linux-supply-chain-guard

Version 0.6.3 adds a read-only check for CVE-2026-98432. It compares the running kernel with the first fixed stable release on the 7.2, 5.15, and 5.10 branches, and it reports a pending reboot when a newer kernel of the same flavor is installed. A changelog mention counts only when that package build is the one running.

Version 0.6.1 extends UpdraftCentral access-log review to the 12-hex trigger parameter used by working variants, while retaining the original underscore shape. Matches remain redacted review leads, not proof of compromise.

Version 0.6.0 records PHP's October 21 security releases for CVE-2026-109618 and CVE-2026-109619. The default read-only check compares recognized runtime package versions and exact official-image declarations with the upstream fixes: 8.2.35, 8.3.36, 8.4.27 and 8.5.12. Distribution backports and running deployments remain unverified; no version comparison marks a host patched. See the PHP assessment and sources.

Version 0.5.0 adds optional read-only UpdraftCentral incident review with --wordpress-root, --updraft-log, and --wordpress-evidence. It checks selected plugin files, logs and a sanitized account/key export against published indicators; unselected layers remain uninspected and compromise status remains unknown. See scope and evidence format.

Version 0.4.1 corrects two web-review reporting gaps in 0.4.0. Unavailable /proc/self/fd access now makes coverage incomplete, including in minimal containers and chroots. A webroot file that changes both contents and Unix permissions now produces both findings. Upgrade and rerun affected scans; an empty 0.4.0 result from an environment without procfs is not reliable.

Version 0.4.0 adds local web review: supported management-panel and cache/session configuration checks now run by default. Select --webroot DIR and a trusted --web-baseline FILE to review file-content and permission changes. Runtime exposure stays unknown; no network probes or target execution occur. See supported configurations and baseline workflow.

PHP readiness: the default scan now inventories PHP-related packages, common runtime/configuration paths and selected Composer/container declarations. Deployment patch status stays unknown, separately from the published upstream version comparison. This is preparation evidence, not a vulnerability or protection verdict. See coverage, limitations and official sources.

October 8 update: exact Tensorlake 0.5.144 package/payload checks and ordered token-monitor warnings are in the default scan. See the dated evidence, limitations and inert test instructions.

linux-supply-chain-guard is a read-only Linux host checker for developers and incident responders reviewing supply-chain exposure on workstations, CI runners, and build hosts.

--report creates a new private file (0600). Existing destinations, including symlink, hard-link, and parent-directory aliases of scanned files, are refused. Choose a new report filename for each run; its parent must already exist.

Version 0.1.5 reviews exact editor-extension identities from Socket's October GlassWorm investigation. A matching identity prompts registry and artifact verification; a matching distributed VSIX or JavaScript hash is a high-confidence malicious-file finding. Cluster-linked theme identities remain review-only because Socket did not find an active payload in every analyzed version. These October checks run in the default scan. The older GlassWASM checks remain behind --include-historical.

GlassWorm artifacts use a separate bounded binary inspection: up to 100 MiB per VSIX or app.js/extension.js, 1 MiB per package.json, 256 MiB total, 30,000 candidates, and 100,000 directory entries. Reads use 64 KiB chunks. A cooperative 30-second budget is checked between directory entries and reads; an individual filesystem syscall can take longer. Symlinks, dependency/build directories, and any operator --exclude trees are not followed. Oversized, malformed, changed, or unreadable candidates produce review findings; exhausted aggregate budgets produce an explicit incomplete-scan finding. No skipped artifact is reported as clean. JSON report versions come from package.json.

Version 0.1.4 adds exact dependency checks for the lodash _.template imports-key advisory and the MCP Python SDK OAuth credential-routing advisory. It also recognizes 15 exact npm package names from OX Security's PhantomSub report. The MCP check reviews Python code that constructs unattended OAuth providers without a visible issuer= argument. Findings are exposure leads: lodash exploitation depends on an unsafe template call, MCP exposure depends on an HTTP OAuth client connecting to an untrusted server, and a PhantomSub dependency reference does not prove its WhatsApp behavior ran. The package checks use exact manifest pins or resolved lockfile entries where available.

Version 0.1.3 checks the nine SafeDep-reported DirtyBlanket npm package names and its Linux systemd persistence paths. It also flags workflow tag references to the two hijacked actions-cool actions reported by Socket and SafeDep. OX Security's LiteLLM CVE-2026-93355 disclosure adds a version review finding for exact LiteLLM pins through 1.100.1; the finding requires JWT/IdP configuration review because the issue had no vendor fix at disclosure. None of these matches proves the payload or exploit ran.

The same release checks exact malicious MemTensor sckit worm releases in npm and Python dependency or installed-package metadata: @memtensor/memos-cloud-openclaw-plugin 0.1.21, 0.1.23, and 0.1.25, plus MemoryOS 2.0.34. The intervening npm releases 0.1.22 and 0.1.24 are not treated as malicious. A match calls for exposure review; it does not prove the package ran or that credentials were taken.

Version 0.1.2 keeps the September 2026 detection coverage while making the default report an active-host view. Older campaign lanes remain source-backed but run only with --include-historical. Known scanner sources, test fixtures, IDE history, response archives, duplicate text indicators, and informational fixed/mitigated results no longer inflate the default severity headline. They remain available with --include-historical and --include-resolved. Cache, IDE-history, agent, cloud-sync and security-tool checkout directories are scanned like any other directory. The file walkers still skip dependency, VCS and build-output folders (.git, .hg, .svn, node_modules, .venv, venv, dist, build, coverage, .next); dedicated dependency checks read installed packages separately. Use --exclude DIR to skip a tree; the report is then marked incomplete and the CLI exits 3. A directory that exists but cannot be listed (for example permission denied) also marks the report incomplete and exits 3; review the listed paths and choose an appropriate scan scope. Failed candidate inspections (read, parse, change-during-read, size/time budgets) and discovery limits now also mark top-level coverage incomplete. Critical and token-monitor results retain higher exit-code precedence. Exact npm-name boundaries prevent names such as sync-external from matching the legitimate use-sync-external-store package, and Ubuntu-family vendor backports are honored for PackageKit CVE-2026-41651. Repeated filesystem walks are cached for the duration of a scan; nothing is uploaded or collected.

Version 0.1.1 added the September 2026 public Linux kernel exploit-batch matrix (22 enumerated CVEs), component-aware upstream fixed-baseline review, and public-PoC provenance detection. It also adds local Aurora Linux/ESXi ransomware artifact detection using Gambit Security and CloudSEK indicators, including the exact encrypt.out hash, R2 download path, ESXi VM force-kill shape, SSH-banner/ransom-note artifacts, and ESXi discovery-tool context. Vendor backports still require confirmation; a version comparison alone is not a claim that a distribution kernel is vulnerable.

The same release adds exact-version and campaign-marker detection for the August 28 Trinitite / Mini Shai-Hulud compromise of @7nohe/openapi-react-query-codegen, plus a review finding for unsafe comment-triggered npm Trusted Publishing workflows. GitHub's reviewed advisory lists ten malicious releases with no patched version; use a known-good release line instead of attempting to "patch" an affected tarball.

It checks local host posture related to the May 2026 Linux supply-chain response lane, including Fragnesia / CVE-2026-46300 kernel exposure, ITScape / CVE-2026-46316 ARM64 KVM exposure, DirtyCBC/RxGK page-cache poisoning research-artifact leads, risky module state, and known developer-tooling persistence paths reported in public Shai-Hulud / Here We Go Again analysis. It also checks selected dependency metadata for the OX-reported DPRK npm RAT package names that target developer workstations through install-time payloads.

The July 2026 npm watch pack adds exact-version checks for the compromised jscrambler and Injective releases, all-version checks for Paperclip2, polymarket-kit, and the reported Rollup lookalikes, plus campaign network markers and IronWorm pgmon.service persistence paths.

