Monday, August 31, 2026 | Jonathan Brown
Attackers abuse a trusted GitHub workflow to publish ten malicious npm releases
Socket and StepSecurity reported on August 28 that an external GitHub user published ten malicious versions of @7nohe/openapi-react-query-codegen, an npm package with roughly 150,000 weekly downloads. The affected package generates TypeScript clients and TanStack Query integrations from OpenAPI specifications and is likely to run in developer workstations and CI/CD environments.
The attacker did not need to steal the maintainer’s npm password or publishing token. Researchers found that the project’s GitHub Actions workflow accepted a particular pull-request comment without checking whether the commenter was a trusted contributor. The workflow then checked out code from the attacker-controlled pull-request branch and used its legitimate OpenID Connect trusted-publishing permission to publish the result to npm. All ten malicious releases consequently carried valid npm provenance attestations.
The malicious packages execute attacker-controlled code during installation. Socket found an obfuscated second-stage payload designed to collect cloud credentials, GitHub and package-registry credentials, GitHub Actions secrets, and AI-development configuration. The payload also contained self-propagation functionality, although public evidence has not yet established how many downstream systems executed it or whether the same operator successfully poisoned additional packages.
The eight malicious stable releases are versions 0.5.4, 0.5.5, 1.6.3, 1.6.4, 2.2.1, 2.2.2, 3.0.3, and 3.0.4. Two malicious prereleases were also identified: 0.0.0-365d4eb738d3146583431948d3ba6e27a32556be and 0.0.0-ec7876d6c917dad516ba69bbfafc948b834bf0ab. Researchers identified 0.5.3, 1.6.2, 2.2.0, and 3.0.2 as the last known-good releases in their respective branches. At the time of Socket’s initial report, npm’s latest tag pointed to malicious version 3.0.4.
Organizations should search manifests, lockfiles, dependency caches, build logs, developer systems, and CI runners for all ten versions. Any system that installed an affected release while lifecycle execution was permitted should be treated as potentially compromised, isolated, examined, and rebuilt from a trusted state. Credentials accessible to that environment should be rotated from a clean system after containment, and downstream repositories and packages should be checked for unauthorized workflow or release changes.
Watch for: Confirmation of downstream propagation, verified victim counts, additional poisoned packages, and a final maintainer or npm incident report establishing the registry remediation timeline.
Sources: Socket, “OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack,” August 28, 2026; StepSecurity, “@7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow,” August 28, 2026; Aikido Security, “Popular code generator for TanStack Query hit by supply chain worm,” updated August 29, 2026; GitHub issue 217, “Malicious NPM packages published,” August 28, 2026.
VulnCheck canaries detect exploitation attempts against a Ruby on Rails file-read flaw
SecurityWeek reported on August 31 that VulnCheck had observed exploitation attempts against CVE-2026-66066, known as KindaRails2Shell. VulnCheck said its canaries in Singapore, Israel, and the United Kingdom received the activity from one IP address in France. This establishes active exploit traffic against controlled systems, not confirmed compromise of production organizations.
The flaw affects Rails applications that use libvips for Active Storage image processing and allow image uploads from untrusted users. A crafted upload can make libvips read arbitrary files accessible to the Rails process. Those files may contain secret_key_base, the Rails master key, database credentials, cloud-storage keys, API tokens, and other environment secrets. Stolen signing material may enable session forgery, while exposed service credentials can support remote code execution or lateral movement.
Affected Active Storage versions include versions earlier than 7.2.3.2, version 8.0 releases earlier than 8.0.5.1, and version 8.1 releases earlier than 8.1.3.1. Administrators must also use libvips 8.13 or later. Public proofs of concept appeared after researchers reverse-engineered the vulnerability, and Rails subsequently released forensic guidance and tools for determining whether an application was vulnerable and whether crafted files were processed.
Rails instructs affected operators to rotate every secret the application process could read, because patching does not invalidate credentials or signing keys already obtained. Changing secret_key_base expires active sessions, signed cookies, signed global identifiers, and Active Storage URLs. An exposed secret must not be retained as a fallback during rotation.
VulnCheck separately reported that a patched Rails 8.1.3.1 test system still executed a Marshal-deserialization gadget when supplied with a valid variation-key signature. This is not evidence of a fresh unauthenticated patch bypass: the attacker would first need a valid signing capability, which could result from earlier theft of secret_key_base. It reinforces the need for secret rotation and retrospective investigation rather than undermining the vendor’s file-read fix.
Watch for: Confirmed production compromises, broader exploitation infrastructure, CISA KEV inclusion, or additional Rails guidance concerning the signed-payload behavior.
Sources: Ruby on Rails, “Possible arbitrary file read and remote code execution in Active Storage variant processing,” July 29, 2026; Ruby on Rails, “Attack details, and tools to perform a forensic investigation,” July 31, 2026; VulnCheck, Patrick Garrity, “CVE-2026-66066 Exploitation Underway,” August 25, 2026; SecurityWeek, “Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs,” August 31, 2026.
ServiceNow patches three maximum-severity AI Platform flaws and a separate sandbox escape
ServiceNow published advisory KB3152242 on August 27 addressing four vulnerabilities in the ServiceNow AI Platform and Now Platform. Three carry vendor-assigned CVSS version 4 scores of 10.0 and can, under specific circumstances, be exploited without authentication. ServiceNow says it deployed updates to hosted instances and provided the fixes to partners and self-hosted customers.
CVE-2026-18885 is a code-injection vulnerability that can permit arbitrary code execution and unauthorized access to or modification of instance data. CVE-2026-18886 is an improper-access-control flaw that can allow an unauthenticated attacker to create or modify instance data and escalate privileges. CVE-2026-74820 is a SQL-injection vulnerability that can allow unauthenticated execution of arbitrary statements against the instance’s underlying database.
CVE-2026-6876 is a separate Now Platform sandbox escape rated 8.7. ServiceNow’s written description says an unauthenticated user could execute arbitrary code, but its published CVSS vector specifies low privileges as a requirement. Until ServiceNow reconciles those two statements, defenders should not present the flaw as conclusively pre-authentication or assume that every exposed installation has the same attack path.
ServiceNow’s records identify affected builds in the Xanadu, Yokohama, Zurich, and Australia release families, with different patch and hot-fix thresholds across individual branches. There is no single universal fixed-version number. Partners and self-hosted operators should compare their precise build against KB3152242 rather than assuming that a family-level platform upgrade supplied the required fix.
ServiceNow says it is not aware of malicious exploitation of these vulnerabilities. Defenders should nevertheless confirm patch installation, restrict unnecessary internet access, and review unauthenticated API and GraphQL traffic, image-processing events, abnormal database errors, unexpected data exports, new privileged identities, and altered integrations. If compromise is suspected, connected credentials and automation secrets should be included in the investigation.
Watch for: Public exploit code, confirmed exploitation, or a corrected ServiceNow record resolving the authentication requirements for CVE-2026-6876.
Sources: ServiceNow, “August 2026 CVE Advisory Notification,” KB3152242, August 27, 2026; CVE records for CVE-2026-18885, CVE-2026-18886, CVE-2026-74820, and CVE-2026-6876; The Hacker News, “Three CVSS 10.0 ServiceNow Flaws Could Let Unauthenticated Attackers Execute Code and SQL,” August 28, 2026.
Boston Scientific limits an ongoing intrusion to on-premises systems as manufacturing and shipping remain disrupted
Boston Scientific said in its latest official update, published at 8:25 p.m. Eastern Time on August 30, that the cybersecurity incident detected on August 25 remains under investigation. The company sees no indication of related unauthorized activity after August 25 and currently assesses the intrusion as limited to certain on-premises systems. It reports no impact to its cloud-based systems and applications.
The network disruption has affected manufacturing, order processing, and product shipping. Boston Scientific can accept electronic orders through Electronic Data Interchange, local applications, and the Global Health Exchange, but those orders are being queued for later fulfillment. The company says its confidence in restoration is increasing and expects to resume shipping some products during the week beginning August 31 before gradually returning ordering and shipping to full capacity.
Boston Scientific reports no known impact on existing implantable cardiac-rhythm-management device function, programmer interrogation, or remote monitoring established before the outage. New remote-monitoring activations are affected, however. Some newly implanted devices cannot transmit available data to remote-management systems until communicators or mobile connections can be activated. Insertable cardiac monitors continue recording episodes, which clinicians can retrieve through an in-person interrogation.
Healthcare providers should distinguish this availability problem from an unsupported claim that implanted devices or hospital networks have been compromised. Providers should review inventory and pending orders, identify procedures dependent on Boston Scientific products, document temporary monitoring arrangements, and follow current clinical instructions from the company. The intrusion method, responsible actor, data-access scope, and full restoration date remain undisclosed.
Watch for: Verified restoration of manufacturing and full shipping capacity, confirmation of whether information was accessed, and any regulatory guidance concerning product availability or new remote-monitoring activation.
Sources: Boston Scientific, “Update on recent cybersecurity incident,” updates through August 30, 2026; Boston Scientific Form 8-K, filed August 26, 2026; SecurityWeek, “Boston Scientific Still Recovering From Cyberattack,” August 31, 2026.
ATF declares a major cyber incident after a standalone investigative system is breached
The Bureau of Alcohol, Tobacco, Firearms and Explosives disclosed on August 26 that a cybersecurity incident affected a standalone system operating separately from its enterprise network. ATF terminated connections to the affected environment, began forensic work, and is investigating with the Department of Justice.
ATF says it has no indication that the incident affected its enterprise network, eForms service, case-management systems, other agency systems, or its ability to perform its missions. Senior Justice Department officials classified the event as a major incident under federal guidelines and completed the required notifications. That classification reflects the federal reporting threshold; it does not establish compromise of the wider ATF network.
An ATF spokesperson told Reuters that the affected system contained information about targets of investigations. The Qilin ransomware operation listed ATF on its leak site and claimed responsibility, but ATF has not attributed the incident to Qilin or confirmed that ransomware was involved. The Qilin listing provided no public data samples, volume, or technical evidence sufficient to validate the group’s claim at the verification cutoff.
Separation from the enterprise network reduces immediate lateral-movement risk but does not prove that the affected environment lacked shared identities, administrative credentials, exports, backups, or other trust relationships. Investigators must establish what information was accessed, whether credentials were present, how the attacker entered, and whether affected investigations or individuals require protective measures.
Watch for: ATF confirmation of the accessed-data scope, the initial-entry method, validated attribution, and evidence supporting or disproving Qilin’s claim.
Sources: Bureau of Alcohol, Tobacco, Firearms and Explosives, “ATF responds to cybersecurity incident,” August 26, 2026; Reuters, “US federal agency confirms data breach in wake of claims by ransomware group,” August 27, 2026; The Record, “DOJ firearms agency says hackers breached system containing investigation targets,” August 27, 2026.
Berlin confirms further government data theft while Rhysida advertises an unverified 5.79-terabyte haul
Berlin officials confirmed on August 28 that continuing forensic work had identified further data exfiltration from the Senate Department for Mobility, Transport, Climate Protection, and the Environment. The data left the state network between August 7 and August 12. That department and the Senate Department for Urban Development, Building, and Housing were disconnected from the state network on August 14 and reconnected on August 23 after implementing additional security measures.
Berlin says the newly identified material may include personal or other non-public information, but its scope and contents remain under investigation. Governing Mayor Kai Wegner and Interior Senator Iris Spranger confirmed that the city-state is being extorted and said Berlin will not pay. The state criminal police, public prosecutor, and federal security agencies are investigating.
The Rhysida ransomware group claimed responsibility and advertised approximately 5.79 terabytes of data, including contracts, legal documents, human-resources material, credentials, identity documents, and financial records. Those quantities and categories remain attacker claims rather than independently confirmed facts. Berlin has not attributed the intrusion to Rhysida or disclosed the initial-access method.
Officials say that, based on current information, no data was compromised from the technical environment used for Berlin’s September 20 election and that the election environment is considered secure. That assessment should not be generalized to the rest of the state network while scanning and forensic analysis continue. Administrators should invalidate credentials found in affected repositories, monitor for attempted reuse, review administrative activity across connected departments, and prepare for targeted phishing if personnel data is released.
Watch for: Publication or independent validation of the claimed data, technical attribution, identification of the entry point, and evidence that the compromise reached additional departments.
