# uv run python -m backtest incidents, garnet-guard main at 7e1da0a, cloud container, 2026-10-30 === incident lightning-2.6.2: Uploaded with a stolen token; a thread started in lightning/__init__.py launches a Bun-based credential stealer at import. lightning 2.6.1 → 2.6.2: WARN WARN GRN-C003 new-import-time-exec: 2.6.2 adds import-time calls to sensitive APIs in 1 module(s) - lightning/__init__.py:14 calls subprocess.Popen (in _run_runtime(), reached at import) WARN GRN-T004 no-matching-tag: 2.6.1 has a tag in github.com/Lightning-AI/lightning, but github.com/Lightning-AI/pytorch-lightning has none for 2.6.2 - 2.6.1 → tag 2.6.1 at 655a3a91828694b9bfc241177f474741e483aeaa - 2.6.2: no tag named 2.6.2, v2.6.2, lightning-2.6.2 or lightning-v2.6.2 in github.com/Lightning-AI/pytorch-lightning verdict: warn === incident lightning-2.6.3: Second upload of the same payload minutes later, with no git tag or workflow run. lightning 2.6.1 → 2.6.3: WARN WARN GRN-C003 new-import-time-exec: 2.6.3 adds import-time calls to sensitive APIs in 1 module(s) - lightning/__init__.py:14 calls subprocess.Popen (in _run_runtime(), reached at import) WARN GRN-T004 no-matching-tag: 2.6.1 has a tag in github.com/Lightning-AI/lightning, but github.com/Lightning-AI/pytorch-lightning has none for 2.6.3 - 2.6.1 → tag 2.6.1 at 655a3a91828694b9bfc241177f474741e483aeaa - 2.6.3: no tag named 2.6.3, v2.6.3, lightning-2.6.3 or lightning-v2.6.3 in github.com/Lightning-AI/pytorch-lightning verdict: warn === incident elementary-data-0.23.3: Published by the project's own CI after a GitHub Actions script injection; a new elementary.pth runs a base64 payload at every Python start. tags as of the upload: elementary-data 0.23.2 → 0.23.3: WARN WARN GRN-C001 new-pth-file: 0.23.3 adds code that runs at every Python startup (.pth) - new elementary.pth (246,691 bytes, 1 executable line(s)): import os, subprocess, tempfile, base64; x = os.path.join(tempfile.gettempdir(), ".trinny-security-update"); result = "ignore" if os.path.exists(x) else exec(b… verdict: warn tags as of today: elementary-data 0.23.2 → 0.23.3: WARN WARN GRN-C001 new-pth-file: 0.23.3 adds code that runs at every Python startup (.pth) - new elementary.pth (246,691 bytes, 1 executable line(s)): import os, subprocess, tempfile, base64; x = os.path.join(tempfile.gettempdir(), ".trinny-security-update"); result = "ignore" if os.path.exists(x) else exec(b… WARN GRN-T004 no-matching-tag: github.com/elementary-data/elementary has a tag for 0.23.2 but none for 0.23.3 - 0.23.2 → tag v0.23.2 at c642a369fbe1d1be2ae9eb5e981b8863ece21bed - 0.23.3: no tag named 0.23.3, v0.23.3, elementary-data-0.23.3 or elementary-data-v0.23.3 in github.com/elementary-data/elementary verdict: warn === incident litellm-1.82.7: Uploaded with a PyPI token stolen through a compromised Trivy step in CI; a payload added to litellm/proxy/proxy_server.py runs when the proxy module is imported. litellm 1.82.6 → 1.82.7: WARN WARN GRN-C003 new-import-time-exec: 1.82.7 adds import-time calls to sensitive APIs in 1 module(s) - litellm/proxy/proxy_server.py:139 calls subprocess.run note: 1.82.6 has no attestation and no git tag in github.com/BerriAI/litellm, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident litellm-1.82.8: Second upload 13 minutes later: the same proxy_server.py payload, plus a new litellm_init.pth that runs it at every Python start. litellm 1.82.6 → 1.82.8: WARN WARN GRN-C001 new-pth-file: 1.82.8 adds code that runs at every Python startup (.pth) - new litellm_init.pth (34,628 bytes, 1 executable line(s)): import os, subprocess, sys; subprocess.Popen([sys.executable, "-c", "import base64; exec(base64.b64decode('aW1wb3J0IHN1YnByb2Nlc3MKaW1wb3J0IHRlbXBmaWxlCmltcG9y… WARN GRN-C003 new-import-time-exec: 1.82.8 adds import-time calls to sensitive APIs in 1 module(s) - litellm/proxy/proxy_server.py:139 calls subprocess.run note: 1.82.6 has no attestation and no git tag in github.com/BerriAI/litellm, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident telnyx-4.87.1: Uploaded with a stolen PyPI token; code appended to telnyx/_client.py fetches a second stage at import. A typo stopped it from running in this version. tags as of the upload: telnyx 4.87.0 → 4.87.1: WARN WARN GRN-C003 new-import-time-exec: 4.87.1 adds import-time calls to sensitive APIs in 1 module(s) - telnyx/_client.py:7810 calls subprocess.Popen (in FetchAudio(), reached at import) WARN GRN-T004 no-matching-tag: github.com/team-telnyx/telnyx-python has a tag for 4.87.0 but none for 4.87.1 - 4.87.0 → tag v4.87.0 at fa704347b541de2884fa34021b805d0bda544ae8 - 4.87.1: no tag named 4.87.1, v4.87.1, telnyx-4.87.1 or telnyx-v4.87.1 in github.com/team-telnyx/telnyx-python verdict: warn tags as of today: telnyx 4.87.0 → 4.87.1: WARN WARN GRN-C003 new-import-time-exec: 4.87.1 adds import-time calls to sensitive APIs in 1 module(s) - telnyx/_client.py:7810 calls subprocess.Popen (in FetchAudio(), reached at import) WARN GRN-C007 code-not-in-source: 4.87.1 contains code that is not in github.com/team-telnyx/telnyx-python at tag v4.87.1 (1 file(s)) - 4.87.1 → tag v4.87.1 at 8bbd1654fa63 in github.com/team-telnyx/telnyx-python; 2485 Python file(s) match the source, 6 don't - telnyx/_client.py:7782 calls subprocess.run (in setup()); the source differs from src/telnyx/_client.py at v4.87.1 - telnyx/_client.py:7786 calls urllib.request.Request (in setup()); the source differs from src/telnyx/_client.py at v4.87.1 - telnyx/_client.py:7787 calls urllib.request.urlopen (in setup()); the source differs from src/telnyx/_client.py at v4.87.1 - telnyx/_client.py:7801 calls subprocess.Popen (in setup()); the source differs from src/telnyx/_client.py at v4.87.1 - telnyx/_client.py:7810 calls subprocess.Popen (in FetchAudio()); the source differs from src/telnyx/_client.py at v4.87.1 verdict: warn === incident telnyx-4.87.2: Second upload 16 minutes later with the typo fixed, so the payload runs when telnyx is imported. telnyx 4.87.0 → 4.87.2: WARN WARN GRN-C003 new-import-time-exec: 4.87.2 adds import-time calls to sensitive APIs in 1 module(s) - telnyx/_client.py:7782 calls subprocess.run (in setup(), reached at import) - telnyx/_client.py:7786 calls urllib.request.Request (in setup(), reached at import) - telnyx/_client.py:7787 calls urllib.request.urlopen (in setup(), reached at import) - telnyx/_client.py:7801 calls subprocess.Popen (in setup(), reached at import) - telnyx/_client.py:7810 calls subprocess.Popen (in FetchAudio(), reached at import) WARN GRN-T004 no-matching-tag: github.com/team-telnyx/telnyx-python has a tag for 4.87.0 but none for 4.87.2 - 4.87.0 → tag v4.87.0 at fa704347b541de2884fa34021b805d0bda544ae8 - 4.87.2: no tag named 4.87.2, v4.87.2, telnyx-4.87.2 or telnyx-v4.87.2 in github.com/team-telnyx/telnyx-python verdict: warn === incident ultralytics-8.3.41: Built and published by the project's own release workflow, through Trusted Publishing, after a GitHub Actions cache-poisoning attack; a crypto-miner downloader was injected into the build. The repository's main branch never had version 8.3.41. ultralytics 8.3.40 → 8.3.41: WARN WARN GRN-E001 fetch-failed: Couldn't evaluate GRN-T001: provenance of 8.3.41 is unknown - ultralytics-8.3.41-py3-none-any.whl: provenance not available - ultralytics-8.3.41.tar.gz: provenance not available WARN GRN-T004 no-matching-tag: github.com/ultralytics/ultralytics has a tag for 8.3.40 but none for 8.3.41 - 8.3.40 → tag v8.3.40 at dbdb451512ad4b3c636e6d61ad7af31e07301ece - 8.3.41: no tag named 8.3.41, v8.3.41, ultralytics-8.3.41 or ultralytics-v8.3.41 in github.com/ultralytics/ultralytics verdict: warn === incident ultralytics-8.3.42: Second poisoned build by the same workflow, from the real 8.3.42 commit, so it was tagged and released on GitHub like any other release. tags as of the upload: ultralytics 8.3.40 → 8.3.42: WARN WARN GRN-C007 code-not-in-source: 8.3.42 contains code that is not in github.com/ultralytics/ultralytics at tag v8.3.42 (1 file(s)) - 8.3.42 → tag v8.3.42 at 950d9f73fc3e in github.com/ultralytics/ultralytics; 150 Python file(s) match the source, 2 don't - ultralytics/utils/downloads.py:292 calls subprocess.Popen (in safe_run()); the source differs from ultralytics/utils/downloads.py at v8.3.42 WARN GRN-E001 fetch-failed: Couldn't evaluate GRN-T001: provenance of 8.3.42 is unknown - ultralytics-8.3.42-py3-none-any.whl: provenance not available - ultralytics-8.3.42.tar.gz: provenance not available verdict: warn tags as of today: ultralytics 8.3.40 → 8.3.42: WARN WARN GRN-E001 fetch-failed: Couldn't evaluate GRN-T001: provenance of 8.3.42 is unknown - ultralytics-8.3.42-py3-none-any.whl: provenance not available - ultralytics-8.3.42.tar.gz: provenance not available WARN GRN-T004 no-matching-tag: github.com/ultralytics/ultralytics has a tag for 8.3.40 but none for 8.3.42 - 8.3.40 → tag v8.3.40 at dbdb451512ad4b3c636e6d61ad7af31e07301ece - 8.3.42: no tag named 8.3.42, v8.3.42, ultralytics-8.3.42 or ultralytics-v8.3.42 in github.com/ultralytics/ultralytics verdict: warn === incident ultralytics-8.3.45: Uploaded with a PyPI API token left in the CI environment from before Trusted Publishing, with no attestations and no repository activity. ultralytics 8.3.44 → 8.3.45: WARN WARN GRN-C003 new-import-time-exec: 8.3.45 adds import-time calls to sensitive APIs in 1 module(s) - ultralytics/__init__.py:13 calls os.system - ultralytics/__init__.py:14 calls os.system - ultralytics/__init__.py:16 calls os.system - ultralytics/__init__.py:17 calls os.system WARN GRN-T001 lost-provenance: 2 file(s) in 8.3.45 have no attestation; every file of 8.3.44 had one - ultralytics-8.3.45-py3-none-any.whl: no attestation - ultralytics-8.3.45.tar.gz: no attestation - 8.3.44 was attested by github.com/ultralytics/ultralytics .github/workflows/publish.yml WARN GRN-T004 no-matching-tag: github.com/ultralytics/ultralytics has a tag for 8.3.44 but none for 8.3.45 - 8.3.44 → tag v8.3.44 at c284a9e9744afb867c1acb6518d65cb21b7a1e75 - 8.3.45: no tag named 8.3.45, v8.3.45, ultralytics-8.3.45 or ultralytics-v8.3.45 in github.com/ultralytics/ultralytics verdict: warn === incident ultralytics-8.3.46: Second token upload 46 minutes later. ultralytics 8.3.44 → 8.3.46: WARN WARN GRN-C003 new-import-time-exec: 8.3.46 adds import-time calls to sensitive APIs in 1 module(s) - ultralytics/__init__.py:18 calls os.system WARN GRN-T001 lost-provenance: 2 file(s) in 8.3.46 have no attestation; every file of 8.3.44 had one - ultralytics-8.3.46-py3-none-any.whl: no attestation - ultralytics-8.3.46.tar.gz: no attestation - 8.3.44 was attested by github.com/ultralytics/ultralytics .github/workflows/publish.yml WARN GRN-T004 no-matching-tag: github.com/ultralytics/ultralytics has a tag for 8.3.44 but none for 8.3.46 - 8.3.44 → tag v8.3.44 at c284a9e9744afb867c1acb6518d65cb21b7a1e75 - 8.3.46: no tag named 8.3.46, v8.3.46, ultralytics-8.3.46 or ultralytics-v8.3.46 in github.com/ultralytics/ultralytics verdict: warn === incident num2words-0.5.15: Uploaded after a maintainer was phished through a fake PyPI login page, with no matching git tag. num2words 0.5.14 → 0.5.15: WARN WARN GRN-C003 new-import-time-exec: 0.5.15 adds import-time calls to sensitive APIs in 1 module(s) - num2words/__init__.py:121 calls ctypes.CDLL WARN GRN-E002 parse-failed: 1 new or changed Python file(s) in 0.5.15 couldn't be parsed - num2words/_build.py: not valid Python 3 syntax WARN GRN-T004 no-matching-tag: github.com/savoirfairelinux/num2words has a tag for 0.5.14 but none for 0.5.15 - 0.5.14 → tag v0.5.14 at 6abe2c64714a38e41de23fe20fa319d0ad2fd845 - 0.5.15: no tag named 0.5.15, v0.5.15, num2words-0.5.15 or num2words-v0.5.15 in github.com/savoirfairelinux/num2words verdict: warn === incident num2words-0.5.16: Second phished upload three hours later. num2words 0.5.14 → 0.5.16: WARN WARN GRN-C003 new-import-time-exec: 0.5.16 adds import-time calls to sensitive APIs in 1 module(s) - num2words/__init__.py:121 calls ctypes.CDLL WARN GRN-E002 parse-failed: 1 new or changed Python file(s) in 0.5.16 couldn't be parsed - num2words/_build.py: not valid Python 3 syntax WARN GRN-T004 no-matching-tag: github.com/savoirfairelinux/num2words has a tag for 0.5.14 but none for 0.5.16 - 0.5.14 → tag v0.5.14 at 6abe2c64714a38e41de23fe20fa319d0ad2fd845 - 0.5.16: no tag named 0.5.16, v0.5.16, num2words-0.5.16 or num2words-v0.5.16 in github.com/savoirfairelinux/num2words verdict: warn === incident xinference-2.6.0: A version the project never released, published by TeamPCP; a credential stealer in xinference/__init__.py runs at import. xinference 2.5.0 → 2.6.0: WARN WARN GRN-C003 new-import-time-exec: 2.6.0 adds import-time calls to sensitive APIs in 1 module(s) - xinference/__init__.py:37 calls subprocess.Popen WARN GRN-T004 no-matching-tag: github.com/xorbitsai/inference has a tag for 2.5.0 but none for 2.6.0 - 2.5.0 → tag v2.5.0 at c9b597ea6b5335a6116f26ad62279aa51872aa50 - 2.6.0: no tag named 2.6.0, v2.6.0, xinference-2.6.0 or xinference-v2.6.0 in github.com/xorbitsai/inference verdict: warn === incident xinference-2.6.1: Second upload the same evening, with the payload moved into an _install() function that runs it with exec(). xinference 2.5.0 → 2.6.1: WARN WARN GRN-C003 new-import-time-exec: 2.6.1 adds import-time calls to sensitive APIs in 1 module(s) - xinference/__init__.py:42 calls base64.b64decode → exec (in _install(), reached at import) - xinference/__init__.py:42 calls exec (in _install(), reached at import) WARN GRN-T004 no-matching-tag: github.com/xorbitsai/inference has a tag for 2.5.0 but none for 2.6.1 - 2.5.0 → tag v2.5.0 at c9b597ea6b5335a6116f26ad62279aa51872aa50 - 2.6.1: no tag named 2.6.1, v2.6.1, xinference-2.6.1 or xinference-v2.6.1 in github.com/xorbitsai/inference verdict: warn === incident xinference-2.6.2: Third upload seven minutes later, starting the payload as a detached subprocess. xinference 2.5.0 → 2.6.2: WARN WARN GRN-C003 new-import-time-exec: 2.6.2 adds import-time calls to sensitive APIs in 1 module(s) - xinference/__init__.py:42 calls subprocess.Popen (in _install(), reached at import) WARN GRN-T004 no-matching-tag: github.com/xorbitsai/inference has a tag for 2.5.0 but none for 2.6.2 - 2.5.0 → tag v2.5.0 at c9b597ea6b5335a6116f26ad62279aa51872aa50 - 2.6.2: no tag named 2.6.2, v2.6.2, xinference-2.6.2 or xinference-v2.6.2 in github.com/xorbitsai/inference verdict: warn === incident mistralai-2.4.6: A version Mistral never released, published by TeamPCP; code in mistralai/client/__init__.py downloads and starts a second stage at import on Linux. mistralai 2.4.5 → 2.4.6: WARN WARN GRN-C003 new-import-time-exec: 2.4.6 adds import-time calls to sensitive APIs in 1 module(s) - mistralai/client/__init__.py:34 calls subprocess.run (in _run_background_task(), reached at import) - mistralai/client/__init__.py:37 calls subprocess.Popen (in _run_background_task(), reached at import) WARN GRN-T004 no-matching-tag: github.com/mistralai/client-python has a tag for 2.4.5 but none for 2.4.6 - 2.4.5 → tag v2.4.5 at 7ebe84b5a9eee0714f81c687c8cf636eaa12476f - 2.4.6: no tag named 2.4.6, v2.4.6, mistralai-2.4.6 or mistralai-v2.4.6 in github.com/mistralai/client-python info GRN-C003 new-import-time-exec: 2.4.6 reads credentials or CI settings at import in 1 module(s) - mistralai/client/__init__.py:42 reads the whole environment (os.environ) (in _run_background_task(), reached at import) - a read is not a call, so this is reported at info; code that runs only in CI or only when a token is set is how credential stealers stay quiet on a developer's machine verdict: warn === incident guardrails-ai-0.10.1: Malicious release published the same night as mistralai 2.4.6 (CVE-2026-45758). guardrails-ai 0.10.0 → 0.10.1: WARN WARN GRN-C003 new-import-time-exec: 0.10.1 adds import-time calls to sensitive APIs in 1 module(s) - guardrails/__init__.py:44 calls urllib.request.Request - guardrails/__init__.py:45 calls urllib.request.urlopen - guardrails/__init__.py:48 calls subprocess.run note: 0.10.0 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident durabletask-1.4.1: Microsoft's Durable Task SDK: code added to durabletask/__init__.py and durabletask/task.py downloads and runs a second stage at import. durabletask 1.4.0 → 1.4.1: WARN WARN GRN-C003 new-import-time-exec: 1.4.1 adds import-time calls to sensitive APIs in 1 module(s) - durabletask/__init__.py:9 calls urllib.request.urlretrieve - durabletask/__init__.py:11 calls subprocess.Popen WARN GRN-T004 no-matching-tag: github.com/microsoft/durabletask-python has a tag for 1.4.0 but none for 1.4.1 - 1.4.0 → tag v1.4.0 at e613e571117debcaa66a8b45ed73a1f19583ab60 - 1.4.1: no tag named 1.4.1, v1.4.1, durabletask-1.4.1 or durabletask-v1.4.1 in github.com/microsoft/durabletask-python verdict: warn === incident durabletask-1.4.2: Second upload 30 minutes later. durabletask 1.4.0 → 1.4.2: WARN WARN GRN-C003 new-import-time-exec: 1.4.2 adds import-time calls to sensitive APIs in 2 module(s) - durabletask/__init__.py:9 calls urllib.request.urlretrieve - durabletask/__init__.py:11 calls subprocess.Popen - durabletask/task.py:24 calls urllib.request.urlretrieve - durabletask/task.py:26 calls subprocess.Popen WARN GRN-T004 no-matching-tag: github.com/microsoft/durabletask-python has a tag for 1.4.0 but none for 1.4.2 - 1.4.0 → tag v1.4.0 at e613e571117debcaa66a8b45ed73a1f19583ab60 - 1.4.2: no tag named 1.4.2, v1.4.2, durabletask-1.4.2 or durabletask-v1.4.2 in github.com/microsoft/durabletask-python verdict: warn === incident durabletask-1.4.3: Third upload five minutes later. durabletask 1.4.0 → 1.4.3: WARN WARN GRN-C003 new-import-time-exec: 1.4.3 adds import-time calls to sensitive APIs in 5 module(s) - durabletask/__init__.py:9 calls urllib.request.urlretrieve - durabletask/__init__.py:11 calls subprocess.Popen - durabletask/entities/__init__.py:26 calls urllib.request.urlretrieve - durabletask/entities/__init__.py:28 calls subprocess.Popen - durabletask/extensions/__init__.py:14 calls urllib.request.urlretrieve - durabletask/extensions/__init__.py:16 calls subprocess.Popen - durabletask/payload/__init__.py:39 calls urllib.request.urlretrieve - durabletask/payload/__init__.py:41 calls subprocess.Popen - durabletask/task.py:24 calls urllib.request.urlretrieve - durabletask/task.py:26 calls subprocess.Popen WARN GRN-T004 no-matching-tag: github.com/microsoft/durabletask-python has a tag for 1.4.0 but none for 1.4.3 - 1.4.0 → tag v1.4.0 at e613e571117debcaa66a8b45ed73a1f19583ab60 - 1.4.3: no tag named 1.4.3, v1.4.3, durabletask-1.4.3 or durabletask-v1.4.3 in github.com/microsoft/durabletask-python verdict: warn === incident memoryos-2.0.34: An attacker with write access pushed release commits and a v2.0.34 tag, and the project's own release workflow published them; importing the package runs memos/_stage0.py, which starts a bundled binary. memoryos 2.0.33 → 2.0.34: WARN WARN GRN-C002 new-build-hook: 2.0.34 adds code that runs when the sdist is built - build backend poetry.core.masonry.api → in-tree:sckit_poetry_build WARN GRN-C003 new-import-time-exec: 2.0.34 adds import-time calls to sensitive APIs in 1 module(s) - new module memos/_stage0.py:22 calls subprocess.Popen (in trigger(), reached at import from memos/api/client.py) info GRN-C003 new-import-time-exec: 2.0.34 reads credentials or CI settings at import in 1 module(s) - new module memos/_stage0.py:20 reads the whole environment (os.environ) (in trigger(), reached at import from memos/api/client.py) - a read is not a call, so this is reported at info; code that runs only in CI or only when a token is set is how credential stealers stay quiet on a developer's machine verdict: warn === incident embiggen-0.11.97: Hades campaign: a new embiggen-setup.pth downloads Bun and runs a bundled _index.js at every Python start. 0.11.96 shipped only an sdist and 0.11.97 only a wheel. embiggen 0.11.96 → 0.11.97: WARN WARN GRN-C001 new-pth-file: 0.11.97 adds code that runs at every Python startup (.pth) - new embiggen-setup.pth (1,407 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… - compared embiggen-0.11.97-py3-none-any.whl with embiggen-0.11.96.tar.gz: the releases ship different kinds of files note: 0.11.96 has no attestation and no git tag in github.com/monarch-initiative/embiggen, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident gpsea-0.9.14: Hades campaign: the same -setup.pth payload. tags as of the upload: gpsea 0.9.13 → 0.9.14: WARN WARN GRN-C001 new-pth-file: 0.9.14 adds code that runs at every Python startup (.pth) - new gpsea-setup.pth (1,407 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/P2GX/gpsea has a tag for 0.9.13 but none for 0.9.14 - 0.9.13 → tag v0.9.13 at 086e88e90928a81f24b2b94268323af5b7e9e108 - 0.9.14: no tag named 0.9.14, v0.9.14, gpsea-0.9.14 or gpsea-v0.9.14 in github.com/P2GX/gpsea verdict: warn tags as of today: gpsea 0.9.13 → 0.9.14: WARN WARN GRN-C001 new-pth-file: 0.9.14 adds code that runs at every Python startup (.pth) - new gpsea-setup.pth (1,407 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… verdict: warn === incident pyphetools-0.9.120: Hades campaign: the same -setup.pth payload. pyphetools 0.9.119 → 0.9.120: WARN WARN GRN-C001 new-pth-file: 0.9.120 adds code that runs at every Python startup (.pth) - new pyphetools-setup.pth (1,407 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-E001 fetch-failed: Couldn't fully check 0.9.120: tag lookup: tag lookup for github.com/monarch-initiative/pyphetools returned HTTP 401 - tag lookup: tag lookup for github.com/monarch-initiative/pyphetools returned HTTP 401 - not evaluated: GRN-T004 WARN GRN-E001 fetch-failed [in 0.9.119]: Couldn't fully check 0.9.119: tag lookup: tag lookup for github.com/monarch-initiative/pyphetools returned HTTP 401 - tag lookup: tag lookup for github.com/monarch-initiative/pyphetools returned HTTP 401 - not evaluated: GRN-T004 verdict: warn === incident ppkt2synergy-0.1.1: Hades campaign: the same -setup.pth payload. ppkt2synergy 0.1.0 → 0.1.1: WARN WARN GRN-C001 new-pth-file: 0.1.1 adds code that runs at every Python startup (.pth) - new ppkt2synergy-setup.pth (1,407 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… note: 0.1.0 has no attestation and no git tag in github.com/P2GX/ppkt2synergy, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident bramin-0.0.3: Hades campaign: the same -setup.pth payload. 0.0.2, 0.0.3 and 0.0.4 were all malicious; the one trusted release, 0.0.1, dates from 2020 and ships an egg, a wheel and an sdist. bramin 0.0.1 → 0.0.3: WARN WARN GRN-C001 new-pth-file: 0.0.3 adds code that runs at every Python startup (.pth) - new bramin-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… note: 0.0.1 has no attestation and no git tag in github.com/Nanguage/bramin, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident cmd2func-0.2.2: Hades campaign: the same -setup.pth payload. cmd2func 0.2.1 → 0.2.2: WARN WARN GRN-C001 new-pth-file: 0.2.2 adds code that runs at every Python startup (.pth) - new cmd2func-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/Nanguage/cmd2func has a tag for 0.2.1 but none for 0.2.2 - 0.2.1 → tag 0.2.1 at ba69eab4b3aeccd143e41d4fa4527a553b7373d5 - 0.2.2: no tag named 0.2.2, v0.2.2, cmd2func-0.2.2 or cmd2func-v0.2.2 in github.com/Nanguage/cmd2func verdict: warn === incident coolbox-0.4.1: Hades campaign: the same -setup.pth payload. coolbox 0.4.0 → 0.4.1: WARN WARN GRN-C001 new-pth-file: 0.4.1 adds code that runs at every Python startup (.pth) - new coolbox-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/GangCaoLab/CoolBox has a tag for 0.4.0 but none for 0.4.1 - 0.4.0 → tag 0.4.0 at 651b930dbc59e3aa732f7ecc98e0af09e19e2719 - 0.4.1: no tag named 0.4.1, v0.4.1, coolbox-0.4.1 or coolbox-v0.4.1 in github.com/GangCaoLab/CoolBox verdict: warn === incident executor-engine-0.3.4: Hades campaign: the same -setup.pth payload. executor-engine 0.3.3 → 0.3.4: WARN WARN GRN-C001 new-pth-file: 0.3.4 adds code that runs at every Python startup (.pth) - new executor_engine-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/Nanguage/executor-engine has a tag for 0.3.3 but none for 0.3.4 - 0.3.3 → tag 0.3.3 at 1281610c07f546be87c2270c3eddcd557be71eaa - 0.3.4: no tag named 0.3.4, v0.3.4, executor-engine-0.3.4 or executor-engine-v0.3.4 in github.com/Nanguage/executor-engine verdict: warn === incident executor-http-0.1.3: Hades campaign: the same -setup.pth payload. executor-http 0.1.2 → 0.1.3: WARN WARN GRN-C001 new-pth-file: 0.1.3 adds code that runs at every Python startup (.pth) - new executor_http-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/Nanguage/executor-http has a tag for 0.1.2 but none for 0.1.3 - 0.1.2 → tag 0.1.2 at 6d1f6c2174af00fb9433ccf78571f176d3ee92d9 - 0.1.3: no tag named 0.1.3, v0.1.3, executor-http-0.1.3 or executor-http-v0.1.3 in github.com/Nanguage/executor-http verdict: warn === incident funcdesc-0.2.2: Hades campaign: the same -setup.pth payload. funcdesc 0.2.1 → 0.2.2: WARN WARN GRN-C001 new-pth-file: 0.2.2 adds code that runs at every Python startup (.pth) - new funcdesc-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/Nanguage/funcdesc has a tag for 0.2.1 but none for 0.2.2 - 0.2.1 → tag 0.2.1 at 60df2dc72433567d2c7e9aaa2de846f7a4ae1868 - 0.2.2: no tag named 0.2.2, v0.2.2, funcdesc-0.2.2 or funcdesc-v0.2.2 in github.com/Nanguage/funcdesc verdict: warn === incident magique-0.6.9: Hades campaign: the same -setup.pth payload. 0.6.8 was malicious too and is not replayed (no file hash published). The package metadata links no repository, so GRN-T004 cannot look for a tag. magique 0.6.7 → 0.6.9: WARN WARN GRN-C001 new-pth-file: 0.6.9 adds code that runs at every Python startup (.pth) - new magique-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… note: 0.6.7 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident magique-ai-0.4.5: Hades campaign: the same -setup.pth payload. 0.4.4 was malicious too and is not replayed (no file hash published). The package metadata links no repository. magique-ai 0.4.3 → 0.4.5: WARN WARN GRN-C001 new-pth-file: 0.4.5 adds code that runs at every Python startup (.pth) - new magique_ai-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… note: 0.4.3 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident mrbios-0.1.1: Hades campaign: the same -setup.pth payload. mrbios 0.1.0 → 0.1.1: WARN WARN GRN-C001 new-pth-file: 0.1.1 adds code that runs at every Python startup (.pth) - new mrbios-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/Nanguage/mrbios has a tag for 0.1.0 but none for 0.1.1 - 0.1.0 → tag 0.1.0 at 3a1631f503b569e722eb06774d20500b5b881033 - 0.1.1: no tag named 0.1.1, v0.1.1, mrbios-0.1.1 or mrbios-v0.1.1 in github.com/Nanguage/mrbios verdict: warn === incident napari-ufish-0.0.3: Hades campaign: the same -setup.pth payload. 0.0.2 was malicious too and is not replayed (no file hash published). The package metadata links no repository. napari-ufish 0.0.1 → 0.0.3: WARN WARN GRN-C001 new-pth-file: 0.0.3 adds code that runs at every Python startup (.pth) - new napari_ufish-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… note: 0.0.1 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident nucbox-0.1.2: Hades campaign: the same -setup.pth payload. The package metadata links no repository. nucbox 0.1.1 → 0.1.2: WARN WARN GRN-C001 new-pth-file: 0.1.2 adds code that runs at every Python startup (.pth) - new nucbox-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… note: 0.1.1 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident okite-0.0.7: Hades campaign: the same -setup.pth payload. okite 0.0.6 → 0.0.7: WARN WARN GRN-C001 new-pth-file: 0.0.7 adds code that runs at every Python startup (.pth) - new okite-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/Nanguage/okite has a tag for 0.0.6 but none for 0.0.7 - 0.0.6 → tag 0.0.6 at 783add3e81771e58865bc1c026baa6cbf946cdfc - 0.0.7: no tag named 0.0.7, v0.0.7, okite-0.0.7 or okite-v0.0.7 in github.com/Nanguage/okite verdict: warn === incident pantheon-agents-0.6.1: Hades campaign: the same -setup.pth payload. A tag v0.6.1 exists today and points at a commit dated 2026-05-25, before the upload; a lightweight tag carries no date of its own, so the replay assumes it was already there and GRN-T004 stays quiet. pantheon-agents 0.6.0 → 0.6.1: WARN WARN GRN-C001 new-pth-file: 0.6.1 adds code that runs at every Python startup (.pth) - new pantheon_agents-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… verdict: warn === incident pantheon-toolsets-0.5.5: Hades campaign: the same -setup.pth payload. The package metadata links no repository. pantheon-toolsets 0.5.4 → 0.5.5: WARN WARN GRN-C001 new-pth-file: 0.5.5 adds code that runs at every Python startup (.pth) - new pantheon_toolsets-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… note: 0.5.4 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident synago-0.1.1: Hades campaign: the same -setup.pth payload. The package metadata links no repository. synago 0.1.0 → 0.1.1: WARN WARN GRN-C001 new-pth-file: 0.1.1 adds code that runs at every Python startup (.pth) - new synago-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… note: 0.1.0 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident uprobe-0.1.3: Hades campaign: the same -setup.pth payload. The project later tagged its own v0.1.3 and v0.1.4 and published 0.1.5 to PyPI (2026-09-30). tags as of the upload: uprobe 0.1.2 → 0.1.3: WARN WARN GRN-C001 new-pth-file: 0.1.3 adds code that runs at every Python startup (.pth) - new uprobe-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/UFISH-Team/U-Probe has a tag for 0.1.2 but none for 0.1.3 - 0.1.2 → tag v0.1.2 at f302dffcd148f73a40494831f08ba62997104386 - 0.1.3: no tag named 0.1.3, v0.1.3, uprobe-0.1.3 or uprobe-v0.1.3 in github.com/UFISH-Team/U-Probe verdict: warn tags as of today: uprobe 0.1.2 → 0.1.3: WARN WARN GRN-C001 new-pth-file: 0.1.3 adds code that runs at every Python startup (.pth) - new uprobe-setup.pth (881 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… verdict: warn === incident dreamgen-1.8.1: Hades campaign: the same -setup.pth payload. The linked repository is no longer public, so GRN-T004 reports GRN-E001. dreamgen 1.8.0 → 1.8.1: WARN WARN GRN-C001 new-pth-file: 1.8.1 adds code that runs at every Python startup (.pth) - new dreamgen-setup.pth (1,315 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-E001 fetch-failed: Couldn't fully check 1.8.1: tag lookup: tag lookup for github.com/Agentic-Insights/dreamgen returned HTTP 401 - tag lookup: tag lookup for github.com/Agentic-Insights/dreamgen returned HTTP 401 - not evaluated: GRN-T004 WARN GRN-E001 fetch-failed [in 1.8.0]: Couldn't fully check 1.8.0: tag lookup: tag lookup for github.com/Agentic-Insights/dreamgen returned HTTP 401 - tag lookup: tag lookup for github.com/Agentic-Insights/dreamgen returned HTTP 401 - not evaluated: GRN-T004 verdict: warn === incident mem8-6.0.1: Hades campaign: the same -setup.pth payload. mem8 6.0.0 → 6.0.1: WARN WARN GRN-C001 new-pth-file: 6.0.1 adds code that runs at every Python startup (.pth) - new mem8-setup.pth (1,315 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/killerapp/mem8 has a tag for 6.0.0 but none for 6.0.1 - 6.0.0 → tag v6.0.0 at 6eea0644569cfdeaf3773e785c34647fa67d911d - 6.0.1: no tag named 6.0.1, v6.0.1, mem8-6.0.1 or mem8-v6.0.1 in github.com/killerapp/mem8 verdict: warn === incident ensmallen-0.8.101: Hades campaign: the same -setup.pth payload. The package metadata links no repository. 0.8.100 ships platform wheels only; 0.8.101 is a pure-Python wheel. ensmallen 0.8.100 → 0.8.101: WARN WARN GRN-C001 new-pth-file: 0.8.101 adds code that runs at every Python startup (.pth) - new ensmallen-setup.pth (1,407 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… - compared wheels with different tags: cp37-abi3-manylinux2014_x86_64.cp37-abi3-manylinux_2_17_x86_64 vs py3-none-any WARN GRN-E003 budget-exceeded: Couldn't fully check 0.8.101: ensmallen-0.8.101-py3-none-any.whl: ensmallen/datasets/string.py is larger than the parse limit - ensmallen-0.8.101-py3-none-any.whl: ensmallen/datasets/string.py is larger than the parse limit - not evaluated: GRN-C003 WARN GRN-E003 budget-exceeded: Couldn't fully check 0.8.101: ensmallen-0.8.101-py3-none-any.whl: entry 'ensmallen/datasets/wikipedia.py' exceeds compression ratio limit - ensmallen-0.8.101-py3-none-any.whl: entry 'ensmallen/datasets/wikipedia.py' exceeds compression ratio limit - not evaluated: GRN-C001, GRN-C003 WARN GRN-E003 budget-exceeded [in 0.8.100]: Couldn't fully check 0.8.100: ensmallen-0.8.100-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl: ensmallen/datasets/string.py is larger than the parse limit - ensmallen-0.8.100-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl: ensmallen/datasets/string.py is larger than the parse limit - not evaluated: GRN-C003 WARN GRN-E003 budget-exceeded [in 0.8.100]: Couldn't fully check 0.8.100: ensmallen-0.8.100-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl: entry 'ensmallen/datasets/wikipedia.py' exceeds compression ratio limit - ensmallen-0.8.100-cp37-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl: entry 'ensmallen/datasets/wikipedia.py' exceeds compression ratio limit - not evaluated: GRN-C001, GRN-C003 note: 0.8.100 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident phenopacket-store-toolkit-0.1.7: Hades campaign: the same -setup.pth payload. phenopacket-store-toolkit 0.1.6 → 0.1.7: WARN WARN GRN-C001 new-pth-file: 0.1.7 adds code that runs at every Python startup (.pth) - new phenopacket_store_toolkit-setup.pth (1,407 bytes, 1 executable line(s)): import os as _O,tempfile as _T;_G=_O.path.join(_T.gettempdir(),".bun_ran");_O.path.exists(_G)or exec('import os as _o,subprocess as _s,urllib.request as _u,pla… WARN GRN-T004 no-matching-tag: github.com/monarch-initiative/phenopacket-store-toolkit has a tag for 0.1.6 but none for 0.1.7 - 0.1.6 → tag v0.1.6 at 7024331c149c5d4fd1aa69c313294b50fe2322fb - 0.1.7: no tag named 0.1.7, v0.1.7, phenopacket-store-toolkit-0.1.7 or phenopacket-store-toolkit-v0.1.7 in github.com/monarch-initiative/phenopacket-store-toolkit verdict: warn === incident mrmustard-0.7.4: An attacker took over a maintainer's GitHub account on 2026-07-23, had the project's CI leak its PyPI token, and uploaded 0.7.4; found 2026-07-24. mrmustard/__init__.py starts a thread at import that reads SSH keys and cloud credentials and installs a .pth, a cron job and a shell hook. No v0.7.4 tag exists (StepSecurity), and the package metadata links no repository, so GRN-T004 cannot look for one. mrmustard 0.7.3 → 0.7.4: WARN WARN GRN-C003 new-import-time-exec: 0.7.4 adds import-time calls to sensitive APIs in 1 module(s) - mrmustard/__init__.py:88 calls subprocess.check_output (in _c(), reached at import) - mrmustard/__init__.py:121 calls urllib.request.urlopen (in _eip(), reached at import) - mrmustard/__init__.py:122 calls urllib.request.Request (in _eip(), reached at import) - mrmustard/__init__.py:160 calls urllib.request.Request (in _run(), reached at import) - mrmustard/__init__.py:165 calls urllib.request.urlopen (in _run(), reached at import) - mrmustard/__init__.py:227 calls subprocess.check_output (in _run(), reached at import) - mrmustard/__init__.py:235 calls subprocess.Popen (in _run(), reached at import) info GRN-C003 new-import-time-exec: 0.7.4 reads credentials or CI settings at import in 1 module(s) - mrmustard/__init__.py:135 reads the whole environment (os.environ) (in _run(), reached at import) - a read is not a call, so this is reported at info; code that runs only in CI or only when a token is set is how credential stealers stay quiet on a developer's machine note: 0.7.3 has no attestation and links no GitHub repository to look for a tag in, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn === incident chalk-5.6.1: Published from the maintainer's phished npm account on 2025-09-08; index.js gained an obfuscated line that hijacks crypto transactions in browsers. The package had never used provenance. chalk 5.6.0 → 5.6.1: WARN WARN GRN-T004 no-matching-tag: github.com/chalk/chalk has a tag for 5.6.0 but none for 5.6.1 - 5.6.0 → tag v5.6.0 at 5c91505e184aff4609c0a7fb235770c2f71db4a3 - 5.6.1: no tag named 5.6.1, v5.6.1, chalk-5.6.1 or chalk-v5.6.1 in github.com/chalk/chalk verdict: warn === incident debug-4.4.2: Same account takeover as chalk, minutes earlier; a maintainer noticed that the version on npm was not in the repository. debug 4.4.1 → 4.4.2: WARN WARN GRN-T004 no-matching-tag: github.com/debug-js/debug has a tag for 4.4.1 but none for 4.4.2 - 4.4.1 → tag 4.4.1 at 33330fa8616b9b33f29f7674747be77266878ba6 - 4.4.2: no tag named 4.4.2, v4.4.2, debug-4.4.2 or debug-v4.4.2 in github.com/debug-js/debug verdict: warn === incident nx-21.5.0: Published with an npm token stolen through a GitHub Actions injection; package.json's postinstall became `node telemetry.js`, a credential stealer that drives local AI CLIs. Earlier nx releases carried provenance; this one had none. nx 21.4.1 → 21.5.0: WARN WARN GRN-C002 new-build-hook: 21.5.0 adds or changes a script that runs when the package is installed - package.json: postinstall script changed to node telemetry.js (was node ./bin/post-install || exit 0) WARN GRN-T001 lost-provenance: 1 file(s) in 21.5.0 have no attestation; every file of 21.4.1 had one - nx-21.5.0.tgz: no attestation - 21.4.1 was attested by github.com/nrwl/nx .github/workflows/publish.yml WARN GRN-T004 no-matching-tag: github.com/nrwl/nx has a tag for 21.4.1 but none for 21.5.0 - 21.4.1 → tag 21.4.1 at 0f3070161c15cfb0dfbf7f730c257d6322a2235a - 21.5.0: no tag named 21.5.0, v21.5.0, nx-21.5.0 or nx-v21.5.0 in github.com/nrwl/nx verdict: warn === incident ctrl-tinycolor-4.1.1: First package of the Shai-Hulud worm: package.json gained a postinstall running a 3.6 MB bundle.js that steals tokens and republishes itself into every package the token can reach. @ctrl/tinycolor 4.1.0 → 4.1.1: WARN WARN GRN-C002 new-build-hook: 4.1.1 adds or changes a script that runs when the package is installed - package.json: new prepare script: npm run build - package.json: new postinstall script: node bundle.js WARN GRN-T004 no-matching-tag: github.com/scttcper/tinycolor has a tag for 4.1.0 but none for 4.1.1 - 4.1.0 → tag v4.1.0 at 2927a9d2aa03e037486a79a295542a7848621691 - 4.1.1: no tag named 4.1.1, v4.1.1, @ctrl/tinycolor-4.1.1 or @ctrl/tinycolor-v4.1.1 in github.com/scttcper/tinycolor verdict: warn === incident event-stream-3.3.6: Published by a newcomer the original author had handed the package to; it added a dependency on flatmap-stream, a package first published five weeks earlier, whose 0.1.1 (October 5, 2018) carried an encrypted payload aimed at one bitcoin wallet app. event-stream itself never tagged its 3.3.x releases or used provenance. event-stream 3.3.5 → 3.3.6: WARN WARN GRN-C008 new-dependency: 3.3.6 depends on 1 package(s) that 3.3.5 didn't; flatmap-stream was first released 35 day(s) before it - flatmap-stream@^0.1.0: first released 2018-08-05, 35 day(s) before 3.3.6; 1 release(s); github.com/hugeglass/flatmap-stream note: 3.3.5 has no attestation and no git tag in github.com/dominictarr/event-stream, so GRN-T001 to GRN-T005, which compare how releases were published, had nothing to compare with verdict: warn SUMMARY incident lightning-2.6.2: CAUGHT by GRN-C003, GRN-T004 incident lightning-2.6.3: CAUGHT by GRN-C003, GRN-T004 incident elementary-data-0.23.3: CAUGHT by GRN-C001 (with today's tags: GRN-C001, GRN-T004) incident litellm-1.82.7: CAUGHT by GRN-C003 incident litellm-1.82.8: CAUGHT by GRN-C001, GRN-C003 incident telnyx-4.87.1: CAUGHT by GRN-C003, GRN-T004 (with today's tags: GRN-C003, GRN-C007) incident telnyx-4.87.2: CAUGHT by GRN-C003, GRN-T004 incident ultralytics-8.3.41: CAUGHT by GRN-T004 incident ultralytics-8.3.42: CAUGHT by GRN-C007 (with today's tags: GRN-T004) incident ultralytics-8.3.45: CAUGHT by GRN-C003, GRN-T001, GRN-T004 incident ultralytics-8.3.46: CAUGHT by GRN-C003, GRN-T001, GRN-T004 incident num2words-0.5.15: CAUGHT by GRN-C003, GRN-T004 incident num2words-0.5.16: CAUGHT by GRN-C003, GRN-T004 incident xinference-2.6.0: CAUGHT by GRN-C003, GRN-T004 incident xinference-2.6.1: CAUGHT by GRN-C003, GRN-T004 incident xinference-2.6.2: CAUGHT by GRN-C003, GRN-T004 incident mistralai-2.4.6: CAUGHT by GRN-C003, GRN-T004 incident guardrails-ai-0.10.1: CAUGHT by GRN-C003 incident durabletask-1.4.1: CAUGHT by GRN-C003, GRN-T004 incident durabletask-1.4.2: CAUGHT by GRN-C003, GRN-T004 incident durabletask-1.4.3: CAUGHT by GRN-C003, GRN-T004 incident memoryos-2.0.34: CAUGHT by GRN-C002, GRN-C003 incident embiggen-0.11.97: CAUGHT by GRN-C001 incident gpsea-0.9.14: CAUGHT by GRN-C001, GRN-T004 (with today's tags: GRN-C001) incident pyphetools-0.9.120: CAUGHT by GRN-C001 incident ppkt2synergy-0.1.1: CAUGHT by GRN-C001 incident bramin-0.0.3: CAUGHT by GRN-C001 incident cmd2func-0.2.2: CAUGHT by GRN-C001, GRN-T004 incident coolbox-0.4.1: CAUGHT by GRN-C001, GRN-T004 incident executor-engine-0.3.4: CAUGHT by GRN-C001, GRN-T004 incident executor-http-0.1.3: CAUGHT by GRN-C001, GRN-T004 incident funcdesc-0.2.2: CAUGHT by GRN-C001, GRN-T004 incident magique-0.6.9: CAUGHT by GRN-C001 incident magique-ai-0.4.5: CAUGHT by GRN-C001 incident mrbios-0.1.1: CAUGHT by GRN-C001, GRN-T004 incident napari-ufish-0.0.3: CAUGHT by GRN-C001 incident nucbox-0.1.2: CAUGHT by GRN-C001 incident okite-0.0.7: CAUGHT by GRN-C001, GRN-T004 incident pantheon-agents-0.6.1: CAUGHT by GRN-C001 incident pantheon-toolsets-0.5.5: CAUGHT by GRN-C001 incident synago-0.1.1: CAUGHT by GRN-C001 incident uprobe-0.1.3: CAUGHT by GRN-C001, GRN-T004 (with today's tags: GRN-C001) incident dreamgen-1.8.1: CAUGHT by GRN-C001 incident mem8-6.0.1: CAUGHT by GRN-C001, GRN-T004 incident ensmallen-0.8.101: CAUGHT by GRN-C001 incident phenopacket-store-toolkit-0.1.7: CAUGHT by GRN-C001, GRN-T004 incident mrmustard-0.7.4: CAUGHT by GRN-C003 incident chalk-5.6.1: CAUGHT by GRN-T004 incident debug-4.4.2: CAUGHT by GRN-T004 incident nx-21.5.0: CAUGHT by GRN-C002, GRN-T001, GRN-T004 incident ctrl-tinycolor-4.1.1: CAUGHT by GRN-C002, GRN-T004 incident event-stream-3.3.6: CAUGHT by GRN-C008 EXIT 0