<p><strong>TLDR:</strong> The Arch User Repository supply chain attack has escalated to over 1,500 compromised packages across three waves, with attackers now injecting Russian-language spam into shell startup files. A critical three-CVE chain in LiteLLM (CVSS 9.9) is already in CISA’s KEV catalog with a June 22 deadline, exposing all provider API keys and MCP OAuth tokens on affected gateways. JetBrains Marketplace saw a coordinated campaign of 15 malicious AI assistant plugins installed nearly 70,000 times, silently exfiltrating API keys over plain HTTP. npm v12, due in July, will block install scripts by default — a meaningful structural change worth testing now in npm 11.16.0.</p>
<hr>
<h2>AUR supply chain attack reaches 1,500+ packages across three escalating waves</h2>
<p>Attackers adopted orphaned AUR packages and rewrote PKGBUILDs to install a Rust-based credential stealer harvesting SSH keys, browser cookies, GitHub/npm tokens, and Docker credentials over Tor. A second wave added obfuscation via hex encoding to drop malicious npm/bun packages; the third injected Russian-language spam into bashrc, zshrc, and fish configs. Arch temporarily suspended new account registrations. With roughly 13,000 orphaned AUR packages still out there, the structural exposure isn’t going away — users should read every PKGBUILD before building and rotate credentials on any recently updated AUR package. <a href="https://app.daily.dev/feed-by-ids?id=e2a7ZfKo1&amp;id=bRrfAgKyV&amp;id=Sl3o5qvr9&amp;id=sJ2f1gofQ&amp;id=XHUC1wLPr" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>LiteLLM three-CVE chain (CVSS 9.9) in CISA KEV, June 22 remediation deadline</h2>
<p>CVE-2026-47101, CVE-2026-47102, and CVE-2026-40217 chain together to let any low-privilege user escalate to full admin and execute arbitrary code on the LiteLLM gateway host. A separate unauthenticated RCE (CVE-2026-42271, affecting versions 1.74.2–1.83.6) is already in CISA’s Known Exploited Vulnerabilities catalog. A successful exploit exposes every provider API key — OpenAI, Anthropic, Azure, AWS Bedrock — plus in-flight prompts and MCP OAuth tokens. Upgrade to v1.83.14-stable immediately, rotate all provider keys, and disable Custom Code Guardrails if you’re not using them. <a href="https://app.daily.dev/posts/2Dh1T9Pl9" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>15 malicious JetBrains Marketplace plugins stole AI API keys from ~70,000 installs</h2>
<p>A coordinated campaign published at least 15 plugins across seven vendor accounts, each posing as a DeepSeek-based AI coding assistant. Every plugin silently exfiltrated OpenAI, DeepSeek, and SiliconFlow API keys to a hardcoded attacker-controlled server over plain HTTP. The stolen keys were likely resold to paying users of the same plugins — victims unknowingly funded others’ AI compute. The campaign ran from October 2025 through at least June 2026. Check the published IOCs, revoke any API keys entered into JetBrains AI assistant plugins, and treat any plugin requesting AI provider credentials with suspicion. <a href="https://app.daily.dev/posts/e0cBtEfUM" target="_blank" rel="noopener nofollow">Read more</a></p>
<h2>npm v12 blocks install scripts by default, testable now in npm 11.16.0</h2>
<p>npm v12, expected July 2026, will require explicit allowlisting via <code>npm approve-scripts</code> before any package can run install scripts, and will also block git dependencies and remote tarball dependencies by default. Native modules like bcrypt and sqlite3, and binary-downloading tools like esbuild and husky, will break silently if not approved. The change is already live in npm 11.16.0. Teams should audit dependency trees now — the risk of blindly approving everything to get CI green is exactly the failure mode this is meant to prevent. <a href="https://app.daily.dev/posts/9tWjHff9i" target="_blank" rel="noopener nofollow">Read more</a></p>
<hr>
<h2>Also notable</h2>
<ul>
<li><strong>FortiSandbox three critical CVEs (CVE-2026-39813, CVE-2026-39808, CVE-2026-25089) under active exploitation:</strong> All three allow unauthenticated remote code execution via low-complexity command injection with no user interaction required; Fortinet patched on April 14 and admins on unpatched versions should treat this as an emergency upgrade given Fortinet’s track record as a ransomware and espionage target. <a href="https://app.daily.dev/feed-by-ids?id=hPJiEpVtA&amp;id=pPy51tykP" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>Vertex AI Python SDK bucket squatting enabled cross-tenant RCE via pickle injection (fixed in v1.148.0):</strong> Versions 1.139.0–1.140.0 constructed predictable staging bucket names from project ID and region; an attacker who pre-created that bucket could replace an uploaded model with a malicious pickle payload within a ~2.5-second window, exfiltrating OAuth tokens and gaining access to cross-tenant BigQuery datasets — upgrade to v1.148.0 which adds bucket ownership verification. <a href="https://app.daily.dev/posts/cuZ0rz1po" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>1Password acquires Apono for $250–300M, SailPoint acquires Entro for ~$200M — NHI market consolidating fast:</strong> Both deals closed the same day and target the same problem: non-human identities (AI agents, service accounts) now outnumber human users 45-to-1 yet remain largely unmanaged, putting 1Password in direct competition with CyberArk and Wiz. <a href="https://app.daily.dev/feed-by-ids?id=zCDmZOU29&amp;id=5ud7yC1TD" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>SprySOCKS Windows variant uses kernel drivers signed with leaked cert to hide processes on government targets:</strong> ESET found WIN_DRV, a rootkit variant of the China-nexus FishMonger backdoor, deployed against government targets in Honduras, Taiwan, Thailand, and Pakistan using two encrypted kernel drivers loaded via a certificate leaked from the open-source PastDSE project — enable HVCI and check published IOCs. <a href="https://app.daily.dev/feed-by-ids?id=vYz246IRY&amp;id=IyygRdkHW" target="_blank" rel="noopener nofollow">Read more</a></li>
<li><strong>FIFA World Cup broadcast control panel exposed via zero-authorization backend API — patched within hours of report:</strong> Registering as a player agent on FIFA’s public platform added the researcher’s account to FIFA’s Entra tenant with no role checks on backend APIs, granting access to live RTMP ingest URLs and stream keys for every World Cup camera feed. <a href="https://app.daily.dev/feed-by-ids?id=k8McaIRsW&amp;id=Cu0D8VDIo" target="_blank" rel="noopener nofollow">Read more</a></li>
</ul>


CVE disclosures, supply-chain attacks, security incidents, and developer-facing security tooling.

Security Digest

A security-focused roundup covering four major developer threats: (1) The AUR supply chain attack has grown to 1,500+ compromised packages across three waves, with a Rust-based credential stealer harvesting SSH keys, tokens, and Docker credentials. (2) A three-CVE chain in LiteLLM (CVSS 9.9) is actively exploited and in CISA's KEV catalog — upgrade to v1.83.14-stable and rotate all provider API keys immediately. (3) Fifteen malicious JetBrains Marketplace plugins posing as DeepSeek AI assistants silently exfiltrated API keys from ~70,000 installs. (4) npm v12 (July 2026) will block install scripts by default — testable now in npm 11.16.0. Also covered: FortiSandbox RCEs under active exploitation, a Vertex AI Python SDK bucket-squatting RCE, NHI market consolidation via 1Password/Apono and SailPoint/Entro acquisitions, a China-nexus rootkit targeting governments, and a FIFA World Cup broadcast API exposure.

AUR malware hits 1,500+ packages, LiteLLM CVSS 9.9 chain under active exploitation