The August 4, 2026 keyv / cacheable (ChainDrop / Shai-Hulud "Here We Go Again") watch pack adds exact-version checks for the initial full-worm carriers ([email protected] and ten related jaredwray-family releases), campaign network markers, and payload/persistence text. Ox Security reports the live wave at roughly 444 packages, 1,600+ versions, and 2B+ monthly downloads, with the same credential theft, IDE/AI persistence, GitHub exfil, and dead-man switch tradecraft as prior waves, plus a new production-crash extortion string and campaign RSA public key (unattributed; TeamPCP-copycat hypothesis only). Seed carriers and peer confirmation: Snyk, StepSecurity, Aikido, Wiz, and JFrog. Full inventory is partial—use the Ox package table and Wiz CSV, not the seed set alone. This is a cross-platform npm ecosystem compromise—not a Linux-only issue. This guard only observes indicators under a Linux root or mounted workspace. Sister scanners cover the same package set as project-tree checks. Read-only / notify-only (including dead-man paths). Ox recommended actions for operators: rotate keys + 2FA, downgrade packages, search/revoke affected GitHub accounts under IR order. Credits: Ox Security and Moshe Simon (@MosheTov; X post → Ox blog), Snyk, StepSecurity, Aikido, Wiz, JFrog, and npm Security.

The May 29, 2026 TeamPCP/Dynatrace watch pack adds weak-signal exposure checks for Dynatrace token-shaped credentials and repo/service names observed in public threat-actor screenshots. These findings do not prove a Dynatrace breach by themselves; they are meant to catch leaked strings in repos, dependency metadata, logs, and mounted workspaces where malware-hash tooling may see nothing.

The June 5, 2026 PCPJack watch pack adds host-residue checks for the exposed cloud SMTP relay network reported by Hunt.io and Security Affairs. It looks for Sliver/Chisel relay artifacts, xsync watchdog persistence, relay CSV/verifier files, and high-signal IP/path strings. These checks are review signals for mounted Linux hosts and cloud runners; they do not scan remote infrastructure.

The June 2026 Hades / Miasma PyPI watch pack adds local checks for affected package versions, executable *-setup.pth startup hooks, Bun bootstrap and _index.js loader behavior, .abi3.so native-extension launcher layouts, and GitHub/CI exfiltration and seeding markers reported by Socket, SecurityWeek, and JFrog.

The June 2026 JFrog Solana FakeFix / CMS Windows loader watch pack adds checks for malicious Solana-themed npm/PyPI package names, CMS-themed npm loader names, Solana wallet/keypair paths, Telegram exfiltration, suspicious Solana RPC redirection, Deno remote-loader execution, Windows Registry Run-key persistence, mutex markers, and EXE-dropper filenames.

The June 2026 JFrog / The Hacker News PostCSS-lookalike Windows RAT watch pack adds checks for the postcss-minify-selector-parser, postcss-minify-selector, and aes-decode-runner-pro npm packages, plus PowerShell/VBS/Python/Nuitka payload-stage markers and Chrome credential/extension theft terms.

The June 2026 Socket GlassWASM / Open VSX watch pack adds checks for trojanized Open VSX extension copies, suspicious WASM payload names, affected VSIX archive names and hashes, TinyGo/WebAssembly host fingerprints, Solana memo dead-drop markers, and Node child-process download/execute loaders.

The SafeDep Astro config-as-code watch pack adds local checkout checks for suspicious astro.config.* loader behavior, blockchain/C2 relay markers, horizontally hidden executable-looking payload lines, and .gitignore entries that hide reported PR helper artifacts.

The June 2026 JFrog VS Code autorun / blockchain dead-drop watch pack adds local checkout checks for hijacked [email protected] and [email protected] npm metadata, .vscode/tasks.json folder-open tasks that launch the fake fa-solid-400.woff2 payload path, JFrog-reported C2 and blockchain dead-drop strings, reported fake-font SHA-256 hashes, and Nextron's Go-package reuse lead as OSINT correlation only.

The June 2026 OpenClaw agent-safety watch pack adds local checkout checks for OpenClaw versions before 2026.4.23 and risky OpenClaw configuration that combines open inbound DMs, wildcard sender allowlists, or host/main/disabled sandbox mode.

The June 2026 npm v12 readiness watch pack adds local checkout checks for old npm pins, dependency install-script approval readiness, Git dependency sources, remote tarball dependency sources, and broad repo .npmrc opt-ins. These are local operator notifications only. JFrog's npm v12 analysis reinforces the same lane: allowScripts, allow-git, and allow-remote approvals should stay narrow, version-pinned, and re-reviewed on upgrade because attackers may target already-approved packages or move payloads to runtime/import-time execution.

The June 2026 Oracle PeopleSoft watch pack adds local host and mounted-root checks for CVE-2026-35273 posture and the UNC6240/ShinyHunters campaign reported by Oracle and Google/Mandiant. It checks for affected PeopleTools version references, PSEMHUB route evidence, PSEMHUB.war filesystem artifacts, MeshCentral masquerade filenames, campaign network indicators, and extortion markers. These are local operator notifications only.

The June 2026 Gentlemen ransomware watch pack adds local host and mounted-root checks for Microsoft and Hunt.io reported artifacts: known hashes, ransom-note and wallpaper filenames, mutex/service/task markers, PsExec self-propagation markers, defense-evasion toolkit filenames, exposed operator toolkit scripts, reported network/session indicators, and ESET-reported GentleKiller/BYOVD EDR-killer suite markers. These are local operator notifications only.

The June 2026 Edgecution / Payouts King watch pack adds local host and mounted-root checks for Zscaler-reported malicious Microsoft Edge extension artifacts, Chrome native messaging host manifests, native_host.bat, Edge test1 and Recovery profile paths, headless --load-extension launch commands, Outlook update lure terms, CloudFront websocket C2s, AppKey registry setup strings, and published SHA-256 indicators. These are local operator notifications only.

The June 2026 Malwarebytes Chrome session-cookie theft lane adds local and mounted-root checks for fake .pfd.js PDF-lure attachments, malicious Chrome extension deployment via Chrome policy settings, Native Messaging host manifests, chrome.runtime.sendNativeMessage, browser-cookie/session hijacking terms, open-tab/URL/language/fingerprinting collection, PowerShell command execution, and C: drive enumeration. These are review and incident-response signals for Windows browser profiles mounted from response hosts.

The June 2026 Island / The Hacker News Adblock for YouTube watch pack adds local Chrome/Chromium/Edge extension inventory checks for cmedhionkhpnakcndndgjdbohmhepckk, related removed Adblock extension IDs, Adblock/Unistream infrastructure, and dormant server-controlled trusted-create-element / MAIN-world scriptlet injection terms. These are review signals, not proof that a malicious payload ran.

The June 2026 Operation Highland / Velvet Ant watch pack adds Sygnia-reported Linux authentication-stack compromise checks for replaced PAM/OpenSSH components, hidden credential-log paths, GS-Netcat staging, Nginx/FastCGI bridge artifacts, process-masquerade strings, and the published SHA-1 IOC set. These are local operator notifications only.

The June 2026 Squidbleed review lane adds Squid proxy posture checks for installed Squid packages, Squid configuration files, and FTP proxy exposure via Safe_ports port 21. It tracks CVE-2026-47729; because distribution backports and Squid 7.6/7.7 fixed-version reporting have been inconsistent, operator guidance still favors disabling FTP proxying unless it is explicitly required.

The June 2026 NGINX critical exposure lane adds local checks for F5-reported NGINX Open Source affected ranges for CVE-2026-42530 and CVE-2026-42055, HTTP/3/QUIC configuration, and the HTTP/2 proxy/gRPC configuration chain with ignore_invalid_headers off and oversized large_client_header_buffers.

The June 2026 DifyTap watch pack adds local deployment checks for Dify versions before 1.14.2, Plugin Daemon/internal API exposure terms, file-preview and chat-message file UUID routes, trace-provider exfiltration risk, and PDFium document-parser review markers.

The June 2026 Langflow watch pack adds local deployment checks for Langflow versions affected by CVE-2026-10561, CVE-2026-7664, and CVE-2026-55450, PythonREPL/auto-login and webhook/MCP auth-bypass terms, deprecated /api/v1/upload/{flow_id} route exposure, absolute upload file_path leak artifacts, public-bind review, upload-size limit markers, and the LOGSPACE-LangFlow FOFA/product fingerprint context.

It also tracks Langflow CVE-2026-33017 / GHSA-vwmf-pq79-vjvx, fixed in 1.9.0, for unauthenticated public-flow builds through POST /api/v1/build_public_tmp/{flow_id}/flow. The guard flags affected versions before 1.9.0, build_public_tmp / FlowDataRequest / attacker-controlled data terms, unsandboxed exec() / prepare_global_scope notes, and SecurityOnline-reported cryptominer campaign markers including KORKERDS, init_rmount, Kinsing, miner/XMRig/Monero terms, kill-list behavior, reused SSH keys, and SSH worm lateral-movement language.

The June 2026 Gogs exposure-review lane adds local/mounted-root checks for Gogs deployment artifacts, app="Gogs" FOFA fingerprint notes, public PoC provenance references, and path-traversal or Git-hook RCE triage terms. These are review signals for exposed self-hosted Git services; the guard does not include or run exploit steps.

The June 2026 Laravel Livewire watch pack adds local deployment checks for CVE-2025-54068 vulnerable livewire/livewire Composer versions before 3.6.4, broad v3 Composer constraints requiring lockfile verification, and Imperva-reported shoc.enz credential-theft campaign indicators including xantibot[.]pw, .env harvesting, APP_KEY/database credential extraction, FTP 47.129.100.149, Telegram, GoFile, and webhook.site exfiltration paths.

The June 2026 AryStinger watch pack adds router/NAS edge-device malware checks for /tmp/bin syswapd0/Dropbear artifacts, port 2332 Dropbear persistence, ajb8/auq8/dataexplore/opi7 infrastructure, and legacy D-Link/Linksys/QNAP CVE markers.

The June 23, 2026 CISA KEV edge-device watch pack adds local/mounted-root triage checks for Lantronix EDS5000 CVE-2025-67038 and Ubiquiti UniFi OS CVE-2026-34908, CVE-2026-34909, and CVE-2026-34910, including BOD 26-04, vendor advisory, product-family, Bishop Fox unauthenticated RCE-chain triage markers, exposed management-interface notes, and forensics-triage terms.

The June 2026 Cisco CUCM WebDialer watch pack adds local/mounted-root triage checks for CVE-2026-20230, Cisco Unified Communications Manager / Unified CM SME, WebDialer SSRF, file-write-to-root escalation terms, Cisco advisory cisco-sa-cucm-ssrf-cXPnHcW, and OSINT-reported full-chain webshell/Tor exploitation language.

The June 2026 Cisco Catalyst SD-WAN Manager watch pack adds local/mounted-root triage checks for GTIG-reported exploitation involving CVE-2026-20245, CVE-2026-20127, and CVE-2026-20182, rogue peer IP indicators, evil_tenant.csv, vconfd_script_upload_tenant_list.sh, tenant-list upload history, troot UID 0 artifacts, vmanage-admin default-account activity, /var/log/scripts.log, /var/log/auth.log, and fixed-release references.

The June 2026 Microsoft Exchange watch pack adds local/mounted-root triage checks for CVE-2026-45502 EWS InstallApp / ManifestUrl SSRF, CVE-2026-45504 SSRF/file-read privilege-escalation language, Microsoft Exchange Server build/update exports, June 2026 KB/build markers, PT-2026-47976, public PoC artifact markers, and Hawktrace's WOPI/EWS file-read chain terms including GetWopiTargetPropertiesByUrl, ReferenceAttachment, ProviderEndpointUrl, WebApplicationUrl, FileWebRequest, and fragment-obfuscated file://...# URLs.

The May 2026 Delphos DirtyCBC / Linux RxGK watch lane adds local/mounted-root checks for copied advisory notes and research-artifact markers around AF_RXRPC/YFS-RxGK RESPONSE decrypt-before-MAC page-cache poisoning, MSG_SPLICE_PAGES, rxgk_decrypt_skb, skb_to_sgvec, upstream commit aa54b1d27fe0, and public PoC context. This is a kernel posture and authorized-research provenance lane; it does not test exploitability.

The June 2026 KnowBe4 Threat Labs ClickFix watch pack adds local host and mounted-root checks for the Review Past Due Doc.zip / .lnk OneDrive lure, clipboard-injected PowerShell, DNS TXT staging, document-auth[.]icu, italy-news[.]info, lootrioya[.]info, and the reported ZIP/MSI/password stealer SHA-256 values.

The June 2026 Nextron Research Packagist watch pack adds local/mounted-root checks for malicious [email protected], r[.]keepex[.]xyz credential exfiltration, the reported 979890 hardcoded 2FA bypass code, and obfuscated PHP markers co-occurring with the package indicators.

The June 2026 macOS ClickFix watch pack adds local host and mounted-root checks for fake-CAPTCHA Terminal paste commands that use curl -fsSL, /tmp DMG downloads, hdiutil attach -nobrowse, automatic .app/.pkg launch, Atomic macOS Stealer/AMOS terms, s.01M0td.dmg, NNApp.app, svs-verificationdate[.]beer, and 196.251.107[.]171.

The June 2026 macOS.Gaslight watch pack adds local host and mounted-root checks for SentinelOne-reported Gaslight SHA-256 values, the com.apple.system.services.activity LaunchAgent label, Telegram Bot API polling/exfiltration terms, standalone CPython staging through astral-sh/python-build-standalone, Keychain/browser collection terms, and LLM-triage prompt-injection bait.

The June 2026 EvilTokens watch pack adds Microsoft OAuth device-code phishing triage checks for browser-data/SOC exports, including AES-GCM browser-side decryption notes, /api/device/start, /api/device/gate/, /api/device/status/, emp01825.workers.dev, and the reported MD5. Shared Cloudflare IPs from the analysis are intentionally not treated as stable IOCs.

The June 2026 BlueKit watch pack adds browser-in-the-middle phishing review signals for Netcraft-reported rrweb DOM streaming over WebSocket, custom CAPTCHA, WebRTC IP mismatch detection, browser fingerprint checks, top-level CSS filter randomization, and phishing-infrastructure asset proxying. rrweb alone is intentionally treated as context, not an IOC.

The June 2026 TonRAT Photo ZIP watch pack adds local/mounted-root triage checks for hospitality phishing notes involving Booking Manager/Calendly and Google redirect lures, photo-*.zip archives, image-looking .png.lnk shortcuts, PowerShell stagers, user-space Node.js v24.13.0 under AppData\Local\Nodejs, TON blockchain API C2 discovery, encrypted WebSocket C2, and Run/RunOnce persistence notes.

The June 2026 PixelSmash watch pack adds FFmpeg/libavcodec posture checks for CVE-2026-8461, MagicYUV decoder exposure terms, older upstream-looking FFmpeg versions before 8.1.2, and high-risk media ingestion surfaces such as Jellyfin, Nextcloud movie previews, PhotoPrism, Immich, OBS, and thumbnailers.

The June 2026 libssh2 client-exposure lane adds Debian-family package checks and copied-advisory/source-note checks for CVE-2026-55200, the ssh2_transport_read() packet-length out-of-bounds write fixed by upstream commit 7acf3df. It also tracks adjacent CVE-2026-55199 notes because both libssh2 fixes are being triaged together by downstream packagers. The lane now also tracks SecurityOnline/VulnCheck-reported CVE-2026-58050 publickey subsystem heap-corruption terms and flags local copies or notes from the public bikini/exploitarium libssh2-cve-2026-55200-poc and libssh2-publickey-list-calc-poc trees as PoC research artifacts.

