View Ridge Security
Back to Cyber Hose

Shai-Hulud npm Worm Resurfaces, Compromises tensorlake Package

The Shai-Hulud npm worm returns, compromising tensorlake and stealing tokens, credentials, and wallets from 100,000+ npm users.

🚨 ACTIVE EXPLOITATION

  • UPDATE: Shai-Hulud npm Worm Resurfaces, Compromises tensorlake Package and Slips Past Registry Scanning
    The Shai-Hulud npm worm has resurfaced after months of dormancy, compromising the tensorlake package and bypassing npm's publish-time malware scanning.
    • Affects npm users of the tensorlake TypeScript SDK (100,000+ lifetime installs); malicious version 0.5.144 published 8 October 2026, plus four packages (feishu-docx-mcp@0.3.2, bmc-i18n-extract-cli@1.1.1, blueai-cli@0.7.0, bmc-translate-utils@1.1.1) republishing the original payload on September 7.
    • The worm steals npm, GitHub, and AWS tokens, Kubernetes and Vault credentials, SSH keys, .env files, cryptocurrency wallets, and AI tool config files (Claude, Cursor, Kiro, Windsurf, Zed), and can wipe machines via a dead-man's switch if its embedded GitHub token is revoked.
    • Delivery via a preinstall hook running obfuscated setup.mjs that drops the Bun runtime to execute Math_Symbol.js; attackers pushed verified commits under a maintainer's identity to the tensorlake GitHub repo (commit 41b38f0) roughly 20 hours before the npm publish.
    • Propagation works by enumerating packages tied to the victim's publishing identity, injecting code, bumping versions, and republishing; persistence via .vscode/tasks.json and .claude/settings.json; new variant targets 14 crypto browser extensions and drops a HackBrowserData binary.
    • IOCs: tensorlake 0.5.144; C2 iseekaigogo[.]com resolved via Ethereum contract 0xb614155Fd88114d40549b259457Bcf921Df091B9; payload hashes 25a0735d0db7dc40e5d45ce42d9c106067e6a66e184d967cfecfab17c3bcb5ef and e37e3ddeeaaa9e0c4fdbcb829b4895a6521031c80053fc436625b61e6ee5b1a6; C2 t[.]m-kosche[.]com from the May wave.
    Sources 📄 Source: aikido.dev · 📎 Coverage: thehackernews.com · 👁 via The Hacker News, aikido.dev (discovered)

🕵️ RESEARCH & DEEP DIVES

  • UPDATE: Public PoC released for critical VMware VMXNET3 guest-to-host flaw CVE-2026-59346 CVE-2026-59346
    A public proof-of-concept has been released for CVE-2026-59346, a critical integer-overflow flaw in VMware Workstation and Fusion's VMXNET3 adapter that can enable guest-to-host code execution.

    • Affects VMware Workstation 25H2 and 26H1 and VMware Fusion 25H2 and 26H1 (macOS); fixed in 26H1u1; CVSS 9.3 (Broadcom).
    • The integer overflow in the host's TCP Segmentation Offload (TSO) path causes a 32-bit multiplication wrap-around, leading to an out-of-bounds write with guest-controlled data in the vmware-vmx process.
    • Exploitation requires local administrative privileges inside a guest VM using the VMXNET3 adapter; the PoC (0xCyberstan GitHub) runs as a Linux kernel module writing transmit descriptors directly and currently only crashes the host process, not full code execution.
    • The flaw survived the earlier CVE-2025-41236 patch, which added bounds checks but did not validate the final multiplication result; no exploitation in the wild reported.
    Sources 📄 Source: support.broadcom.com · 📎 Coverage: securityonline.info · 👁 via Cyber Security News

  • Public PoC released for critical VMware VMXNET3 guest-to-host escape flaw CVE-2026-59346 CVE-2026-59346
    A public proof-of-concept has been released for CVE-2026-59346, a critical integer-overflow flaw in VMware's VMXNET3 adapter that can let a privileged guest execute code on the host.

    • Affects VMware Workstation 25H2 and 26H1 and VMware Fusion 25H2 and 26H1 (macOS) using the VMXNET3 virtual network adapter; fixed in 26H1u1 (CVSS 9.3).
    • The flaw is a 32-bit integer overflow in the TSO segmentation path of the host's vmware-vmx process: guest-supplied segment count × segment size wraps to a small allocation, causing a guest-controlled out-of-bounds write.
    • Exploitation requires local administrative privileges inside a compromised guest VM; it is not a remote unauthenticated attack.
    • The PoC (GitHub repo 0xCyberstan/CVE-2026-59346-POC) runs as a Linux kernel module writing transmit descriptors directly, currently only crashing vmware-vmx rather than achieving code execution.
    • The bug survived the 2025 fix for CVE-2025-41236, which bounded packet fields but not the final multiplication; no in-the-wild exploitation reported so far.
    Sources 📄 Source: support.broadcom.com · 📎 Coverage: securityonline.info · 👁 via cryptika.com (discovered)

  • Newly registered domain teams-online[.]com clones Microsoft Teams login page to steal credentials
    A newly registered domain, teams-online[.]com, is mimicking the full Microsoft Teams login and interface to phish work account credentials.

