Mastra confirmed today that the ehindero npm account, which was used to distribute malicious packages across the Mastra ecosystem on June 17, belongs to a current active Mastra employee rather than a dormant former contributor as initially reported. The employee was targeted by a threat actor using a hijacked LinkedIn account, was contacted for what appeared to be a professional conversation, joined a call, and clicked a malicious link that compromised his machine and gave the attackers access to his npm publishing credentials.

Microsoft attributed the attack on June 19 with high confidence to Sapphire Sleet, a North Korean state-sponsored threat actor also tracked as BlueNoroff, APT38, and Stardust Chollima. Microsoft noted the same group conducted a near-identical attack on the Axios npm HTTP client in April 2026, confirming a sustained campaign against the npm developer ecosystem. The malware deployed through the Mastra attack targeted 166 cryptocurrency wallet browser extensions and harvested LLM API keys, cloud provider credentials, and general login credentials from affected developer machines.

On systems where the initial payload established command-and-control communication, Sapphire Sleet deployed a separate PowerShell backdoor from different infrastructure. This backdoor installed itself as a persistent service called scdev, running under svchost.exe in the SYSTEM security context with automatic startup at boot, independent of any user login. The backdoor survived reboots and package cleanup. Affected organizations should block the known C2 IP addresses 23.254.164[.]92 and 23.254.164[.]123 at the network perimeter and check for the presence of the scdev service on any machine that was exposed.

Researchers at Calif.io disclosed CVE-2026-47729, nicknamed Squidbleed, this week after discovering it with the assistance of Claude Mythos Preview. The vulnerability is a heap buffer over-read in Squid’s FTP directory-listing parser, introduced in a January 1997 change to the codebase. The bug lies in a whitespace-skipping loop that calls strchr to search for whitespace characters. The C standard defines strchr as also matching the null terminator when the search character is null. When an attacker-controlled FTP server sends a directory listing line that ends immediately after a timestamp, without a null terminator at the expected position, the loop walks off the end of the buffer and reads into adjacent heap memory.

Because Squid reuses freed memory buffers without zeroing them through a custom per-size freelist allocator, the adjacent heap memory frequently contains the contents of a previous user’s HTTP request, including Authorization headers carrying credentials and session tokens. The attacker receives this data as part of what appears to be a valid FTP directory listing response. The attack requires only that the attacker share the same Squid proxy as the victim and can reach an FTP server they control on port 21. Both FTP support and port 21 are enabled in Squid’s default configuration through the Safe_ports ACL.

The exposure is limited to cleartext HTTP traffic and TLS-terminating proxy deployments where Squid decrypts and inspects HTTPS traffic. Standard HTTPS connections, which Squid forwards as opaque CONNECT tunnels, are not affected. The fix is a two-line null-terminator check in the parsing loop, merged to the development branch in April and targeted for release in Squid 7.7. No patched release is currently available.

SecurityWeek published updated FortiBleed figures today confirming that the custom sniffer deployed on compromised FortiGate devices has captured over 110 million credentials since at least February 2026. This total encompasses both the credentials used to initially compromise each device and the credentials captured from live SSL VPN authentication traffic passing through those compromised devices after the fact.

The figure is consistent with the self-feeding mechanism described in yesterday’s brief: compromised devices intercept live VPN traffic and capture authentication credentials from employees connecting through the gateway, feeding those credentials back into the operation continuously. The 86,644 figure from yesterday represents verified working login credentials for individual FortiGate devices. The 110 million figure represents the cumulative credential harvest from all interception activity.

The remediation guidance from Issues 68 and 69 remains unchanged: patch all internet-accessible FortiGate appliances to the latest firmware, rotate all administrator and VPN user credentials after patching, rename or disable factory default and built-in system accounts, and audit authentication logs for unexpected logins from unfamiliar IP addresses or at unusual times.