The June 2026 PackageKit lane adds Debian-family package checks and copied-advisory/source-note checks for CVE-2026-41651, a local privilege escalation in PackageKit versions 1.0.2 through 1.3.4 fixed in 1.3.5. It flags InstallFiles, pk_transaction_set_state, and transaction->cached_transaction_flags race-condition notes, plus Pack2TheRoot/GHSA provenance markers as local research-artifact review leads.

The June 2026 cloud bucket hijacking lane adds copied-advisory and local note checks for storage bucket deletion plus same-name recreation risks that can reroute cloud data streams. It tracks Google Cloud Logging sinks, Pub/Sub Cloud Storage destinations, Storage Transfer jobs, AWS S3 replication, Amazon Data Firehose, and Azure Monitor diagnostic export context, along with bucket delete permissions and perimeter mitigations such as VPC Service Controls, Service Control Policies, and account-regional S3 namespaces.

The June 2026 MCP Python SDK lane adds PyPI mcp dependency checks for CVE-2026-52869 / GHSA-jpw9-pfvf-9f58, fixed in 1.27.2. It flags affected versions before 1.27.2, SSE session_id/SseServerTransport exposure, stateful Streamable HTTP Mcp-Session-Id/StreamableHTTPSessionManager context, bearer-token/authenticated-principal terms, and hosted-client AccessToken.subject isolation notes. Stdio, stateless Streamable HTTP, and no-auth deployments are called out as different exposure cases.

The June 2026 Amazon Q Developer lane tracks AWS bulletin 2026-047-AWS, CVE-2026-12957, and CVE-2026-12958 for Language Servers for AWS and Amazon Q IDE plugins. It flags vulnerable-looking Amazon Q plugin metadata, repository-local .amazonq/mcp.json command configs, MCP command/args entries near cloud credential inheritance terms, suspicious aws sts get-caller-identity collection behavior, and symlink trust-boundary review notes. Fixed baselines are Language Servers for AWS 1.69.0, Amazon Q Developer for VS Code 2.20, JetBrains 4.3, Eclipse 2.7.4, and AWS Toolkit with Amazon Q for Visual Studio 1.94.0.0.

The June 2026 ShapedPlugin Pro WordPress supply-chain watch pack adds local WordPress tree checks for affected Pro plugin slugs and versions, LicenseLoader.php, fake woocommerce-subscription / woocommerce-notification plugin paths, 194.76.217[.]28:2871, generate[.]2faplugin[.]org, the REST backdoor endpoint, 2FA secret markers, and the reported loader hash.

This project also tracks urgent Linux advisories as operator guidance when they intersect supply-chain response hosts. NGINX Rift / CVE-2026-42945 and Sudo CVE-2026-35535 are currently documented as advisory-only context; this guard does not yet perform NGINX rewrite-module configuration or distro sudo package detection for those separate advisories.

Safety stance

• Read-only checks by default.
• No exploit testing.
• No malware execution.
• No automatic cleanup.
• No token revocation.
• No claim that a host is clean.
• Secret files are detected by path only; contents are not printed.
• Dynatrace token-shaped values are redacted in output.
• No telemetry, upload, or maintainer-side collection of scan results.

Privacy

This guard does not provide a hosted service, send telemetry to the maintainers, or upload scan results. It reads local host metadata and reports findings to the terminal, or to a local report path only when the operator explicitly provides --report.

Any output files are created in the operator's local environment unless the operator separately chooses to share them.

Expected startup tooling is documented in docs/expected-tooling.md. Approval is scoped to the verified installed artifact and official destination; provider names alone never suppress a finding.

Credential-adjacent files are reported by path only. The tool does not print secret values, read private keys for content, or send results to the project maintainers.

Usage

npx linux-supply-chain-guard

Local checkout:

node bin/linux-supply-chain-guard.js
node bin/linux-supply-chain-guard.js / --json
node bin/linux-supply-chain-guard.js /mnt/recovered-root --report report.json --home /mnt/recovered-root/home/alice
node bin/linux-supply-chain-guard.js / --include-historical --include-resolved
node bin/linux-supply-chain-guard.js / --exclude /srv/mirror   # incomplete scan, exit 3

The default is deliberately concise and actionable. --include-historical runs the older source-backed rule catalog for retrospective incident response. --exclude DIR (repeatable) skips a directory tree you name; skipped trees are listed under coverage in the JSON report, summary.incomplete is true, and the CLI exits 3 unless a critical (2) or token-monitor (4) result applies.

The same incomplete status now covers unreadable inputs, candidate inspection failures and reached discovery budgets. coverage.unreadablePaths and bounded path samples report access failures; coverage.limitedSearches reports exhausted discovery searches; coverage.inspectionFailures identifies failed rule lanes. coverage.scope describes the boundary: enabled lanes and configured discovery paths, not every file on the host. Missing optional platform files do not by themselves mean incomplete coverage. A missing or non-directory explicit root is an error (64), not an empty successful scan. This intentionally replaces review exit 1 for candidate inspection failures with incomplete exit 3. --include-research is deprecated: it is still accepted, prints a one-line warning to stderr, and has no effect, because research and tool folders are no longer path-suppressed. It does not change the exit code. --include-resolved restores informational fixed or mitigated findings. Suppressed counts are reported without including their path-level data.

Excluding deliberate mounts

The guard walks every directory under the scanned roots, including mounted filesystems. If a home directory contains a deliberate cloud-sync mount (for example a FUSE/rclone remote) or a tmpfs/in-memory mount that you do not want walked (slow, remote, or volatile content), exclude it explicitly:

node bin/linux-supply-chain-guard.js / --exclude /home/user/cloud-drive --exclude /home/user/ramdisk

Each --exclude is a real path (for a mounted root, use the path under that root, for example /mnt/recovered-root/home/user/cloud-drive). Excluded trees are never listed, are reported under coverage.excludedPaths, and make the scan incomplete: summary.incomplete is true and the CLI exits 3 unless a critical (2) or token-monitor (4) result applies. Treat exit 3 as "review what was skipped", not as a clean result.

Optional guarded dependency resolution for this checkout:

sfw npm install --package-lock-only --ignore-scripts --audit=false --fund=false

Socket Firewall is approved for guarded use in this repository as of 2026-05-21 after vendor confirmation of the sfw-free v1.10.0 binary update and local canary logs showing stable wrapper and binary hashes. Keep lifecycle scripts suppressed on first contact and review any lockfile changes before commit.

Socket's 2026-06-19 Launch Week Day 3 product note says Socket Firewall now blocks malicious VS Code and Open VSX extensions before install or update. That matches this guard's editor-extension watch lane: editor extensions execute in developer environments with source, terminal, credential, and token access, so pre-install blocking is a valid team safeguard rather than only a convenience wrapper.

Exit codes:

• 0: informational findings only
• 1: warning or review findings
• 2: critical findings
• 3: scan incomplete: exclusions, unreadable inputs, failed candidate inspections or resource limits (see coverage in the JSON report)
• 4: token-monitor artifact found; follow the STOP guidance before revoking tokens or removing anything
• 64: command-line or runtime error

Precedence when several apply: 4 > 2 > 3 > 1 > 0.

Current checks

• AlmaLinux Fragnesia / CVE-2026-46300 patched kernel posture:
  • AlmaLinux 8: kernel-4.18.0-553.124.2.el8_10 and above
  • AlmaLinux 9: kernel-5.14.0-611.54.4.el9_7 and above
  • AlmaLinux 10: kernel-6.12.0-124.56.2.el10_1 and above
• DirtyFrag-family module state for esp4, esp6, and rxrpc.
• Temporary module blacklist confirmation in /etc/modprobe.d.
• Trend Micro Deep Security Agent hook reload bypass indicators:
  • bmhook, tmhook, dsa_filter, dsa_filter_hook, ds_am.init, /opt/ds_agent, and ds_agent.service metadata
  • copied logs showing agent-controlled rmmod / module reload behavior, livepatch unpatch/patch transitions, LKM DOWN, or reload breadcrumbs
  • event-storm and telemetry-gap terms such as TELEMETRY_EVENT_DROPPED_COUNT, event.dropped, bmhook_throttle_check, bmhook_scan_enqueue, tmbpf_send_event, enable_loop_prevention, thresholdBLP, and enableBLP
• System Register Hijacking / ret2entry research indicators:
  • System Register Hijacking, ret2entry, swapgs Stack Pivoting, KERNEL_GSBASE_MSR, MSR_GSBASE, entry_SYSCALL_64, entry_SYSCALL_compat, FineIBT, KERNEL_IBT, and kCFI
  • adjacent register-technique terms including native_write_cr4, native_write_cr0, CR-Pinning, wrgsbase, wrfsbase, MSR_FSBASE, SPSR_EL1, ELR_EL1, VBAR_EL1, and PAN MSR
  • PoC/provenance terms such as KernelCTF, vulnerable kernel module notes, and exploit-porting references; these are research leads only
• ITScape / CVE-2026-46316 ARM64 KVM posture:
  • ARM64/aarch64 architecture detection from scanner options, /proc/cpuinfo, or kernel metadata
  • loaded kvm, kvm_arm, or kvm_arm64 module exposure
  • kernel config signals for KVM and ARM GIC/vGIC ITS support
  • review finding when an exposed ARM64 KVM host is below upstream 6.15.0 and needs vendor backport confirmation
• DirtyCBC / Linux RxGK review indicators:
  • DirtyCBC, AF_RXRPC, YFS-RxGK, RxGK RESPONSE, and MSG_SPLICE_PAGES advisory terms
  • decrypt-before-MAC/page-cache poisoning terms near rxgk_decrypt_skb, skb_to_sgvec, or crypto_krb5_decrypt
  • upstream fix marker aa54b1d27fe0, SKBFL_SHARED_FRAG, and skb_has_shared_frag
  • public PoC/provenance markers such as poc.c, poc.py, RXGK_SERVER_ENC_TOKEN, RXRPC_CHARGE_ACCEPT, and RXRPC_CLIENT_INITIATED
• DirtyClone / CVE-2026-43503 review indicators:
  • DirtyClone, Copy Fail, DirtyFrag, CVE-2026-43503, CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, and CVE-2026-46300 advisory terms
  • clone-path markers such as __pskb_copy_fclone, nf_dup_ipv4, skb_shinfo, skb_shift, skb_segment, skb_gro_receive, and tcp_clone_payload
  • XFRM/IPsec, CAP_NET_ADMIN, unshare -Urn, ip xfrm, TEE --gateway, esp_input(), and kernel.unprivileged_userns_clone=0 terms
  • upstream fix/release markers including 48f6a5356a33, 9e171fc1d7d7, v7.1-rc5, SKBFL_SHARED_FRAG, SecurityOnline-reported affected marker cef401de7be8c4e155c6746bfccf721a4fa5fab9, and stable-backport markers such as fbeab9555564a1b98e8582cd106dfe46c4606991
• Pedit COW / CVE-2026-46331 review indicators:
  • Pedit COW, CVE-2026-46331, act_pedit, and net/sched/act_pedit.c advisory terms
  • traffic-control mutation path terms such as tcf_pedit_act, tc pedit, TCA_PEDIT_KEY_EX, pedit ex, skb_ensure_writable, and skb_linearize
  • exposure/mitigation terms including cls_u32, CAP_NET_ADMIN, unprivileged user namespace, and kernel.unprivileged_userns_clone=0
  • THN-reported exploit/mitigation terms including packet_edit_meme, /bin/su, setuid root binary, user.max_user_namespaces=0, lsmod | grep act_pedit, install act_pedit /bin/true, drop_caches, Debian 13, trixie, and RHEL 10
  • copied PoC/provenance markers such as tc qdisc, tc filter, tc action, unshare -Urn, and packet_edit_meme are review-only signals
• nf_tables / CVE-2026-23111 review indicators:
  • affected upstream kernel trains from the public checker notes, including 6.18 < 6.18.10, 6.12 < 6.12.70, 6.6 < 6.6.124, 6.1.36 < 6.1.163, and 5.15.121 < 5.15.200
  • nf_tables module/config presence paired with kernel.unprivileged_userns_clone=1
  • nft_map_catchall_activate, nft_set_elem_active, nft_setelem_data_activate, nft_data_hold, NFT_GOTO, DELSET, DELCHAIN, pipapo, catchall element, and chain->use advisory terms
  • kernel fix markers including 8c760ba4e36c750379d13569f23f5a6e185333f5 and upstream f41c5d151078c5348271ffaf8e7410d96f2d82f8
  • public PoC/provenance markers such as Baba01hacker666/CVE-2026-23111, CVE-2026-23111-checker.py, exploit_full.c, and exploit_full.b64 are review-only signals
• IPv4 TCP CVE-2026-98432 (inet_opt/ireq_opt use-after-free) kernel posture:
  • running kernel upstream version compared with the first fixed stable release for its branch: 7.2 < 7.2.10, 5.15 < 5.15.223, 5.10 < 5.10.272; other branches report "unknown, check vendor"
  • installed kernel package changelogs under /usr/share/doc are read offline; a mention of upstream fix e3f33b0 or CVE-2026-98432 is treated as a vendor backport note only when that package build stamp matches the running kernel
  • net.ipv4.tcp_migrate_req is reported; 0 closes only the second attack path, so it is never treated as a fix
• Kernel reboot pending (kernel-reboot-pending): a newer linux-image-* package installed than the running kernel, the same release rebuilt with a different build stamp than /proc/sys/kernel/version, or /run/reboot-required present
• Known Shai-Hulud / Here We Go Again persistence and payload paths:
  • /tmp/transformers.pyz
  • gh-token-monitor.service
  • gh-token-monitor.sh
  • pgsql-monitor.service
  • pgmonitor.py
• OX-reported DPRK npm RAT dependency indicators:
  • terminal-logger-utils
  • pretty-logger-utils
  • ts-logger-pack
  • pinno-loggers
  • utils.cjs
  • /api/validate/keyboard-events
• Osj/@inf0stache reported DPRK/Famous Chollima-style npm loader behavior:
  • Socket.IO usage paired with /api/service
  • 0001.dat second-stage fetch/write/Node execution paths
• GitHub Advisory npm malware packages with all versions affected:
  • atomic-lockfile
  • csc154-internall-depend
  • ecto-flag-read
  • @validate-sdk/v2
  • google-cloud-secret-manager-config-poc
  • signup-embedder
  • ts-grok
• August 4, 2026 keyv / cacheable (ChainDrop / Shai-Hulud) npm indicators (cross-platform npm ecosystem—not Linux-only):
  • Ox Security's August 4 early estimate: ~444 packages, 1,600+ versions, 2B+ monthly downloads; this guard checks the seed carriers listed below, not the complete later inventory
  • exact seed compromised versions: [email protected], [email protected], [email protected], [email protected], [email protected], @cacheable/[email protected], [email protected], @cacheable/[email protected], @cacheable/[email protected], @cacheable/[email protected], [email protected] (full inventory via Ox table / Wiz CSV)
  • same tradecraft: credential theft, IDE/AI persistence, GitHub exfil, dead-man switch (notify-only before revoke)
  • new Ox signals: production-crash extortion string, campaign RSA public key (TeamPCP-copycat hypothesis; attribution unconfirmed), router_runtime.js, opensearch-js git pin
  • network markers: npm-cache[.]com, Ethereum contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103, and public ETH RPC hosts used for C2 resolution
  • payload/persistence text: setup.mjs / Math_Symbol.js / math_init.js, preinstall → node setup.mjs, Bun 1.3.13 staging, GitHub description Shai-Hulud: Here We Go Again, and related campaign strings
