Supply Chain Advisory
 Ecosystem: Composer Severity: CRITICAL Hundreds of historical Laravel Lang Packagist releases were republished with malicious code, risking credential theft and secret exfiltration. Action Required: Remove or audit any Laravel Lang packages installed from Packagist. Use trusted sources for dependencies. Source
 The AntV Supply Chain Campaign Expands: Microsoft's durabletask PyPI Package Compromised
 Ecosystem: PyPI Severity: CRITICAL The AntV supply chain attack campaign has compromised durabletask, a Microsoft-associated Python package on PyPI, potentially exposing users to malicious code. Action Required: Remove or audit any durabletask packages installed from PyPI. Use trusted sources for dependencies. Source
 Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account
 Ecosystem: npm Severity: CRITICAL A compromised npm maintainer account led to the automated release of over 300 malicious package versions in the AntV ecosystem as part of the Mini Shai-Hulud campaign. Action Required: Audit your dependencies for any AntV packages. Remove or revert to known good versions. Source
 Malicious node-ipc versions published to npm in suspected maintainer account compromise
 Ecosystem: npm Severity: CRITICAL Multiple malicious versions of the popular node-ipc npm package were published to the npm registry, posing a risk to users. Action Required: Audit your dependencies for node-ipc. Remove or revert to known good versions. Source
 TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack
 Ecosystem: npm Severity: CRITICAL The Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 /* packages, chaining GitHub Actions vulnerabilities to achieve supply chain attacks with valid SLSA Build Level 3 attestations. Action Required: Audit your dependencies for u/tanstack* packages. Remove or revert to known good versions. Source
 lightning PyPI Compromise: A Bun-Based Credential Stealer in Python
 Ecosystem: PyPI Severity: CRITICAL A malicious release of the lightning PyPI package includes a credential-stealing Bun payload that runs on import, potentially compromising user credentials. Action Required: Remove or audit any lightning packages installed from PyPI. Use trusted sources for dependencies. Source
 FUXA has an unauthenticated arbitrary tag value disclosure via /api/getTagValue
 Ecosystem: npm CVE: CVE-2026-43946 Severity: HIGH An authorization bypass in FUXA's /api/getTagValue endpoint allows unauthenticated access to tag values when the referenced script does not exist. Action Required: Upgrade to a version that addresses this vulnerability. Source
 yeoman-environment Vulnerable to Arbitrary Package Installation without User Confirmation
 Ecosystem: npm CVE: CVE-2026-42089 Severity: HIGH yeoman-environment versions >= 2.9.0 and < 6.0.1 can install arbitrary packages without confirmation, leading to potential code execution during CLI bootstrap. Action Required: Upgrade to version 6.0.1 or later. Source
 CVE-2023-2065 - Authorization Bypass Through User-Controlled Key vulnerability in Armoli Technology Cargo Tracking System allows Authent
 Ecosystem: Cargo CVE: CVE-2023-2065 Severity: HIGH An authorization bypass vulnerability in Armoli Technology Cargo Tracking System allows for authentication abuse and bypass. Action Required: Upgrade to a version that addresses this vulnerability. Source
 CVE-2022-23302 - JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write acce
 Ecosystem: Maven CVE: CVE-2022-23302 Severity: HIGH Log4j 1.x's JMSSink is vulnerable to deserialization of untrusted data, potentially leading to remote code execution if configured with an attacker-accessible LDAP service. Action Required: Upgrade to Log4j 2.x or migrate away from JMSSink. Source
 CVE-2025-34291 - Langflow Origin Validation Error Vulnerability
 Ecosystem: PyPI CVE: CVE-2025-34291 Severity: HIGH Langflow contains an origin validation error vulnerability due to permissive CORS configuration, allowing malicious webpages to perform cross-origin requests with credentials and potentially achieve system compromise. Action Required: Upgrade to a version that addresses this vulnerability. Source
 Lessons learned from the Argo CD zero-day vulnerability (CVE-2022-24348)
 Ecosystem: GitHub Actions CVE: CVE-2022-24348 Severity: HIGH This vulnerability in Argo CD highlights the risks of supply chain attacks and the importance of securing CI/CD pipelines. Action Required: Upgrade Argo CD to a patched version. Source
 Automated daily digest — feedback welcome. Repo: https://github.com/Deam0on/wakellm

12 npm/PyPI/supply-chain threats today (2026-05-27): CVE-2026-43945 (FUXA), CVE-2026-43947 (FUXA), Laravel Lang, durabletask, AntV, node-ipc, TanStack, lightning, ...

Reddit Discussion: 12 npm/PyPI/supply-chain threats today (2026-05-27): CVE-2026-43945 (FUXA), CVE-2026-43947 (FUXA), Laravel Lang, durabletask, AntV, node-ipc, TanStack, lightning, ...

https://github.com/Deam0on/wakellm

Threat Intelligence Database

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threat Intelligence

Lead Pen Test Professional