A quiet weekend: Checkmarx detailed an npm supply chain campaign that hides its loader inside a btree library to slip past install-script blocks, researchers published two escapes from the OpenAI Codex sandbox, ransomware groups added a fresh batch of leak site victims, and CNN reported that an AI-assisted intelligence report nearly triggered a US operation against a Chinese ship.
🟠 HIGH (1)
Malicious npm packages hide loader inside a btree library to evade install-script blocks Confirmed
Checkmarx researchers detailed an ongoing supply chain campaign built around indexed-btree, an npm package that impersonates the legitimate sorted-btree library and has reached about 2 million weekly downloads. The loader sits inside the package’s own BTree.prototype.set() method, so it runs only when an application uses the library, which means installation looks clean and the dependency lifecycle script blocks npm introduced in June 2026 never trigger. Once active it collects host details such as architecture, CPU, memory and uptime, exfiltrates them through hardcoded Slack and Telegram channels, and polls a smart contract on the Ethereum Sepolia testnet for command and control, using an X25519 key exchange to decrypt a second stage; it can also delete its files and remove the trigger to erase traces. Checkmarx found nine further packages from the same operation, among them btree-core with 1.95 million downloads, and npm has since replaced indexed-btree with a security holding package. Anyone who installed these packages should rotate secrets and rebuild the development environment, and teams should add runtime behavioural monitoring rather than relying on install-time scanning alone.
Sources Checkmarx|BleepingComputer
🟡 MEDIUM (2)
Researchers escape the OpenAI Codex sandbox twice, one path working from read-only mode Confirmed
Oren Yomtov of Accomplish AI found two ways out of the OpenAI Codex sandbox and reported both to OpenAI on 12 August 2026, with fixes landing inside eight days. The first, Overpatch, abuses Codex’s own apply_patch tool: it grants write access to the parent folder of every path named in a patch, so naming /tmp hands over the whole disk, letting a patch write outside the workspace in the normal agent mode with no approval prompt. The second, Heapjack, targets the node_repl JavaScript tool that Codex Desktop writes into the shared ~/.codex/config.toml at install time with no way to opt out; trusted and untrusted code run in one Node process and share one memory heap, so the untrusted side can snapshot the heap, recover the trust token and drive the unsandboxed parent process, which the researchers used to launch an application outside Codex’s process tree and to reach any Unix socket, including the Docker daemon socket, all while the sandbox was in read-only mode. In practice, opening an untrusted repository in Codex and asking a question about the code was enough for the repository author to get unsandboxed command execution. Both issues are patched, so teams should run a current Codex release and treat agent sandboxes as a boundary to test rather than to assume.
Sources Accomplish AI|BleepingComputer
Ransomware groups add a fresh batch of leak site victims, including Fanatics and Touring Club Suisse Unconfirmed report
Ransomware and extortion groups listed a batch of new victims on their leak sites in the last day, according to the ransomware.live tracker. The Qilin group posted Zorlu Holding, a Turkish industrial group, the ShopDunk retail brand and Touring Club Suisse, while the N0n group claimed the sports commerce platform Fanatics, alongside smaller groups listing a US women’s health clinic and Great Bay Bio in Hong Kong. None of the claims have been independently confirmed and the listings show little about what data, if any, was taken, so treat them as unverified. Organisations named in such claims should assume that credentials and access paths behind them need review, and defenders elsewhere can use the pattern to check whether their own suppliers or regional peers appear on the same panels.
Sources ransomware.live
⚪ WATCH (1)
CNN: AI-assisted intelligence report almost triggered a US operation against a Chinese ship Confirmed
CNN reported that a false, AI-assisted intelligence report nearly triggered a US military operation against a Chinese vessel in the Middle East during this spring’s war with Iran. Four sources told CNN that the assessment was produced by an analyst at US Special Operations Command Pacific in Hawaii who asked a chatbot to analyse reporting on the ship’s manifest; the chatbot fused open source information with classified signals intelligence and reached the wrong conclusion that the vessel carried components of a nuclear weapons programme, and the analyst then used AI again to turn that result into a standard formatted intelligence report. Armed boarding teams and aircraft were readied before officials examined the underlying material and found the report entirely false. The case shows how quickly a confident error can travel once it is packaged in an authoritative format, and sources said similar mistakes have appeared elsewhere in the intelligence community with no common system for verifying what these tools produce before it reaches decision makers.
Sources CNN via Security Affairs|Engadget
Methodology: compiled from vendor advisories, government feeds (CISA KEV, MSRC), security news sources and on-chain/security-firm alerts. Grouping: one incident, one entry, with every source cited. Unconfirmed reports are labeled. Crypto items are incident reporting, not investment advice. Corrections from prior digests are noted at the top when applicable.