CVE
CVE-2025-62593
CWE
CWE-94, CWE-295, CWE-352, CWE-494, CWE-506
Affected Surface
- Rust developer workstations, CI runners, and release hosts that resolved arrayref@0.3.10, internment@0.8.7, append-only-vec@0.1.9, or proc-macro1@1.0.107 during the 20 August 2026 exposure window
- Linux developer workstations, CI runners, and Node.js workloads that installed and imported the 14 trojanized RedC2 npm date and streak packages, including via transitive dependencies
- Ray dashboards and Jobs API deployments that relied on browser-request heuristics instead of real authentication
- Python applications, notebooks, scripts, and CI jobs that called `scrambleeer` or `scrambleeeer` on Unix-like hosts, or that replaced trusted networking helpers with `reqcrypts`, `reqcrypt`, or `requests-crypt` during the 20-21 August 2026 publication burst
Welcome to Corgea’s weekly briefing. The briefing covers the most important security findings and research from the week.
This edition covers research published from Wednesday, 19 August through Tuesday, 25 August 2026, excluding items already covered in the 18 August briefing.
Top Article
arrayref, internment, append-only-vec: proc-macro1 build.rs backdoor
The Rust security team deserves response and registry-removal credit for the 20 August crates.io incident, while Wiz, Aikido, JFrog, and StepSecurity deserve public technical-analysis credit for showing how a single typosquatted dependency, proc-macro1, turned ordinary cargo build into remote payload execution. It leads the week because the visible change inside the parent crates was almost trivial, the affected libraries were broadly reused, and the detonation point was build.rs. The republished arrayref, internment, and append-only-vec releases kept close to normal source, but introduced proc-macro1 = "1.0.107", whose build.rs fetched and executed a second stage during compilation. Cargo does not need a runtime import to become a compromise path. Once a lockfile resolved the bad versions, compilation itself crossed the trust boundary.
This is the right companion piece to AsyncAPI’s require-time npm compromise, the keyv/cacheable worm path, and this week’s RedC2 npm import-time loader. The common lesson is that the registry package is often only the wrapper. The real attack surface lives in the build step, import path, or publishing identity that the toolchain already trusts.
More news
14 npm calendar and streak packages launched RedC2 4.0 on import
TrendAI deserves first public disclosure and reverse-engineering credit for the 21 August RedC2 cluster. The important point is where the malware ran: not in preinstall or postinstall, but in dist/index.mjs, where a normal import re-exported harmless date helpers and quietly spawned a detached Linux ELF. The packages still export working helper code from dist/internal/daymath.mjs, but the entrypoint reportedly resolves the bundled binary with import.meta.url, sets execute permissions with fs.chmodSync(binaryPath, 0o755), verifies a hardcoded SHA-256, and launches the payload with a detached child process. That makes the dangerous event “someone imported the package,” not “someone allowed npm lifecycle scripts.”
It is a useful update to the same runtime-execution pattern seen in Joyfill’s import-time RAT chain, ViteVenom, and StubMaker’s RubyGems extconf.rb detonation path, and it belongs beside the arrayref incident and the earlier TanStack compromise. The repeated lesson for defenders is that “we disabled install scripts” only covers one stage of the package lifecycle. Attackers keep moving execution into the next trusted path.
CVE-2025-62593: Ray let Firefox and Safari drive dashboard job RCE
Ray deserves patch credit for replacing the weak User-Agent browser check with stronger Sec-Fetch-* handling, and CISA’s 17 August KEV addition is what turned the issue from an important advisory into a priority remediation item. The vulnerability matters because it collapses a common assumption around local AI infrastructure: a dashboard bound to 127.0.0.1 or tucked inside a private network is not safe if a hostile web page can conscript the victim’s own browser into submitting jobs.
Read this with Langflow’s CORS and refresh-token RCE, Anthropic’s likely anthropickit PyPI incident, and LiteLLM’s CI/CD exposure analysis. All three stories sit on the same boundary: AI tooling often ships powerful local or internal control planes long before teams wrap them in real authentication.
scrambleeer and scrambleeeer: PyPI shuffle helpers opened reverse shells
The freshest new package entry in this window is small, but worth attention because the reverse shell sits directly in the documented helper function. Public analysis places the shell path in src/scrambleeer/core.py and src/scrambleeeer/core.py: open a TCP socket to bax.h4x.tv:6363, duplicate it over stdin, stdout, and stderr, then call pty.spawn("/bin/bash"). The visible shuffle logic still runs after that, which is exactly the kind of detail that helps malicious utility packages survive a shallow review.
This belongs with the reqcrypts cluster below, Joyfill’s import-time RAT chain, and the earlier Telnyx and LiteLLM compromises. The common lesson is that the package’s advertised API surface can be the malware trigger.
Other news:
- reqcrypts turned JSON
_payloadfields into localexec()on PyPI - Kamil Mankowski’s bad-packages tracking and PyPI’s quarantine record provide the clearest public credit trail for this cluster. The danger was not a one-time install hook, but a response-handling path that decoded_payloadfrom JSON and passed it to Pythonexec()before returning data to the caller. That turns a network helper into a delayed code-delivery path: whoever controls the server response gets to choose when the compromise happens. It is a strong companion read to NLTK downloader poisoning, durabletask’s PyPI compromise, and the likely anthropickit incident, because each one hides code execution in a place teams tend to treat as ordinary package plumbing. - For adjacent context, revisit the 18 August briefing, the 11 August briefing, the keyv/cacheable worm, and the earlier TeamPCP campaign summary.
From research to remediation
Check whether this pattern exists in your codebase
Turn this research into a remediation workflow. Scan dependencies and package manifests for similar supply-chain risk, then prioritize fixes with reachability context.