  • Ox recommended actions (operator-owned): rotate keys + 2FA, downgrade packages, search/revoke affected GitHub accounts under IR order
  • scope note: risk follows npm install/lockfile use on any OS; this tool reports matches found on Linux host roots / mounted workspaces only
  • notification only; credits Ox Security and Moshe Simon (@MosheTov; X post → Ox blog), Snyk, Wiz, JFrog, Aikido, StepSecurity, and npm Security; no data collection or auto-remediation
• Checkmarx ChainVeil / SuccessKey npm indicators:
  • typosquat package names including tailwindcss-merge, sass-format, sass-formats, tailwindcss-animates-kit, tailwindcss-animatics, clsx-tailwind, typeorm-encrypt, rate-limits-flexible, and rate-limit-flexible
  • import-time loader markers in lib/lib.min.js, global['_V']='A6-*', successkeyteck, XOR-key fragments, and seeded shuffler context
  • C2 IPs 166.88.54.158, 198.105.127.210, and 23.27.202.27, plus /$/boot, /upload, WebSocket C2, Tron/Aptos/BSC C2 strings, and long-space-padded shell-config persistence markers
• Supply Chain Attack catalog npm malware indicators:
  • free-claude
  • free-anthropic-claude
  • June 23 package-cluster names such as search-from-search, node-fetch-utils, signup-embedder, node-core-libs, calculate-helper, cursorai-agent, and vitest-cli
• AtomicArch / IronWorm AUR indicators:
  • AUR PKGBUILD, .SRCINFO, and .install metadata that references atomic-lockfile
  • AUR build/install scripts that invoke npm or npx while referencing atomic-lockfile
  • payload-behavior terms near atomic-lockfile, including eBPF/rootkit, deps, browser cookie, Vault, Docker/Podman, Slack, Discord, and Teams targeting language
• Panther OtterCookie npm indicators:
  • package names including bjs-biginteger, bjs-lint-builder(s), hjs-lint-builders, sjs-builder(s), and npm-doc-builder
  • Vercel-hosted C2 domains used for config retrieval and file upload
  • install-time node test.js / postinstall behavior markers
• OX / Socket easy-day-js / Mastra npm supply-chain indicators:
  • easy-day-js, setup.cjs, and node setup.cjs --no-warnings
  • reported C2 indicators including 23.254[.]164.92:8000 and 23.254[.]164.123:443
  • stage-2/persistence indicators including protocal.cjs, NodePackages, NvmProtocal, com.nvm.protocal, nvmconf.service, .pkg_history, and .pkg_logs
• SafeDep procwire / routecraft Windows npm dropper indicators:
  • exact package names procwire, routecraft, endpointmap, bytecraft, and staticlayer
  • staged payload URL files[.]catbox[.]moe/j4loim[.]chk
  • Microsoft-Delivery-Optimization/10.0, Zone.Identifier, [ZoneTransfer], bitsadmin, curl.exe, windowsHide: true, and updater-like executable names
• Hades / Miasma PyPI indicators:
  • affected package versions including langchain-core-mcp, openai-mcp, instructor-mcp, tiktoken-mcp, ray-mcp-server, and reported bioinformatics package versions
  • *-setup.pth, _index.js, .bun_ran, oven-sh/bun/releases/download, subprocess.run, and sys.path loader patterns
  • native .abi3.so extension layouts paired with _index.js
  • GitHub/CI markers including Run Copilot, format-results, and Hades - The End for the Damned
  • JFrog-reported seeding markers including SEED_PAT and Seeder
• Miasma / ImmobiliareLabs npm indicators:
  • affected @immobiliarelabs Backstage package versions across backstage-plugin-gitlab, backstage-plugin-gitlab-backend, backstage-plugin-ldap-auth, and backstage-plugin-ldap-auth-backend
  • binding.gyp / Phantom Gyp install-time execution of root index.js
  • root index.js loaders with Bun v1.3.13, AES/Caesar-shift language, and developer or CI/CD credential-theft terms
  • GitHub Actions deployment-triggered release automation and codfish/semantic-release-action review leads
  • AI/IDE persistence artifact terms such as .github/setup.js, .gemini/settings.json, .claude, .vscode/tasks.json, and Cursor rules
• Impacket secretsdump Windows/AD credential-dump artifacts:
  • impacket-secretsdump, secretsdump.py, and common DCSync flags such as -just-dc, -just-dc-ntlm, and -just-dc-user
  • VSS and remote shadow-copy terms including -use-vss, -use-remoteSSWMI, wmiexec, mmcexec, and vssadmin
  • offline hive parsing commands for SAM, SYSTEM, SECURITY, and ntds.dit
  • alternate authentication material terms such as -hashes, -aesKey, -k -no-pass, and KRB5CCNAME
  • output artifact names and hash-table formats such as dump.ntds, dump.secrets, and username:RID:LMhash:NThash
• DAEMON Tools Lite supply-chain indicators:
  • compromised build references from 12.5.0.2421 through 12.5.0.2434 and fixed-build review marker 12.6.0.2445
  • tampered component names DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe
  • C2 and payload terms including env-check.daemontools[.]cc, 38.180.107[.]76, env_check_script, envchk.exe, cdg.exe, cdg.tmp, core.tmp, mcrypto.chiper, mcrypto.dat, and crypto.dll
  • published SHA-1 IOC matches for affected installers, modified DiscSoftBusServiceLite.exe files, and staged payloads
  • command-shape, minimal-backdoor, and QUIC RAT follow-on review markers including cmd.exe /c powershell, DownloadFile, first_match, RC4, schedsvc.dll, msquic.dll, notepad.exe, and conhost.exe
• Agentjacking / Sentry MCP indicators:
  • Sentry DSN or ingest surfaces wired into MCP/agent context
  • Sentry-style fake ## Resolution content that asks an agent to run npx diagnostics before inspecting source
  • Tenet validation markers such as X-Tenet-Security and ResponsibleDisclosure [SECURITY SCAN]
• AutoJack / local agent-control-plane indicators:
  • AutoGen Studio / autogenstudio references near local MCP WebSocket routes, StdioServerParams, server_params, or localhost port 8081
  • reported autogenstudio pre-release builds 0.4.3.dev1 and 0.4.3.dev2
  • reminders that localhost is not a trust boundary when a browsing agent can render untrusted web content on the same host
• 0DIN clean-repo / DNS TXT agent-setup indicators:
  • first-time setup text that combines requirements.txt with python3 -m ... init in coding-agent context
  • package first-run errors that tell the agent to run a module init command
  • shell scripts that fetch DNS TXT records with dig and execute the result through bash -c, sh -c, or base64 -d | bash
  • demo-specific terms such as python3 -m axiom init, _axiom-config.m100.cloud, and Axiom not initialised
• Roundcube CVE-2025-49113 webmail exposure indicators:
  • installed Roundcube versions below 1.5.10 or 1.6.11
  • local PoC/exploit-runner artifacts referencing CVE-2025-49113
  • upload/session code-path review terms such as program/actions/settings/upload.php, _from, and rcube_session
• Joomla JCE / CVE-2026-48907 indicators:
  • JCE/JCE Pro versions below 2.9.99.6
  • local CISA KEV / exploit notes referencing CVE-2026-48907
  • profile/upload triage terms matching the unauthenticated profile-creation and PHP upload/execution flaw
• Joomla SP Page Builder / CVE-2026-48908 indicators:
  • SP Page Builder versions 1.0.0 through 6.6.1
  • local Censys/exploit notes referencing CVE-2026-48908, active exploitation, unauthenticated file upload, or potential RCE
  • upload/RCE triage terms around com_sppagebuilder and SP Page Builder
• Splunk Enterprise / CVE-2026-20253 indicators:
  • Splunk Enterprise 10.x references for vendor mitigation review
  • CISA KEV / BOD 26-04 copied notes for CVE-2026-20253
  • PostgreSQL sidecar recovery endpoints such as /v1/postgres/recovery/backup and /v1/postgres/recovery/restore
  • file-write/RCE-chain triage terms such as .pgpass, pg_restore, pg_dump, backupFile, and arbitrary file creation/truncation
• CISA KEV June 23, 2026 edge-device indicators:
  • Lantronix EDS5000 / EDS5008 / EDS5016 / EDS5032 references paired with CVE-2025-67038, code injection, username parameter, or root-privilege language
  • Ubiquiti UniFi OS references paired with CVE-2026-34908, CVE-2026-34909, CVE-2026-34910, Security Advisory Bulletin 064, command injection, path traversal, or improper access control language
  • UniFi OS Server 5.0.6 / unifi-core 5.0.126 vulnerable-version metadata and 5.0.8 / unifi-core 5.0.153 fixed-version context
  • management-interface exposure terms including TCP 11443, 0.0.0.0:11443, admin interface, and web interface notes
  • Bishop Fox triage markers including /api/auth/validate-sso/, ucs/update/latest_package, package-update, ucs-update, child-process, and unexpected-sudo review terms
  • CISA KEV, BOD 26-04, and forensics-triage notes for exported appliance inventories or incident-response files
• PTC Windchill/FlexPLM / CVE-2026-12569 indicators:
  • CISA KEV catalog version 2026.06.25, PTC advisory CS473270, and CVE-2026-12569 copied notes
  • Windchill/FlexPLM references paired with improper input validation, unauthenticated remote code execution, CWE-20, CWE-502, or BOD 26-04
  • JSP web shell triage terms, including /Windchill/login/<16 hex>.jsp
  • X-windchill-req request-header review terms for access-log hunting
• python.org release-management API trust indicators:
  • copied notes about forged admin-level API requests, release-file metadata, authentication bypass, or malicious Python release download URLs
  • official host context such as www.python.org/ftp/python, www.python.org/downloads/release, and downloads.nyc1.psf.io
  • release provenance terms such as Sigstore, PGP signature, PEP 761, and Trail of Bits
  • Python release-looking download URLs outside official python.org/PSF hosts are warning-level mirror/provenance review leads
• CPython tarfile / CVE-2026-11940 extraction-filter indicators:
  • copied advisory terms for CVE-2026-11940, incomplete-fix context for CVE-2025-4330, CWE-22, and CWE-59
  • Python code using tarfile.extractall() or extract() with filter="data" or filter="tar" on archive upload, artifact, cache, restore, import, or ingest paths
  • hardlink/symlink bypass mechanics including deeper symlink names, shallower hardlink paths, relative targets, and out-of-destination symlinks
  • PSF patch/provenance markers including python/cpython/pull/151559, python/cpython/issues/151558, and patch commit hashes from the CVE record
• HackedAlert Django cache-deserialization review indicators:
  • HA-2026-00131, Django v6.0.4 RCE, Redis/Memcached cache poisoning, and SMB/UNC path-redirection advisory terms
  • Django 6.0.4 dependency references when paired with cache/session review context
  • RedisCache, PyMemcacheCache, MemcachedCache, cache-backed sessions, RedisSerializer, pickle.loads(data), and pymemcache.serde.pickle_serde
  • exposed Redis/Memcached preconditions such as 0.0.0.0, 6379, 11211, missing auth, SSRF, lateral movement, shared cache, or multi-tenant cache
  • Windows file-session or cache locations using SMB/UNC path redirection
  • PoC/provenance terms such as pwned_session_1337, django.contrib.sessions.cache, CACHE_KEY, and Pickle-RCE-Finder
• Cisco CUCM WebDialer / CVE-2026-20230 indicators:
  • Cisco Unified Communications Manager / Unified CM / Unified CM SME references paired with WebDialer, SSRF, or Cisco advisory cisco-sa-cucm-ssrf-cXPnHcW
  • file-write and root-escalation language from the Cisco/NVD record
  • OSINT escalation terms for full-chain exploitation, webshell drops, Tor, or automated sweeps
• Cisco Catalyst SD-WAN Manager zero-day log-hunting indicators:
  • CVE-2026-20245, CVE-2026-20127, and CVE-2026-20182
  • Rogue peer IP indicators from GTIG reporting
  • evil_tenant.csv, vconfd_script_upload_tenant_list.sh, and request tenant-upload tenant-list
  • troot, /etc/passwd, /etc/shadow, /var/log/scripts.log, and /var/log/auth.log
  • Fixed-release references including 20.9.9.2, 20.12.7.2, 20.15.4.5, 20.15.5.3, 20.18.3.1, and 26.1.1.2
• REDCap exposure posture indicators:
  • REDCap version references older than 17.1.3, the latest version cited by Censys/SecurityWeek on 2026-06-16
  • legacy REDCap path/version strings such as redcap_v16_0_17
  • UNC6508 / InfiniteRed triage terms for clinical/medical research targets
  • reminders to inventory internet exposure, patch REDCap, avoid exposed legacy side-by-side versions, and keep the database behind a firewall
• Fortinet / FortiGate credential-exposure posture indicators:
  • local CISA or incident notes for the June 18, 2026 Fortinet device hardening alert
  • FortiGate/FortiOS/SSL VPN/FortiCloud SSO terms, FortiBleed, credential dump/brute-force language, VPN authentication hashes, and firewall configuration export terms
  • FortigateSniffer/FortiBleed tooling markers including fg_sniffer, mpbrute2.bin, forticheck, SNIFTRAN, PCAP Deep Analysis Toolkit, diagnose sniffer packet, harvestresults, and reported campaign IPs
  • reminders to inventory Fortinet edge devices, rotate Fortinet/VPN/LDAP/AD credentials from a clean posture, enforce MFA, restrict management-plane exposure, and review authentication/config-export logs
• SocGholish / FakeUpdates WordPress triage context:
  • Operation Endgame disrupted 106 SocGholish-linked servers and reported cleanup of 14,971 infected WordPress sites
  • the June 24, 2026 BleepingComputer update reports a related Operation Endgame action against Amadey and StealC infrastructure: 326 servers and 142 domains disrupted, about 27 million stolen credentials recovered from over 385,000 compromised systems, and more than 200 malicious C2 domains/IPs identified in Microsoft's civil action
  • Proofpoint and IBM X-Force's June 24, 2026 StealC writeup adds technical context on StealC C2 panels, RC4-encrypted HTTP POST JSON request types, optional loader payload delivery, and the law-enforcement disruption
  • FBI IC3 warns that malicious traffic distribution systems route users from compromised websites, poisoned ads, phishing, or fake promotions to phishing pages, fake updates, malware, or financial scams
  • no new stable domains, hashes, or file paths were published in the reachable report, so this remains advisory context rather than a detector rule
  • operators should review WordPress integrity, suspicious administrator accounts, CMS/plugin/theme patch state, credentials, and DNS/domain shadowing if SocGholish exposure is suspected
  • businesses should monitor suspicious wscript.exe, cscript.exe, and PowerShell web-request execution for delivered .js, .ps1, or .svg payloads where Windows endpoint telemetry is available
• Argamal game-RAT residue indicators:
  • natives2_blob.bin and zaesdl.dat artifact names
  • C2 domains asper1.freeddns.org and Winst0.kozow.com
  • delayed bitsadmin second-stage fetch markers
  • Windows Color System Calibration Loader COM-hijack persistence terms
• Microsoft/Ars Crypto Clipper USB worm indicators:
  • Crypto Clipper, Trojan:Win32/CryptoBandits.A, and Defender alert terms
  • USB .lnk propagation notes paired with Tor/SOCKS5, clipboard, seed phrase, or wallet-address replacement behavior
  • localhost:9050, portable Tor client, PowerShell screenshot capture, and Curl/web-request exfiltration triage terms
