JDownloader Website Supply Chain Compromise — Trojanized Windows/Linux Installers Deploy Pyarmor-Obfuscated Python RAT (May 6-7, 2026)

Key facts for JDownloader installer hack

Detection coverage for JDownloader installer hack

As of 2026-05-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0490 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Pyarmor RAT Persistence — Win Run-Key & Linux profile.d / SUID / Pyarmor payload

Splunk detection for the post-exploitation persistence and privilege-escalation artifacts of TL-2026-0490: HKCU\...\Run values pointing pythonw.exe at a script under %TEMP%/%APPDATA%/Downloads (Sysmon EID 13), and Linux file events on /etc/profile.d/systemd.sh, the SUID-root /usr/bin/systemd-exec, the hidden $HOME/.local/share/.pkg payload, and the /usr/libexec/upowerd masquerade target.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1547.001, T1546.004, T1548.001, T1036.003, T1564.001, T1037
• Data sources: sysmon, auditd, linux_file_integrity
• Severity: high
• Confidence: high

Splunk SPL

``` TL-2026-0490-SPL-002 — Pyarmor RAT persistence (Run key + Linux profile.d / SUID artifacts) ```
(index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
    TargetObject="*\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\*"
    Details="*pythonw.exe*"
    (Details="*\\Temp\\*" OR Details="*\\AppData\\*" OR Details="*\\Downloads\\*"))
OR (index=linux sourcetype="auditd"
    (key=t1546_profile_d OR key=t1548_suid OR key=t1564_hidden)
    (file_path="/etc/profile.d/systemd.sh"
     OR file_path="/usr/bin/systemd-exec"
     OR file_path="/usr/libexec/upowerd"
     OR file_path="*/.local/share/.pkg"))
| eval phase=case(
    EventCode==13, "win_run_key_pythonw",
    file_path=="/etc/profile.d/systemd.sh", "linux_profile_d_persistence",
    file_path=="/usr/bin/systemd-exec", "linux_suid_root_stage",
    like(file_path,"%/.local/share/.pkg"), "linux_hidden_pyarmor_payload",
    file_path=="/usr/libexec/upowerd", "linux_upowerd_masquerade")
| stats count min(_time) as first_seen max(_time) as last_seen
        values(host) as hosts values(user) as users
        values(TargetObject) as run_keys values(Details) as run_values
        values(file_path) as artifact_paths
        by phase
| eval first_seen=strftime(first_seen,"%Y-%m-%dT%H:%M:%SZ"),
       last_seen=strftime(last_seen,"%Y-%m-%dT%H:%M:%SZ")
| sort - count

Microsoft KQL

// TL-2026-0490-KQL-002 — Linux persistence + SUID + Pyarmor payload + upowerd masquerade (M365 Defender)
let lookback = 24h;
let PersistencePath = "/etc/profile.d/systemd.sh";
let SuidStage = "/usr/bin/systemd-exec";
let MasqPath = "/usr/libexec/upowerd";
DeviceFileEvents
| where Timestamp > ago(lookback)
| where DeviceOSPlatform startswith "Linux" or DeviceType == "Linux"
| where ActionType in~ ("FileCreated","FileModified","FileRenamed")
| where FolderPath in~ (PersistencePath, SuidStage, MasqPath)
       or FolderPath endswith "/.local/share/.pkg"
| extend artifact_kind = case(
    FolderPath =~ PersistencePath, "linux_profile_d_persistence_T1546.004",
    FolderPath =~ SuidStage, "linux_suid_root_T1548.001",
    FolderPath endswith "/.local/share/.pkg", "linux_hidden_pyarmor_payload_T1564.001",
    FolderPath =~ MasqPath, "linux_upowerd_masquerade_T1036.003",
    "unknown")
| extend writer_is_pkgmgr = InitiatingProcessFileName in~ ("dpkg","rpm","apt","apt-get","yum","dnf","pacman","zypper")
| where not(writer_is_pkgmgr) or artifact_kind in ("linux_suid_root_T1548.001","linux_hidden_pyarmor_payload_T1564.001")
| project Timestamp, DeviceName, ReportId, FolderPath, FileName, SHA256,
          ActionType, InitiatingProcessFileName, InitiatingProcessCommandLine,
          InitiatingProcessAccountName, artifact_kind
| summarize Hits = count(), FirstSeen = min(Timestamp), LastSeen = max(Timestamp),
            Paths = make_set(FolderPath, 25), Hashes = make_set(SHA256, 25),
            Writers = make_set(InitiatingProcessFileName, 25)
            by DeviceName, artifact_kind
| order by Hits desc

Sigma

title: JDownloader Linux Supply-Chain Persistence + SUID Stage + Pyarmor Payload + upowerd Masquerade
id: a4901002-0490-4002-9002-000000000002
status: experimental
description: |
    Detects file artifacts associated with the May 2026 JDownloader Linux supply-chain compromise:
    /etc/profile.d/systemd.sh persistence script, the SUID-root /usr/bin/systemd-exec staging binary,
    the hidden /root/.local/share/.pkg (or any user $HOME/.local/share/.pkg) Pyarmor-packed payload,
    and tampering of /usr/libexec/upowerd (legitimate-name masquerade). Excludes writes performed
    directly by package managers.