Sources: State of Berlin, “Wegner and Spranger: Berlin will not give in to blackmail,” August 28, 2026; State of Berlin, “After a hacker attack: Senate departments back online,” August 23, 2026; Reuters, “Ransomware group says it stole Berlin data, offers it for auction,” August 28, 2026; SecurityWeek, “Berlin Won’t Pay Extortion Group Claiming Data Theft,” August 31, 2026.
Jonathan Brown is a cybersecurity researcher and investigative journalist at bordercybergroup.com.
If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.
© 2026 Border Cyber Group. All rights reserved.
BORDER CYBER GROUP THREAT INTELLIGENCE BRIEFING
SOURCE VERIFICATION — AUGUST 31, 2026
OPENAPI REACT QUERY CODEGEN NPM SUPPLY-CHAIN COMPROMISE
Socket: OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
https://socket.dev/blog/openapi-react-query-codegen-npm-compromise
StepSecurity: @7nohe/openapi-react-query-codegen Compromised Through an Exposed npm Publishing Workflow
https://www.stepsecurity.io/blog/7nohe-openapi-react-query-codegen-compromised-npm-publishing-workflow
Aikido: Popular Code Generator for TanStack Query Hit by Supply Chain Worm
https://www.aikido.dev/blog/popular-code-generator-for-tanstack-query-hit-by-supply-chain-worm
GitHub issue 217: Malicious NPM Packages Published
https://github.com/7nohe/openapi-react-query-codegen/issues/217
Official GitHub repository
https://github.com/7nohe/openapi-react-query-codegen
Official package.json from the repository
https://github.com/7nohe/openapi-react-query-codegen/blob/main/package.json
Official npm package and version history
https://www.npmjs.com/package/@7nohe/openapi-react-query-codegen?activeTab=versions
Endor Labs: Mini Shai-Hulud Worm Hits openapi-react-query-codegen
https://www.endorlabs.com/learn/trojanized-7nohe-openapi-react-query-codegen-adds-pypi-to-a-self-replicating-npm-worm
RUBY ON RAILS — CVE-2026-66066
Official Rails security advisory: Possible Arbitrary File Read and Remote Code Execution in Active Storage Variant Processing
https://github.com/rails/rails/security/advisories/GHSA-xr9x-r78c-5hrm
Ruby on Rails Security Announcements: CVE-2026-66066
https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432
Ruby on Rails: Versions 7.2.3.2, 8.0.5.1, and 8.1.3.1 Released
https://rubyonrails.org/2026/7/29/Rails-Versions-7-2-3-2-8-0-5-1-and-8-1-3-1-have-been-released
Rails Security Team: Attack Details and Forensic Investigation Tools
https://discuss.rubyonrails.org/t/cve-2026-66066-attack-details-and-tools-to-perform-a-forensic-investigation/91441
Official Rails forensic repository for CVE-2026-66066
https://github.com/rails/rails-forensics-CVE-2026-66066
VulnCheck’s Patrick Garrity: CVE-2026-66066 Exploitation Underway
https://www.linkedin.com/feed/update/urn:li:activity:7497979391268892672/
SecurityWeek: Critical Ruby on Rails Vulnerability in Attackers’ Crosshairs
https://www.securityweek.com/critical-ruby-on-rails-vulnerability-in-attackers-crosshairs/
Rapid7: KindaRails2Shell Technical Analysis
https://www.rapid7.com/blog/post/ra-kindarails2shell-technical-analysis-cve-2026-66066/
Akamai: Defending Against the KindaRails2Shell Pre-Authentication RCE
https://www.akamai.com/blog/security-research/rails-active-storage-rce-cve-2026-66066
Official CVE record: CVE-2026-66066
https://www.cve.org/CVERecord?id=CVE-2026-66066
NVD record: CVE-2026-66066
https://nvd.nist.gov/vuln/detail/CVE-2026-66066
SERVICENOW AI PLATFORM AND NOW PLATFORM VULNERABILITIES
ServiceNow: August 2026 CVE Advisory Notification — KB3152242
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB3152242
ServiceNow: Common Vulnerabilities and Exposures Advisory Index
