TIA · HYDRA
Cyber Signal
A daily cut from public sources. You don't subscribe to it. It just gets published.
No account. No email address. No tracking.
A daily cut from public sources. You don't subscribe to it. It just gets published.
No account. No email address. No tracking.
no item today reports exploitation in practice
records parsed from the source feeds — before the time window and de-duplication
The digest hands us counts, not the discarded items — so this shows how many and why, not which.
July brought 4,084 new advisories for malicious npm packages. Other months run around 731 — July is a spike, not a trend.
All 8,189 of them, across seven months, are rated critical. Not one carries a computed CVSS score — there is nothing to score in a malicious package. It is not a flaw in the code, it is intent. Triage them by severity and every one is a tie.
But reach is distributed extremely unevenly. Of the 354 packages we could resolve, 67% have no dependents at all — their reach is zero. Among the rest the median multiplier is 1.95×, and 7% multiply thirtyfold or more. Highest measured case: engine.io has 118 direct dependents and reaches 15,865 through the tree. An average severity cannot see that spread at all.
Dependencies: a deps.dev v3alpha dependentCount measurement, SINGLE provider, no cross-check, window 2026-07. The package version is picked by a rule frozen BEFORE the run and BLIND to the measured value — the earlier method took the maximum across six versions, i.e. selected on the quantity it was meant to measure, and overstated the tail twofold. Amplification is undefined for packages with no dependents; those are reported separately as zero reach, not as a missing value. And advisories capture a fraction of malicious packages — this is the advisory denominator, not the malware denominator.
Six collection days, 82 published items. The previous edition ended at consoles — the tools used to manage other people's networks. This week moves the question one floor up: what happens when the tool stops waiting to be told. In three documented cases, that stopped being hypothetical.
Three consecutive days carried the same message from different directions: the model as an acting party. Once as a tool in an attacker's hand, once as the author of malicious code, once as the one that crossed a system boundary on its own. The last case is the most uncomfortable, because there was no attacker — there was a mistaken domain and a model that did not notice the target was not a test.
That changes the question a company has to ask. It used to be „who got in“. Now it is „what acted here, and what can evidence it“. The Spanish filing shows regulators are beginning to ask it too — and that „we have logs“ is not an answer when the logs are kept by the party asking itself.
Three of the cases above are single-party claims: two self-disclosures by model providers and one security-vendor report. We verified none of them independently, and public sources do not allow it. The item count is a count of what cleared our threshold — not a measure of how much happened. Five of six days hit the daily publication cap, so the published figure is a ceiling, not a volume.
Six days, six pages. Held items stay in the record.
Attention classes are how much attention we gave an item. They are not severity verdicts.
Researchers escaped OpenAI's Codex sandbox two ways, one running commands on a developer's machine from its most locked-down…
Designer-RSI: Evolving Procedural Memory from User Traffic for Agentic Graphic Design: Professional graphic design is a…
APort Vault: Benchmarking AI Agent Payment Authorization with the Open Agent Passport: APort Vault is a benchmark for…
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses…