PreFlight catches security issues. This is where we explain them — the patterns we look for, the real-world incidents behind the threat-intel, and the architecture shapes that shape (or break) your security posture. Read once, build safer forever.
4 incidents · 4 published · 0 draft
Two April 2026 supply-chain incidents from overlapping actor groups. Bitwarden CLI 2026.4.0 (April 22) shipped a backdoored release of the official password-manager CLI that explicitly hunted Claude, Cursor, and Codex credentials. Seven days later, intercom-client 7.0.4 / 7.0.5 and lightning 2.6.2 / 2.6.3 (April 29) carried the same Mini Shai-Hulud credential stealer with combined ~8.3M downloads exposure.
Updated 2026-05-12April 29, 2026: the second confirmed wave of the Mini Shai-Hulud worm. Targeted SAP CAP toolchain packages including @cap-js/sqlite and @cap-js/db-service. Same threat actor (TeamPCP) that would later run the May 11 TanStack wave at 4x scale. 1,800+ machines compromised, credentials exfiltrated from ~1,200 GitHub repositories.
Updated 2026-05-1284 malicious versions across 42 @tanstack/* packages published in a six-minute window on May 11, 2026, exploiting GitHub Actions to publish with valid SLSA provenance. If you installed any affected version on May 11, your machine and CI environment should be treated as compromised, and there is a specific defensive sequence that matters.
Updated 2026-05-12On March 31, 2026, the DPRK-aligned actor Sapphire Sleet published axios 1.14.1 and 0.30.4 with a hostile dependency on plain-crypto-js. Any install pulled a RAT through axios postinstall. The incident moved npm cooldown advice from "nice to have" to default-on in CI hardening guides.
Updated 2026-05-12