references:
    - https://www.bleepingcomputer.com/news/security/jdownloader-site-hacked-to-replace-installers-with-python-rat-malware/
    - https://intel.threadlinqs.com/threats/TL-2026-0490
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/05/09
tags:
    - attack.persistence
    - attack.t1546.004
    - attack.t1037
    - attack.privilege_escalation
    - attack.t1548.001
    - attack.defense_evasion
    - attack.t1036.003
    - attack.t1564.001
logsource:
    product: linux
    category: file_event
detection:
    selection_persist:
        TargetFilename: '/etc/profile.d/systemd.sh'
    selection_suid:
        TargetFilename: '/usr/bin/systemd-exec'
    selection_pkg:
        TargetFilename|endswith: '/.local/share/.pkg'
    selection_masq:
        TargetFilename: '/usr/libexec/upowerd'
    filter_pkgmgr:
        Image|endswith:
            - '/dpkg'
            - '/rpm'
            - '/apt'
            - '/apt-get'
            - '/yum'
            - '/dnf'
            - '/pacman'
            - '/zypper'
    condition: (selection_persist or selection_suid or selection_pkg or selection_masq) and not filter_pkgmgr
falsepositives:
    - Custom systemd packaging on bespoke distributions (verify package owner / file hash before suppressing)
    - Configuration management tools (Ansible, Puppet) writing /etc/profile.d/ — should be allowlisted by Image
level: high

Known false positives:

• Configuration management tooling (Ansible, Puppet, Chef) writing /etc/profile.d/ — allowlist by writer process
• Bespoke Linux distributions whose package manager itself ships a /usr/bin/systemd-exec (verify package owner)
• Developer Run-key entries pointing pythonw.exe at user-script paths (rare in enterprise)

Tuning notes: Pre-stage auditd watch rules: -w /etc/profile.d/ -p wa -k t1546_profile_d / -w /usr/bin/systemd-exec -p wa -k t1548_suid / -w /root/.local/share/.pkg -p wa -k t1564_hidden. For .pkg, also watch every user $HOME — extend the path glob accordingly. Suppress writes whose parent process is dpkg/rpm/apt/dnf/pacman/zypper after validating the package source.

• 🔒 JDownloader Trojanized Installer & pythonw RAT Loader — M365 Defender Exploitation · unlock with TL Creds
• 🔒 Linux Persistence + SUID Stage + Pyarmor Payload + upowerd Masquerade — M365 Defender · unlock with TL Creds
• 🔒 JDownloader Pyarmor RAT C2 Beacon — DeviceNetworkEvents (M365 Defender) · unlock with TL Creds
• 🔒 Sigma — JDownloader Trojanized Installer Spoofed Publisher / pythonw Loader · unlock with TL Creds
• 🔒 Sigma — Linux Persistence / SUID / Pyarmor / upowerd Masquerade · unlock with TL Creds
• 🔒 Sigma — JDownloader Pyarmor RAT C2 Beacon /m/<8-alnum>.php · unlock with TL Creds
• 🔒 JDownloader Trojanized Installer & pythonw RAT Loader — Exploitation · unlock with TL Creds
• 🔒 JDownloader Pyarmor RAT C2 Beacon — /m/<8-alnum>.php & Hospitality C2 Hosts/IPs · unlock with TL Creds

Indicators of compromise for JDownloader installer hack

As of 2026-05-09, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-0490.