• KnowBe4 Threat Labs ClickFix phishing indicators:
  • Review Past Due Doc.zip / .lnk OneDrive lure terms
  • Win+R / clipboard-injected PowerShell / DNS TXT staging language
  • infrastructure domains document-auth[.]icu, italy-news[.]info, and lootrioya[.]info
  • reported ZIP, MSI/RMM, and password-stealer SHA-256 values
• macOS ClickFix AMOS DMG indicators:
  • curl -fsSL into /tmp, hdiutil attach -nobrowse, and automatic .app/.pkg launch command-chain language
  • s.01M0td.dmg, NNApp.app, Atomic macOS Stealer/AMOS, Keychain prompt, Ledger Live, and Trezor Suite replacement terms
  • infrastructure svs-verificationdate[.]beer and 196.251.107[.]171
• macOS.Gaslight indicators:
  • SentinelOne-reported Mach-O, sibling BONZAI, Python payload, and bash installer SHA-256 values
  • Apple XProtect labels MACOS_BONZAI_COBUCH and AIRPIPE
  • com.apple.system.services.activity LaunchAgent label and endpoint-macos-aarch64-5555494492fc075f441637fb9d894913dde3a2ea
  • Telegram Bot API getUpdates, attach://, tg_room_id, and error-code terms; temp/collected_data.zip; login.keychain-db
  • cpython-3.10.18, PY_VERSION=3.10.18, BUILD_DATE=20250708, and astral-sh/python-build-standalone
  • LLM-triage prompt-injection bait terms such as 38 fabricated, LLM-assisted triage, token expiry, out-of-memory, disk exhaustion, and static-analysis flags
• EvilTokens Microsoft OAuth device-code phishing indicators:
  • EvilTokens, oauth-ms-phish, and Microsoft OAuth device-code phishing triage terms
  • browser-side AES-GCM / decrypted DOM visibility-gap language
  • /api/device/start, /api/device/gate/, /api/device/status/, emp01825.workers.dev, and MD5 fcd1b654a0b3e8f85ca7cfdafe494d4b
  • device-code flow co-occurrence checks for userCode, sessionId, and verification URI handling
• BlueKit browser-in-the-middle phishing indicators:
  • Bluekit, Browser-in-the-Middle, BitM, and rrweb near login-page DOM streaming or WebSocket terms
  • custom CAPTCHA, WebRTC IP mismatch detection, browser fingerprint checks, headless-browser checks, and top-level CSS filter randomization
  • asset proxying language for images, fonts, and CSS fetched through phishing infrastructure
• TonRAT Photo ZIP phishing indicators:
  • hospitality lure context such as Booking Manager, Calendly, hotel-industry, or reservation-photo language paired with Google redirect/share links, Cloudflare Turnstile, or .cfd staging domains
  • attachment names such as photo-<digits>.zip and image-looking shortcut names such as IMG-*.png.lnk or PHOTO-*.png.lnk
  • PowerShell/LNK stager terms paired with user-space Node.js v24.13.0, AppData\Local\Nodejs, or node-v24.13.0
  • TonRAT, TON blockchain API / tonapi.io, encrypted WebSocket C2, and Run/RunOnce persistence review terms
• Mistic / MLTBackdoor ransomware access-broker indicators:
  • Backdoor.Mistic, Mistic RAT, MLTBackdoor, Woodgnat, KongTuke, and ModeloRAT advisory or telemetry terms
  • co-occurrence with ransomware-family handoff terms including Qilin, Interlock, Rhysida, Akira, 8Base, and Black Basta
  • nearby post-exploitation and remote-admin tooling terms such as Cobalt Strike, Impacket, AnyDesk, Splashtop, and ScreenConnect
  • process-injection and command-execution triage language such as CreateRemoteThread, VirtualAllocEx, WriteProcessMemory, cmd.exe, powershell.exe, and schtasks
• FFmpeg PixelSmash indicators:
  • installed ffmpeg / libavcodec* Debian-family packages
  • upstream-looking versions before FFmpeg 8.1.2 flagged for vendor-backport review
  • PixelSmash, CVE-2026-8461, MagicYUV, magicyuv, ffprobe, and VFS..D magicyuv triage terms
  • media-ingestion surfaces including Jellyfin, Emby, Nextcloud, Immich, PhotoPrism, OBS, and Linux thumbnailers
  • mitigation notes such as --disable-decoder=magicyuv
• HAProxy CVE-2026-55203 / CVE-2026-55204 indicators:
  • installed haproxy Debian-family packages with upstream-looking versions through 3.4.0 flagged for vendor-backport review
  • FastCGI backend configuration terms such as fcgi-app, use-fcgi-app, and proto fcgi
  • HTTP/2/HPACK exposure terms such as alpn h2, hpack_dht_insert, and hpack_dht_defrag
  • upstream fix commit IDs 5985276735777634d8c85f1d73bb7764aab0d6dd and 9a6d1fe3f00d86ab4ea6ea6ea0a5d48fc058a513
• libssh2 CVE-2026-55200 client-exposure indicators:
  • installed libssh2* Debian-family packages
  • upstream-looking versions through 1.11.1 flagged for vendor-backport review
  • advisory/source terms including ssh2_transport_read, packet_length, PR #2052, fix commit 7acf3df, and companion CVE-2026-55199
  • public PoC/research markers including libssh2-cve-2026-55200-poc, cve_2026_55200_probe.c, libpwn_cve_2026_55200_server.py, libpwn_local_rce_harness.c, and libpwn_local_rce_exploit.py
  • local workflow notes where libssh2 appears near SSH/SCP/SFTP clients such as curl, git, backup, deploy, clone, mirror, or artifact-fetch tooling
• libssh2 CVE-2026-58050 publickey-subsystem indicators:
  • installed libssh2* Debian-family packages
  • upstream-looking versions through 1.11.1 flagged for vendor-backport review
  • advisory terms including publickey subsystem, libssh2_publickey_list_fetch, num_attrs, libssh2_publickey_attribute, CWE-190, src/publickey.c, and malicious SSH server
  • public PoC/research markers including libssh2-publickey-list-calc-poc, publickey_win32_heap_groom_calc_repro.c, publickey_win64_arbitrary_free_calc_repro.c, live_publickey_server.py, and replay-calc-poc.py
• PackageKit CVE-2026-41651 local privilege-escalation indicators:
  • installed packagekit* Debian-family packages
  • upstream-looking versions 1.0.2 through 1.3.4 flagged for vendor-backport review
  • advisory/source terms including InstallFiles, pk_transaction_set_state, transaction->cached_transaction_flags, TOCTOU, CWE-367, and src/pk-transaction.c
  • public exploit/advisory provenance markers including Pack2TheRoot, pack2theroot, and GHSA-f55j-vvr9-69xv
• Cloud bucket hijacking posture indicators:
  • Bucket Hijacking, attacker-controlled external storage bucket, active cloud data streams, and globally unique bucket-name risk language
  • Google Cloud terms including Cloud Logging sink, Pub/Sub subscription, Storage Transfer Service, storage.buckets.delete, storage.objects.delete, and logging.sinks.update
  • AWS terms including S3 bucket replication, Amazon Data Firehose, and DeleteBucket
  • Azure terms including Azure Monitor diagnostic settings and Microsoft.Storage/storageAccounts/delete
  • mitigation terms including VPC Service Controls, Service Control Policies, trusted organizational boundaries, and account-regional S3 namespaces
• MCP Python SDK CVE-2026-52869 indicators:
  • PyPI mcp versions before fixed release 1.27.2
  • advisory/source terms including GHSA-jpw9-pfvf-9f58, CWE-639, SseServerTransport, StreamableHTTPSessionManager, Mcp-Session-Id, session_id, AccessToken.subject, and BearerAuthBackend
  • SSE or stateful Streamable HTTP transport terms near bearer/OAuth/ authenticated-principal configuration
  • hosted or multi-tenant MCP client notes where per-user subject isolation is required instead of only shared OAuth client_id
• Amazon Q Developer / AWS Language Servers workspace MCP indicators:
  • AWS bulletin 2026-047-AWS, CVE-2026-12957, CVE-2026-12958, GHSA-6v3r-4p5c-mrp5, and GHSA-xhcr-j4j9-3gh7
  • Amazon Q plugin versions before fixed releas