Conversation
kurtpayne
force-pushed
the
chore/pattern-update-20260406-0eac
branch
from
f534244 to
3cb73b0
Compare
…entic RCE [2026.04.06.1] - SUP-029 (critical): 36 malicious npm packages disguised as Strapi CMS plugins deploying Redis RCE, credential harvesting, and persistent C2 implants via postinstall scripts. Authors: umarbek1233, kekylf12, tikeqemif26, umar_bektembiev1. Ref: https://thehackernews.com/2026/04/36-malicious-npm-packages-exploited.html - PSV-009 (critical): Langflow Agentic Assistant RCE (CVE-2026-33873) — server-side execution of LLM-generated Python code, potentially leading to full system compromise. - IOC DB: added 4 npm sock-puppet account domains from Strapi campaign - Vuln DB: added langflow 1.0.0 → CVE-2026-33873 (critical, fixed 1.0.1) - Showcases: 147_sup029_strapi_npm_malware, 148_psv009_langflow_agentic_rce - Tests: test_sup029_strapi_npm_malware, test_psv009_langflow_agentic_rce (4 new tests)
kurtpayne
force-pushed
the
chore/pattern-update-20260406-0eac
branch
from
3cb73b0 to
ba22ded
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #180 +/- ##
=======================================
Coverage 77.14% 77.14%
=======================================
Files 30 30
Lines 4095 4095
=======================================
Hits 3159 3159
Misses 936 936 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
kurtpayne
added a commit
to kurtpayne/skillscan-website
that referenced
this pull request
Apr 6, 2026
- Add SUP-029: Malicious Strapi npm packages (Redis RCE / Credential Harvesting) - Add PSV-009: Langflow Agentic Assistant RCE Vulnerability (CVE-2026-33873) - Update SUP count: 28 → 29 - Update PSV count: 8 → 9 - Update ruleCount: 175 → 177 - Update rulepack version: 2026.04.05.1 → 2026.04.06.1 Paired with: kurtpayne/skillscan-security#180
kurtpayne
added a commit
to kurtpayne/skillscan-website
that referenced
this pull request
Apr 6, 2026
- Add SUP-029: Malicious Strapi npm packages (Redis RCE / Credential Harvesting) - Add PSV-009: Langflow Agentic Assistant RCE Vulnerability (CVE-2026-33873) - Update SUP count: 28 → 29 - Update PSV count: 8 → 9 - Update ruleCount: 175 → 177 - Update rulepack version: 2026.04.05.1 → 2026.04.06.1 Paired with: kurtpayne/skillscan-security#180 Co-authored-by: kurtpayne <1012635+kurtpayne@users.noreply.github.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Two new detection rules, IOC enrichment, and vuln DB updates for rulepack
2026.04.06.1.New Rules
SUP-029PSV-009SUP-029 — Malicious Strapi npm packages
36 malicious npm packages disguised as Strapi CMS plugins were discovered in April 2026. These packages use postinstall scripts to exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and drop persistent implants. The campaign specifically targeted a cryptocurrency payment platform (Guardarian).
Authors: umarbek1233, kekylf12, tikeqemif26, umar_bektembiev1
Sources:
PSV-009 — Langflow Agentic Assistant RCE (CVE-2026-33873)
A remote code execution flaw in Langflow Agentic Assistant allows attackers to execute LLM-generated Python code server-side, potentially leading to full system compromise. Fixed in 1.0.1.
Source: https://www.sentinelone.com/vulnerability-database/cve-2026-33873/
Other Changes
langflow1.0.0 → CVE-2026-33873 (critical, fixed 1.0.1)Test Results
All 116 tests pass ✅