Sample indicators (3 of 24)

• IP address: 172.96.172[.]91
• Domain: parkspringshotel[.]com
• IP address: 209.133.215[.]178

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How JDownloader installer hack works

The Windows payload is an unsigned loader masquerading under spoofed publisher names ('Zipline LLC', 'The Water Team', 'Peace Team') that drops a Pyarmor-obfuscated Python-based modular RAT framework. The Linux payload is a multi-stage ELF chain (pkg, systemd-exec) staged from compromised hospitality websites (checkinnhotels[.]com), installed as a SUID-root binary in /usr/bin/ and persisted via /etc/profile.d/systemd.sh while masquerading as /usr/libexec/upowerd. In-app updates, macOS downloads, the JDownloader.jar core, and Flatpak/Winget/Snap packages were not affected. C2 endpoints observed: parkspringshotel[.]com/m/Lu6aeloo.php and auraguest[.]lk/m/douV2quu.php. Microsoft Defender SmartScreen flagged the trojanized installers in the wild; the breach was first reported May 7, 2026 by a Reddit user observing unexpected publisher names on signed-installer prompts.

## Overview

On May 6, 2026 at 00:01 UTC, threat actors compromised the official JDownloader website (jdownloader.org), operated by Appwork GmbH, by exploiting an unpatched, unauthenticated vulnerability in the website's content management system that permitted modification of access control lists (ACLs) and published page content without requiring valid credentials. The attackers used this access to swap the legitimate download URLs on the 'Download Alternative Installer' page (Windows .exe) and the Linux shell installer page with attacker-controlled malicious payloads. The compromise was limited to website ACLs and published page content; the underlying server stack, host filesystem, build pipeline, code-signing keys, and in-app update infrastructure were not accessed.

The attack was carefully staged. At 23:55 UTC on May 5, 2026, the threat actors first tested their methodology by modifying a dummy page on the same site to confirm the ACL-bypass exploit would work. Six minutes later, at 00:01 UTC on May 6, they executed the live attack, replacing real download links. The malicious installers remained available on the official domain for over 24 hours before being detected.

## Discovery

The breach was first publicly flagged on May 7, 2026 by a Reddit user posting under the handle 'PrinceOfNightSky', who reported that every Windows executable freshly downloaded from the official JDownloader site triggered Windows SmartScreen warnings and listed unexpected publisher names — 'Zipline LLC', 'The Water Team', and 'Peace Team' — instead of the legitimate publisher 'AppWork GmbH'. Within hours, an Appwork developer (handle 'jdownloader_dev') confirmed the compromise and took the affected pages offline for investigation. The vendor publicly stated: 'Updates are not affected. Only the website has been compromised by replacing links to compromised installers.' Clean files were subsequently restored from backups; the site was placed in read-only mode while the CMS vulnerability was patched and server configurations were hardened.

## Windows Payload Chain

The Windows installer (the trojanized 'Download Alternative Installer' .exe) is a loader signed (or pseudo-signed) under spoofed code-signing publisher names that mimic the look of legitimate AppWork GmbH binaries: 'Zipline LLC', 'The Water Team', and 'Peace Team' have all been observed on collected samples. On execution, the loader writes and launches a Pyarmor-obfuscated Python-based remote access trojan that operates as a modular bot/RAT framework, providing the operator with arbitrary Python code execution, command staging, and post-exploitation tasking on the victim host. The use of pythonw.exe at runtime allows the RAT to execute silently without spawning a visible console window. Because the trojanized binary is unsigned with a valid AppWork certificate (the legitimate publisher), Microsoft Defender SmartScreen flagged the file in the wild — which is what tipped off the original Reddit reporter and triggered downstream detection by Microsoft Defender Antivirus.

## Linux Payload Chain

The Linux installer is a malicious shell script (delivered via the swapped 'Linux Installer' link, observed naming convention `nojre.sh`-class) that downloads a secondary payload archive disguised with an .svg extension from the compromised hospitality website checkinnhotels[.]com. The archive contains two ELF binaries:

- `pkg` — the main payload, obfuscated using Pyarmor (a commercial Python obfuscator increasingly weaponized by adversaries for detection evasion); copied to `/root/.local/share/.pkg`. - `systemd-exec` — a SUID-root component installed under `/usr/bin/systemd-exec`, providing privilege-elevation capability; additionally the threat masquerades as a legitimate system component by impersonating `/usr/libexec/upowerd`.

Persistence is achieved via `/etc/profile.d/systemd.sh`, which causes the RAT to start in every interactive login shell session. Both payloads beacon to attacker-controlled PHP endpoints on compromised hospitality sites: `parkspringshotel[.]com/m/Lu6aeloo.php` and `auraguest[.]lk/m/douV2quu.php`. The use of compromised legitimate domains for staging and C2 is consistent with budget-conscious cybercriminal tradecraft and complicates network-level blocklisting.

## Scope and Non-Affected Components

The following components were explicitly confirmed by Appwork and independent research as **not** compromised:

- The core JDownloader.jar package (cryptographic checksums unchanged). - macOS installers (digital signatures by AppWork GmbH validated throughout). - The in-app update mechanism (separate infrastructure protected by end-to-end digital signatures). - Flatpak, Winget, and Snap distributions (separate package infrastructure with verified SHA-256 checksums). - Third-party Docker images.

## Attribution and Motivation

No formal attribution has been published as of May 9, 2026. The tradecraft (CMS ACL exploitation, compromised hospitality-sector infrastructure for staging/C2, Pyarmor-obfuscated Python RAT, cross-platform targeting of a legitimate freeware brand with millions of users) is consistent with financially motivated cybercrime — likely an information-stealer or commodity-RAT operator seeking broad access to consumer endpoints. Pyarmor-obfuscated Python RATs are also associated with prior infostealer campaigns such as the VVS Discord stealer ecosystem, but no direct lineage has been established. Attribution confidence is LOW.

## Risk and Defender Implications

Any user who downloaded the Windows 'Alternative Installer' or Linux shell installer from jdownloader.org between May 6, 2026 00:01 UTC and the takedown on May 7, 2026 should treat the affected endpoint as fully compromised. Recommended response: full credential rotation for accounts used on the host, complete OS reinstallation, and EDR sweep for the documented IOCs across the rest of the environment. Defenders should retroactively hunt their proxy/DNS telemetry for the C2 domains, hashes, and Linux persistence paths listed in this advisory and pivot from any matches.

MITRE ATT&CK techniques by tactic:

Defense Evasion

T1027 Obfuscated Files or Information; T1027.002 Obfuscated Files or Information: Software Packing; T1036.003 Rename Legitimate Utilities; T1036.005 Match Legitimate Resource Name or Location; T1564.001 Hide Artifacts: Hidden Files and Directories

Persistence

T1037 Boot or Logon Initialization Scripts; T1546.004 Event Triggered Execution: Unix Shell Configuration Modification

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.004 Command and Scripting Interpreter: Unix Shell; T1059.006 Command and Scripting Interpreter: Python; T1204.002 User Execution: Malicious File

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1102 Web Service; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery

Initial Access

T1189 Drive-by Compromise; T1190 Exploit Public-Facing Application; T1195.002 Supply Chain Compromise: Compromise Software Supply Chain

Privilege Escalation

T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid

defense-impairment

T1553.002 Subvert Trust Controls: Code Signing

Credential Access

T1555 Credentials from Password Stores

Resource Development

T1584 Compromise Infrastructure; T1584.001 Compromise Infrastructure: Domains; T1588.003 Obtain Capabilities: Code Signing Certificates; T1608.001 Stage Capabilities: Upload Malware

Remediation for JDownloader installer hack

Patches

• No CVE was issued; the underlying vulnerability is in the JDownloader website's CMS, not in the JDownloader application itself. Appwork patched the CMS vulnerability and hardened server configuration as of 2026-05-08 and restored clean installers from backup.
• No application-level patch is required for JDownloader — the JDownloader.jar core was not modified.

Immediate actions

• If JDownloader Windows Alternative Installer or Linux shell installer was downloaded between 2026-05-06 00:01 UTC and 2026-05-07 takedown, treat the host as fully compromised: isolate from network, capture forensic image if required, then reinstall the operating system from clean media.
• Rotate every credential, session token, browser cookie, and SSH key entered or stored on the affected host since download time — the Python RAT supports arbitrary code execution and credential theft.
• Block the C2 hostnames parkspringshotel[.]com and auraguest[.]lk and the staging host checkinnhotels[.]com (and resolved IPs 172.96.172.91, 209.133.215.178, 66.29.137.25) at perimeter DNS, web proxy, and firewall.
• Hunt EDR/SIEM telemetry for SmartScreen events with publisher = 'Zipline LLC', 'The Water Team', or 'Peace Team' over the past 14 days — these are the spoofed publisher strings on the trojanized Windows installer.
• On Linux endpoints, hunt for the persistence path /etc/profile.d/systemd.sh, the staged binary /root/.local/share/.pkg, and a SUID-root /usr/bin/systemd-exec that does not belong to a known package.

Workarounds

• Until further confirmation, prefer the JDownloader Flatpak/Winget/Snap packages or in-app update over direct .exe / .sh downloads from jdownloader.org.
• On Windows, treat any AppWork .exe whose Authenticode publisher does not read 'AppWork GmbH' as malicious.

Longer-term hardening

• Standardize on package-manager distribution channels (Winget, Flatpak, Snap, official OS repositories) over direct vendor-website downloads where possible — these channels carry separate end-to-end signature chains that survived this incident.
• Validate publisher chain on every signed-installer SmartScreen prompt — train users that an unexpected publisher name on a known vendor's binary is a high-fidelity supply-chain compromise indicator.
• Deploy EDR with behavioral detection for Pyarmor-packed Python interpreters launched by recently-installed application stubs (pythonw.exe spawned from temp/AppData paths shortly after .exe install).
• Monitor download-source allowlists; require code-signing publisher pinning for high-value freeware where supported.

Affected and fixed versions

• Appwork GmbH — JDownloader Windows Alternative Installer
  Vulnerable versions: Any installer downloaded from jdownloader.org Alternative Installer link between 2026-05-06 00:01 UTC and 2026-05-07 takedown
  Fixed in: Installers downloaded after 2026-05-08 (clean files restored from backup; CMS patched)
• Appwork GmbH — JDownloader Linux Shell Installer
  Vulnerable versions: Any Linux .sh installer downloaded from jdownloader.org between 2026-05-06 00:01 UTC and 2026-05-07 takedown
  Fixed in: Installers downloaded after 2026-05-08 (clean files restored from backup; CMS patched)
• Appwork GmbH — JDownloader Website CMS
  Vulnerable versions: Pre-2026-05-08 deployment of the jdownloader.org content management system (specific CMS not publicly disclosed)
  Fixed in: Hardened CMS deployment as of 2026-05-08
• Appwork GmbH — JDownloader macOS Installer
  Fixed in: Not affected — valid AppWork GmbH digital signatures preserved throughout the incident
• Appwork GmbH — JDownloader.jar (core)
  Fixed in: Not affected — checksums unchanged
• Appwork GmbH — JDownloader Flatpak / Winget / Snap packages
  Fixed in: Not affected — separate package infrastructure with verified SHA-256 checksums
• Appwork GmbH — JDownloader In-App Update Channel
  Fixed in: Not affected — separate infrastructure protected by end-to-end digital signatures

Timeline of JDownloader installer hack

• 2026-05-05 23:55 UTC — Threat actors test their CMS ACL-bypass exploit by modifying a non-production dummy page on locked-ioc-15 to confirm the unauthenticated content/ACL modification works as expected.
• 2026-05-06 Malicious installers actively served from the legitimate locked-ioc-15 domain to a global user base for over 24 hours; Microsoft Defender SmartScreen begins flagging fresh downloads with unrecognized publishers ('Zipline LLC', 'The Water Team', 'Peace Team').
• 2026-05-06 00:01 UTC — Live supply-chain attack executed: attackers replace the Windows 'Download Alternative Installer' link and the Linux shell installer link on locked-ioc-15 with malicious payloads (trojanized .exe with spoofed publisher, malicious .sh that stages ELF binaries from locked-ioc-14).
• 2026-05-07 An Appwork developer ('jdownloader_dev') confirms the compromise within hours of the Reddit post, takes affected pages offline, and publicly states: 'Updates are not affected. Only the website has been compromised by replacing links to compromised installers.'
• 2026-05-07 Reddit user 'PrinceOfNightSky' publicly reports that JDownloader Windows installers from the official site are being flagged by SmartScreen and showing unexpected publisher strings — first public disclosure of the breach.
• 2026-05-08 Multiple security outlets (PiunikaWeb, Cyber Kendra, SecurityOnline, Neowin) publish coverage of the incident, including the spoofed publisher names and the affected/unaffected component list.
• 2026-05-08 Appwork restores clean installers from backups, places the site in read-only mode, and patches the underlying CMS access-control vulnerability while hardening server configuration.
• 2026-05-09 Threadlinqs Intelligence (TL-2026-0490) published with consolidated IOC list, MITRE mapping, and detection guidance.
• 2026-05-09 BleepingComputer publishes the most detailed technical writeup, naming the Pyarmor-obfuscated Python RAT, the Linux ELF chain (locked-ioc-24, locked-ioc-20), the persistence path locked-ioc-9, the masquerading as locked-ioc-13, the SUID-root staging at /usr/bin/, the staging via .svg-disguised archive from locked-ioc-14, and the C2 endpoints locked-ioc-12/m/Lu6aeloo.php and locked-ioc-18/m/douV2quu.php.
• 2026-05-29 As of 2026-05-29, the locked-ioc-15 website compromise is contained: Appwork pulled the trojanized installers within ~18 min of the May 7 report, restored clean files from backup, and patched the CMS access-control flaw (no CVE, app core untouched). No resurgence, but the unattributed financially-motivated operator and its modular locked-ioc-23 Python RAT remain at large and could retarget, so monitoring continues.

Sources cited for JDownloader installer hack

• Trust Hijacked: Official JDownloader Website Breached to Distribute Malicious Installers securityonline.info · Research · 2026-05-08
• Hackers breach JDownloader's website to serve malware-laced downloads (Hacker News discussion with VirusTotal hash references) news.ycombinator.com · Research · 2026-05-08
• Compromised JDownloader Malware (ESET Security Forum thread) forum.eset.com · Research · 2026-05-08
• VVS Discord Stealer Using Pyarmor for Obfuscation and Detection Evasion (Pyarmor weaponization context) Unit 42 · Research · 2025-09-15
• Obfuscated Malicious Python Scripts with PyArmor (SANS ISC) isc.sans.edu · Research · 2025-08-12
• Jdownloader.org hacked and offline (Gnoppix Forum discussion) forum.gnoppix.org · Blog · 2026-05-08
• JDownloader site hacked to replace installers with Python RAT malware BleepingComputer · News · 2026-05-09
• JDownloader developers confirm site hack, warn of malicious Windows and Linux installers piunikaweb.com · News · 2026-05-08
• JDownloader Website Hacked — Malicious Installers Served to Windows and Linux Users cyberkendra.com · News · 2026-05-08
• If you downloaded this popular software recently, you might have installed malware neowin.net · News · 2026-05-08

Threats related to JDownloader installer hack

• JDownloader Website Supply-Chain Compromise Distributes Trojanized Installers (Python RAT / Linux Persistence Malware)
• SleeperGem Supply-Chain Campaign Uses Three Malicious RubyGems Packages to Backdoor Developer Machines

Previous and next in supply chain

• Malicious NuGet Packages Impersonate Chinese UI Libraries — IR.* Infostealer With clrjit.dll JIT Hook, Reactor RSA-1024 Anti-Tamper, and Multi-Browser/Wallet/SSH Theft Previous report
• Checkmarx Jenkins AST Plugin Supply Chain Compromise — TeamPCP Backdoored Plugin on Jenkins Marketplace Next report

Further reading

• npm Supply Chain Attacks 2026: 218 Packages
• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs