v vanemmerik.ai / SUPPLY-CHAIN
vanemmerik.ai / supply-chain / 2026-09-07
Supply Chain · Watch Monday · 07 September 2026 End-of-day synthesis 4 watches · 5 items

From the watchtower — what crossed the wire today.

A four-times-a-day standing watch on the open-source supply chain. Each pass pulls newly disclosed CVEs, freshly catalogued KEV adds, and active attacks reported in the wild — then ranks them by severity for the day.

The story of the day — A 111-day-dormant Shai-Hulud payload walked straight past npm's malware scanner today, the same day Adobe's unpatched Magento zero-day was confirmed dropping a disguised Rust backdoor on live stores.

Today's third pass locks in two escalating threads that surfaced across the day, with the lighter items around them staying flat.

Aikido caught four new npm package versions carrying a byte-identical Shai-Hulud payload from May 19's @antv compromise (639 malicious versions in one hour), dormant for 111 days before republishing straight past the publish-time scanner npm built specifically in response to that campaign. Separately, the Magento StyleSmuggler zero-day Sansec disclosed Friday now has a confirmed payload — a Rust-based backdoor disguised as a kernel-worker process and persisted through a direct cron-spool write that dodges normal crontab logging — still live and unpatched on day three, with no CVE, advisory, or fix from Adobe. Both are the same shape: the automated defense built after the last incident is exactly what's getting walked through this time. The day's other two items, a rogue-ScreenConnect worm and a fake-bookmarks Chrome/Edge backdoor toolkit called PEEP, both need a foothold first and aren't new supply-chain vectors on their own.

→ Operational priority for the night pull the May @antv Shai-Hulud indicators and check them against your own registry mirrors and CI caches directly rather than trusting npm's scanner, and if you run Magento or Adobe Commerce, grep for disguised kworker/fc-cache processes and check the raw cron spool file — Sansec's Shield rules remain the only mitigation until Adobe ships a patch.

18:00 ET · First Watch
Critical · BleepingComputer ·added 18:00 ET

StyleSmuggler exploitation confirmed dropping a Rust backdoor on Magento/Adobe Commerce hosts, still no CVE or patch on day three

Three days after Sansec's initial StyleSmuggler disclosure, the payload is now confirmed: successful exploitation drops a small Rust-based backdoor that disguises itself as a [kworker/u:8:0] kernel-worker process (newer samples pose as fc-cache under ~/.cache/fontconfig/), then persists by writing a cron entry directly to the spool file instead of going through crontab, which skips the logging a routine crontab -l audit would catch. Magento and Adobe Commerce run on 160,000+ sites, including 14,000 of the top 1 million, and Adobe still hasn't issued a CVE, advisory, or patch as of today — Enterprise Support confirms a fix is coming but won't say when. Grep running processes for kworker/fc-cache entries with no matching kernel thread or cgroup, check the raw cron spool file rather than crontab -l, and keep Sansec's Shield WAF rules active since there's still nothing from Adobe to patch to.

Context · The Hacker News ·added 18:00 ET

PEEP: a fake “Smart Bookmarks” extension turns compromised Chrome/Edge profiles into a full backdoor

PEEP is a post-compromise toolkit, derived from the open-source RedExt project, that installs as a "Smart Bookmarks" extension by forging Chromium's Secure Preferences integrity hash — it needs prior admin or code-exec access to land, so it's persistence and credential theft rather than an initial-access vector, but the trick of forging the browser's own integrity check to bypass Web Store and unpacked-extension warnings is the same trusted-channel abuse this watch keeps flagging elsewhere. Once resident it polls a C2 every 30 seconds over plaintext HTTP and pulls session cookies, clipboard contents, and screenshots, and can run arbitrary host commands. If your EDR baselines browser extension IDs, add unexpected profile-level Secure Preferences hash mismatches to the watchlist.

12:00 ET · Forenoon Watch
Critical · Aikido Security ·added 12:00 ET

A byte-identical Shai-Hulud payload resurfaces on npm 111 days after going dark, straight past publish-time malware scanning

Aikido caught four new npm package versions carrying a Shai-Hulud payload with the exact same file hash as May 19's @antv compromise (639 malicious versions in one hour) — a 111-day dormancy-to-reactivation gap, the longest this campaign has shown yet. npm rolled out publish-time malware scanning specifically in response to that May campaign, and a known, previously-catalogued hash still walked through it, which means the scanner either isn't hash-matching its own incident corpus or that sample was never fed back in. If you're still relying on npm's scanner as your only backstop, don't: pull the May @antv indicators (file hashes, C2 endpoints) and check them against your own registry mirrors and CI caches directly, since this campaign has now demonstrated it can lie dormant past a full quarter before firing again.

Context · The Hacker News · Huntress ·added 12:00 ET

Rogue ScreenConnect clients push a four-stage VBScript chain to every newly-connected host, worm-style

Huntress is tracking modified ScreenConnect clients that use the tool's own file-transfer feature to drop four VBScript stages (1.vbs–4.vbs) on any endpoint that connects through them, then repeat the same push on the next new connection — self-propagating across support sessions that started via Quick Assist scams, phishing MSI installers, or fake refund searches. It's not an open-source dependency compromise, but the propagation shape is the same lesson this watch keeps repeating for npm worms: one trusted channel (here, an RMM tool, not a registry) becomes the infection vector for everyone connected through it, and the chain ends in a PowerShell stage that UAC-bypasses and hides a second ScreenConnect install for persistence. If you run ScreenConnect, audit for unexpected client installs and unrecognized file-transfer activity, especially from Quick-Assist-style or MSI-based onboarding.