VulnCheck added this to its KEV catalog on 2026-10-07 after its own sensors recorded exploitation attempts and a public exploit is available in XDB, so any Crawl4AI Docker API older than 0.8.0 reachable over the network should be assumed to be a target now.
The Crawl4AI Docker API's /crawl endpoint accepts a hooks parameter containing Python code that is run with exec(), and __import__ was left in the allowed builtins, so an unauthenticated POST can import os and run arbitrary system commands. Successful exploitation gives full control of the crawler host, including reading environment variables and API keys and pivoting to internal services.
Affected: Crawl4AI (pip package / Docker API deployment) < 0.8.0
How to Test
Check the installed crawl4ai package or Docker image version; anything below 0.8.0 with the Docker API running is vulnerable. On 0.8.0 and later, confirm the CRAWL4AI_HOOKS_ENABLED environment variable is not set to true unless every API user is trusted. Review the API's access logs for POST requests to /crawl whose body contains a "hooks" object, especially hook code referencing __import__, os, or subprocess; any such request from an untrusted source should be treated as an exploitation attempt and the host examined for unexpected processes, new files, and exfiltrated environment variables or API keys.
How to Patch
Upgrade to Crawl4AI v0.8.0, which removes __import__ from the allowed builtins and disables hooks by default (CRAWL4AI_HOOKS_ENABLED=false). If you cannot upgrade immediately, disable the Docker API, block the /crawl endpoint at the network level, or put authentication in front of the API.
Supply-Chain Compromisecritical
The version is already pulled from npm but any CI runner or developer laptop that installed it in the publish window is fully compromised and its tokens are being used to propagate the worm into other packages, so credential rotation cannot wait.
The tensorlake TypeScript SDK was compromised and version 0.5.144 was published to npm carrying obfuscated Shai-Hulud/ChainDrop malware that harvests credentials, exfiltrates secrets, establishes persistence and executes remotely supplied code. The malicious release was built from the project's own main branch and shipped through the legitimate GitHub Actions pipeline with a valid npm provenance attestation, so provenance checks did not flag it. The worm steals GitHub, npm and AWS credentials and can republish infected packages from the victim's own tokens.
Affected: tensorlake 0.5.144 (npm)
How to Test
Grep package-lock.json, yarn.lock and pnpm-lock.yaml across all repos for "tensorlake" at 0.5.144 and run `npm ls tensorlake` in build images; check npm/pnpm caches and CI job logs for an install of 0.5.144; on suspect hosts look for the preinstall hook launching package/lib/setup.mjs and the obfuscated package/lib/Math_Symbo* loader; then review GitHub audit logs for unexpected repository creations, workflow changes and new npm publishes made with your tokens, and check AWS CloudTrail for use of developer keys from unfamiliar sources.
How to Mitigate
Remove the package and rebuild — do not trust cleanup of the host — reimage any machine or runner that installed 0.5.144, pin tensorlake to 0.5.143 or later clean release, and rotate GitHub PATs and OAuth grants, npm automation tokens, AWS keys and any .env/CI secrets from a known-clean system — StepSecurity warns that revoking the stolen GitHub token while the worm is still running on the host makes it wipe the user's home directory, so deal with the machine before the token.
Supply-Chain Compromisehigh
Two credible outlets have now named the three packages that remained live and unflagged, so dependency scanners will not have caught them and any project that pulled them has stealer-harvested developer credentials in attacker hands.
Checkmarx and CloudSEK documented a three-year npm campaign (MALFEX) in which a single actor published 12 packages, eight of them malicious, delivering the Overlord Go RAT and the movinlike Node.js stealer that targets browsers, Discord, Telegram and crypto wallets on Windows. OSV advisories exist for six packages, but function-flag — malicious since July 2025 and with more than 37,000 downloads — carried no advisory, and function-flag, function-color and cdn-img-fetch were still installable from the registry as of October 1.
Affected: npm function-flag (all versions); npm function-color; npm cdn-img-fetch; npm tlxbnhd; npm tldriver; npm mxdriver; npm img-to-native; npm native-runner
How to Test
Run `npm ls function-flag function-color cdn-img-fetch tlxbnhd tldriver mxdriver img-to-native native-runner` across repos and grep all lockfiles for those names; check the npm cache and CI install logs going back to July 2025 for function-flag in particular, and on Windows build agents look for Go-based Overlord loader processes beaconing to C2 addresses resolved from Solana transactions and for stealer access to browser, Discord and Telegram credential stores.
How to Mitigate
Remove the packages and replace them with maintained alternatives, block them in your registry proxy or allowlist, reimage affected Windows developer and build hosts, and rotate browser-stored credentials, developer tokens and any wallet keys that were present on those machines.