https://support.servicenow.com/kb?id=kb_article_view&sysparm_article=KB1226057
Official CVE record: CVE-2026-18885
https://www.cve.org/CVERecord?id=CVE-2026-18885
Official CVE record: CVE-2026-18886
https://www.cve.org/CVERecord?id=CVE-2026-18886
Official CVE record: CVE-2026-74820
https://www.cve.org/CVERecord?id=CVE-2026-74820
Official CVE record: CVE-2026-6876
https://www.cve.org/CVERecord?id=CVE-2026-6876
NVD record: CVE-2026-18885
https://nvd.nist.gov/vuln/detail/CVE-2026-18885
NVD record: CVE-2026-18886
https://nvd.nist.gov/vuln/detail/CVE-2026-18886
NVD record: CVE-2026-74820
https://nvd.nist.gov/vuln/detail/CVE-2026-74820
NVD record: CVE-2026-6876
https://nvd.nist.gov/vuln/detail/CVE-2026-6876
SecurityWeek: ServiceNow Patches Three Critical Code Injection Vulnerabilities
https://www.securityweek.com/servicenow-patches-3-critical-code-injection-vulnerabilities/
BOSTON SCIENTIFIC CYBER INCIDENT
Boston Scientific: Update on Recent Cybersecurity Incident
https://news.bostonscientific.com/update-on-recent-cybersecurity-incident
Boston Scientific Form 8-K filed with the SEC on August 26, 2026
https://www.sec.gov/Archives/edgar/data/885725/000088572526000056/bsx-20260826.htm
Reuters: Boston Scientific Hit by Cyberattack, Global Operations Affected
https://www.reuters.com/legal/government/boston-scientific-hit-by-cyberattack-global-operations-affected-2026-08-26/
SecurityWeek: Boston Scientific Still Recovering From Cyberattack
https://www.securityweek.com/boston-scientific-still-recovering-from-cyberattack/
SecurityWeek: Cyberattack Causes Global Disruption at Boston Scientific
https://www.securityweek.com/cyberattack-causes-global-disruption-at-boston-scientific/
ATF MAJOR CYBER INCIDENT
ATF: ATF Responds to Cybersecurity Incident
https://www.atf.gov/news/press-releases/atf-responds-to-cybersecurity-incident
Reuters: U.S. Federal Agency Confirms Data Breach in Wake of Ransomware Group’s Claim
https://www.reuters.com/legal/government/us-federal-agency-confirms-data-breach-wake-claims-by-ransomware-group-2026-08-27/
The Record: DOJ Firearms Agency Says Hackers Breached System Containing Investigation Targets
https://therecord.media/doj-atf-cyberattack-qilin-ransomware
SecurityWeek: ATF Confirms Cyber Incident After Ransomware Group Claims Attack
https://www.securityweek.com/atf-confirms-cyber-incident-after-ransomware-group-claims-attack/
The Register: ATF Responds to Major Cybersecurity Incident After Ransomware Gang’s Claim
https://www.theregister.com/security/2026/08/27/atf-responds-to-major-cybersecurity-incident-after-ransomware-gangs-claims/5292990
BERLIN GOVERNMENT CYBERATTACK AND RHYSIDA CLAIM
Berlin Senate Chancellery: Das Land Berlin lässt sich nicht erpressen
https://www.berlin.de/rbmskzl/aktuelles/pressemitteilungen/2026/pressemitteilung.1708208.php
Berlin Senate Chancellery: Affected Senate Departments Reconnected to the Berlin State Network
https://www.berlin.de/rbmskzl/aktuelles/pressemitteilungen/2026/pressemitteilung.1706036.php
Berlin official portal: Incident and Election Security Summary
https://www.berlin.de/aktuelles/10598900-958090-wegner-und-spranger-berlin-laesst-sich-n.html
Reuters: Ransomware Group Says It Stole Berlin Data and Offers It for Auction
https://www.reuters.com/world/berlin-city-government-says-it-wont-submit-extortion-after-pre-election-2026-08-28/
The Hacker News: Berlin Refuses to Pay Hackers Who Stole Data From the City’s State Network
https://thehackernews.com/2026/08/berlin-refuses-to-pay-hackers-who-stole.html
SecurityWeek: Berlin Won’t Pay Extortion Group Claiming Data Theft
https://www.securityweek.com/berlin-wont-pay-extortion-group-claiming-data-theft/
Member discussion: