Supply Chain · Watch Monday · 21 September 2026 End-of-day synthesis 4 watches · 11 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A fake LastPass installer, a $10.71M North Korean crypto campaign, and a runtime-evasive npm dropper all point the same direction: developer trust is this week's attack surface.

The indexed-btree runtime-evasion campaign from yesterday remains the day's biggest single threat and holds its critical rating. Three new developer-targeting campaigns landed on top of it, all exploiting the same trust surface: the tools engineers install without a second thought.

SentinelOne ties Jade Sleet to a fresh IT-provider breach via FLATROOF and ROOFDECK, a joint advisory pins the Contagious Interview cluster to 30,000 compromised devices and $10.71M in stolen crypto, and a fake LastPass Authenticator installer on GitHub uses a Microsoft-signed kernel driver to blind AV and EDR before dropping a stealer — the same GitHub-as-dropper TTP flagged in yesterday's writeup. Separately, nginx-ignition picked up three disclosures in one batch: an unauthenticated admin-creation race, a ~75x CPU-amplification bug in its Accept-Language parsing, and TOTP reuse. CISA also added a Zyxel GS1900 switch buffer overflow to KEV today, an unauthenticated LAN-based OS-command flaw with a 72-hour remediation clock. The bright spot: every new disclosure today — nginx-ignition's three bugs and the carried-over Hatchet OAuth CSRF — already ships a patched version, so tonight is a patching problem, not a research gap.

→ Operational priority for the night patch nginx-ignition past the fix commit if you self-host it, remediate the Zyxel GS1900 KEV entry before its September 24 due date, and add indexed-btree and the fake LastPass installer's driver hash to EDR blocklists before end of day.

18:00 ET · First Watch

Critical · CISA KEV ·added 18:00 ET

Zyxel GS1900 series switches: unauthenticated LAN-based stack buffer overflow added to KEV

CISA added a stack-based buffer overflow in the Zyxel GS1900 switch CGI web admin to KEV today, letting a LAN-based unauthenticated attacker run OS commands via a crafted HTTP request. These switches sit at the network edge in a lot of branch and lab deployments, and KEV adds carry a short remediation clock regardless of CVSS. Patch or take the management interface off any reachable network before the September 24 due date.

High · GitHub Security Advisories ·added 18:00 ET

nginx-ignition: unauthenticated admin account creation via onboarding race condition

nginx-ignition's onboarding-finish endpoint checks whether setup is already complete and then creates an admin user with no lock or transaction between the two steps, so concurrent unauthenticated requests during the setup window can mint an attacker-controlled admin account alongside the operator's own. Any fresh or reset instance reachable during onboarding is exposed to full admin takeover, and multiple attacker accounts can be minted in a single burst for persistence. Upgrade past the fix commit, and never expose a freshly-deployed instance to the network before onboarding completes.

High · GitHub Security Advisories ·added 18:00 ET

nginx-ignition: Accept-Language '_' separator bypass drives ~75x CPU amplification

nginx-ignition's i18n middleware runs golang.org/x/text's Accept-Language parser on every request without a size filter, and swapping the underscores for the hyphens that trip the existing CVE-2022-32149 guard drives the parser into its O(N²) path — a single 1MiB header burns ~2.4s of CPU, and ten concurrent requests can pin a ten-core box. It's unauthenticated and runs before route resolution, so even 404s pay the cost. Patch to the fixed version, or add a WAF rule capping Accept-Language length until you do.

High · The Hacker News ·added 18:00 ET

Fake LastPass Authenticator installer abuses a Microsoft-signed driver to kill AV and EDR before dropping a stealer

A fake LastPass Authenticator installer hosted on GitHub installs a Microsoft-signed kernel driver that disables AV and EDR before dropping a password stealer, and the driver cleared VirusTotal with zero detections at time of research. Same TTP shape flagged in this week's indexed-btree writeup: GitHub's implicit trust as a distribution channel keeps getting used as the dropper. Block the known driver hash in EDR, and treat any 'security tool installer' sourced from a GitHub repo rather than the vendor's own site as suspect by default.

High · The Hacker News ·added 18:00 ET

Contagious Interview campaign tied to 30,000 compromised devices and $10.71M in stolen crypto

A joint advisory ties North Korea's Contagious Interview cluster to 30,000 compromised devices across 100+ countries and $10.71M drained from over 7,000 crypto wallets, run through the same fake-job-interview lure that has previously delivered malicious npm and PyPI packages to developers. It's the same actor family as today's Jade Sleet item — this is a scale update on an ongoing campaign, not a new vector. Keep flagging unsolicited coding-test repos and job-offer packages as hostile, and check crypto-adjacent engineers' machines against the campaign's published IOCs.

Medium · GitHub Security Advisories ·added 18:00 ET

nginx-ignition: TOTP reuse during validity window

nginx-ignition's 2FA doesn't track used TOTP codes within their 30-second validity window, so a captured or shoulder-surfed code can be replayed for the rest of that window. It's a second-factor weakening rather than a bypass, and needs traffic capture or phishing to exploit. Patch when convenient; if you rolled your own TOTP verification elsewhere, check it maintains a used-code deny-list too.

Medium · GitHub Security Advisories ·added 18:00 ET

k8saudit shipped rules miss privileged init/ephemeral containers

Falco's k8saudit ruleset only ever inspected spec.containers for privileged/sensitive settings, so a privileged container declared as an initContainer or ephemeralContainer slipped past the default Create Privileged Pod rule entirely — the same trick works against custom image allowlists. It's a detection gap, not a new privilege escalation, and needs pod-create access to exploit. Upgrade k8saudit (and the cloud variants) to the June releases, and re-check any custom rules built on the old field names.

Context · The Hacker News ·added 18:00 ET

TASK#STOMP: new PowerShell backdoor harvests documents, Wi-Fi passwords, and clipboard data

TASK#STOMP is a new PowerShell backdoor that harvests documents, Wi-Fi passwords, and clipboard data, then exfiltrates them out. No disclosed delivery-via-package-registry vector yet, so this is a threat-actor watch item rather than a confirmed supply-chain attack. Worth knowing if you're hunting for PowerShell-based exfil behavior on endpoints.

12:00 ET · Forenoon Watch

Critical · BleepingComputer ·added 12:00 ET

Malicious npm package 'indexed-btree' hides its loader in a prototype method to dodge install-script scanners

The npm package 'indexed-btree' impersonates the legitimate sorted-btree library and has racked up 2M weekly downloads while hiding its loader inside BTree.prototype.set() instead of an install script, so it only fires at runtime when the app calls set() with the key 100. That's a direct end-run around npm v12's install-script approval gate — static and install-time scanners see a clean package, and the payload polls an Ethereum Sepolia smart contract for C2 instructions over X25519/AES, a channel that's hard to block by IP or take down. Audit dependency trees for indexed-btree, diff any btree-flavored package against real sorted-btree source, and treat 'no postinstall hook' as insufficient signal — runtime behavioral scanning needs to be in the CI gate too.

High · GitHub Security Advisories ·added 12:00 ET

Hatchet OAuth login-CSRF lets an attacker bind a victim's session to an attacker-controlled identity

Hatchet's OAuth callback handler clears session state to an empty string instead of deleting the key, so a later callback request with state="" satisfies the equality check and lets an unauthenticated attacker bind an already-authenticated victim's session to an attacker-controlled Google, GitHub, or Slack identity. Any deployment with one of those integrations enabled is exposed to login-CSRF account takeover, and the bug has been present through v0.86.26 and earlier. Patch to 0.91.1+, and grep your own OAuth callback handlers for the same empty-string-instead-of-delete pattern — it's an easy one to have copied.

06:00 ET · Morning Watch

Context · The Hacker News ·added 06:00 ET

SentinelOne ties Jade Sleet to an India-based IT provider breach via FLATROOF and ROOFDECK backdoors

SentinelOne attributes a breach at a small India-based IT services firm to North Korea's Jade Sleet, delivered via two new backdoors — FLATROOF and ROOFDECK — with Apple-platform tooling in the mix. Jade Sleet is the same actor whose fake job-interview lures have previously delivered malicious npm and PyPI packages to developers, so file this as a threat-actor update rather than a new registry compromise. No package attack is confirmed in this incident — treat unsolicited coding-test repos or job-offer packages as hostile regardless of platform.