    • Applies to organizations and employees using Microsoft Teams and Microsoft 365 work accounts.
    • The domain teams-online[.]com, registered just 4 days before analysis, copies the full Teams login page and user interface to trick users into entering email addresses and passwords.
    • Identified by security researcher Steven Lim (@0x534c) in a threat alert posted October 8, 2026; Microsoft Defender reportedly showed zero detections at time of analysis.
    • Delivery route is unconfirmed; Microsoft has documented Teams phishing via meetings, chats, and calls.
    • Only IOC supplied is teams-online[.]com — no malware hashes, IPs, or additional URLs were provided.
    Sources 📄 Source: x.com · 📎 Coverage: cybersecuritynews.com · 👁 via cryptika.com (discovered)

📋 ADVISORIES

  • Elastic patches 14 flaws across Elasticsearch, Kibana and Endpoint, incl. Kibana cross-tenant data interception (CVE-2026-102406) CVE-2026-102406
    Elastic has released 14 security advisories fixing vulnerabilities in Elasticsearch, Kibana, and Elastic Agent/Endpoint, led by a CVSS 8.8 Kibana Fleet flaw enabling cross-tenant data interception.

    • Affects Elasticsearch, Kibana, and Elastic Agent/Endpoint; both self-managed and Elastic Cloud Hosted deployments are impacted.
    • CVE-2026-102406 (CVSS 8.8, CWE-639): Kibana Fleet package installation failed to verify ownership of data stream identifiers, letting a user with delegated Fleet package-management privileges hijack another tenant's data stream.
    • The hijack redirects ingested data through attacker-controlled infrastructure, exposing it to disclosure and modification; interception can persist even after the malicious package is removed.
    • Other notable flaws: CVE-2026-103007 (7.2) delegated role-management privilege escalation, CVE-2026-103009 (7.1) cross-cluster index exposure via Remote Cluster Security 2.0, and eight denial-of-service bugs.
    • CVE-2026-102413 (6.2) crashes Elastic Endpoint on Windows with Chinese, Japanese, or Korean locales via crafted filenames, weakening malware protection; affected Kibana versions 8.14.0–8.19.21, 9.0.0–9.4.6, 9.5.0–9.5.3, fixed in 8.19.22, 9.4.7, 9.5.4.
    Sources 📄 Source: discuss.elastic.co · 📎 Coverage: securityonline.info · 👁 via Cyber Security News

  • Elastic patches 14 flaws across Elasticsearch, Kibana and Elastic Defend, incl. Fleet data interception CVE-2026-102406
    Elastic has released 14 security advisories fixing vulnerabilities in Elasticsearch, Kibana, and Elastic Agent/Endpoint, including a high-severity Kibana Fleet flaw enabling cross-tenant data interception.

    • Applies to organizations running Elasticsearch, Kibana, and Elastic Agent/Endpoint, both self-managed and Elastic Cloud Hosted deployments.
    • CVE-2026-102406 (CVSS 8.8, CWE-639): Kibana Fleet package installer fails to verify ownership, letting users with custom package rights claim another tenant's data stream and redirect ingested data through attacker-controlled infrastructure; interception can persist after the malicious package is removed.
    • Affected Kibana versions: 8.14.0–8.19.21, 9.0.0–9.4.6, 9.5.0–9.5.3; fixed in 8.19.22, 9.4.7, 9.5.4; Elasticsearch fixes in 8.19.23, 9.4.8, 9.5.5.
    • Other notable flaws: CVE-2026-103007 (7.2) delegated role-management privilege escalation, CVE-2026-103009 (7.1) cross-cluster search authorization bypass via Remote Cluster Security 2.0 transport interface, and DoS bugs CVE-2026-103008/CVE-2026-102404 (6.5).
    • CVE-2026-102413 (6.2) can crash Elastic Defend on Windows hosts with Chinese, Japanese, or Korean locales, weakening malware protection; no exploitation in the wild confirmed.
    Sources 📄 Source: discuss.elastic.co · 📎 Coverage: securityonline.info · 👁 via cryptika.com (discovered)

🔓 CVEs & KEV

  • CVE-2026-76268 — Splunk Enterprise — CVSS 9.8 — Splunk Patches Critical 9.8 Flaw Allowing Unauthenticated Remote Command Execution

Need help assessing your exposure?

Start with the free Posture Self-Check to see where you stand against the current threat landscape.

Free Posture Self-Check