Start with Identity
Subscribe
This Week in Identity · Issue 17 · 2026-10-13 · Covers 2026-10-07 to 2026-10-13

This Week in Identity, Issue 17

Issue 17 of This Week in Identity. Most of the week's credentials belonged to pipelines, agents and service accounts rather than people, and the one human password that made the news was "123456".

In brief

  • The Tensorlake npm SDK shipped a Shai-Hulud credential stealer in version 0.5.144, published by the project's own release workflow with valid provenance. If the stolen GitHub token is revoked first, a planted monitor deletes the victim's home directory, so persistence has to be removed before rotation.
  • Bloom Security found that npm trusted publishing matched GitHub repositories by owner and name until a package's first publish, so anyone who reclaimed a freed name could publish to more than 1,500 packages. npm now expires unvalidated configurations after 48 hours.
  • Someone misused a private company's lawful search access to Denmark's Central Person Register and pulled names, addresses and CPR numbers for about 8.8 million people, with about 14 million automated searches going unnoticed for about two weeks.

The big story

Shai-Hulud reached the Tensorlake SDK, and revoking the stolen token first wipes the home directory. According to StepSecurity, a malicious commit landed directly on the main branch of the Tensorlake repository under a maintainer's name on October 7, and the repository's own release workflow published tensorlake@0.5.144 the next day, so the package carried valid provenance. A preinstall hook runs a payload that takes npm, GitHub, AWS, Kubernetes and HashiCorp Vault credentials, SSH keys and .env files, then republishes the victim's other packages. It also installs a gh-token-monitor service that checks the stolen GitHub token every 60 seconds and wipes the home directory once it is revoked. Tensorlake released 0.5.145; how the attacker got the maintainer's access is not public.

Why it matters: provenance proved the package came from the real repository's workflow, and the attacker was inside that repository. The control that failed was the identity allowed to push to main without review, sitting upstream of a release pipeline that trusts whatever is on main. Treat push rights on release branches as a publishing credential, with branch protection and required review. And change the incident playbook: on any host that ran the install, remove the persistence, then rotate npm, cloud, Vault and SSH credentials, then rebuild. Source: Shai-Hulud reaches the Tensorlake npm SDK.

Patch this week

  • CVE-2026-107406, NetScaler ADC and Gateway configured for SAML. CVSS v4.0 9.5, can lead to remote code execution, no exploitation reported. It still affects identity-provider builds through 14.1-73.41 and 13.1-64.28, so last week's fix for the exploited CVE-2026-88779 is not enough. Upgrade to 14.1-73.46 or 13.1-64.29. Brief.
  • CVE-2026-89111, SAP Cloud SDK for Python. CVSS 10.0. Whoever controls the tenant subdomain in a multi-tenant SAP BTP app can redirect its OAuth2 token request and capture the client ID and secret. Fixed in 0.45.2, but the check was missing again in 0.53.0 to 0.55.0 and the 0.36 line; run 0.55.1 or later and rotate the client secret. Brief.
  • CVE-2026-102255, SonicWall SMA1000. CVSS 10.0 pre-authentication server-side request forgery in the WorkPlace interface, no workaround. Fixed in 12.4.3-03670 and 12.5.0-03082. No exploitation reported at disclosure. Post.

The pattern

Four stories this week were the same mistake in different places: a credential that proves who a workload is, trusted on the strength of something an attacker could reach. Tensorlake's release workflow trusted whoever could push to main. npm trusted publishing trusted a repository name that could be re-registered. An AWS AgentCore agent handed its execution role credentials to anyone who could write it a prompt, and that default role reached every agent in the region. The SAP SDK sent an OAuth client secret wherever the tenant subdomain pointed. None of these is a password problem, and none shows up in an access review built from the HR system. See secrets in repositories and CI, static API key abuse and agent instruction injection.

What else happened

  • SlugFest: npm trusted publishing trusted repository names, per Bloom Security, exposing more than 1,500 packages with over 10 million downloads, with no confirmed exploitation. npm now expires unused trusted publishing configurations after 48 hours and rejects tokens from issue_comment workflow events. Review every trusted publisher you configured but never used. Post.
  • One prompt pulled AWS AgentCore role credentials from the instance metadata service, Zenity Labs showed. The default role could invoke other agents, read their conversations, plant memories and read Secrets Manager. AWS has since narrowed it and calls the behavior documented. Give each agent its own role scoped to its own tools. Post.
  • Denmark's CPR register was queried 14 million times through one company's account. The breach was noticed on October 2, when a ministry employee spotted an unusually high invoice. A person claiming responsibility says the password was "123456"; authorities have not confirmed it. Delegated access to a national register needs the controls of the register, not the contractor. Post.
  • The FBI and Secret Service say FortiBleed is still active, scanning FortiGate VPNs with stolen logins across more than 86,644 compromised devices by SOCRadar's count. Some victims are locked out after attackers replace the original admin accounts. No vulnerability is involved; reset local admin credentials and hunt for accounts such as forticloud-sync. Post.
  • The ASOS breach began with an employee tricked out of their login by someone impersonating a trusted contact, then reached customer data on third-party platforms. Snowflake says nothing on its side was at fault. Help-desk social engineering reaches SaaS data as easily as it reaches the directory. Post.
  • Dexcom says targeted vishing calls gave an unauthorized party access to limited information in internal documents, with no product impact. Voice phishing remains the entry point in this wave of breaches. Post.
  • UAT-11985 targets Taiwan research affiliates with fake event invites that relay Google passwords and MFA challenges through an adversary-in-the-middle page, per Cisco Talos. Post.
  • Workday will acquire C1.ai, formerly ConductorOne, to govern access for people and AI agents from the HR lifecycle. Price undisclosed, close expected by January 31, 2027. HR as the source of truth for agent identities is new, and worth testing against agents nobody hired. Post.
  • IonQ will acquire Elisity for up to $1.3 billion in stock, pairing identity-based microsegmentation with a quantum computing company. Close is expected in Q4 2026. Post.

New from Start with Identity

  • The acquisitions tracker records Workday and C1.ai and IonQ and Elisity, and the C1.ai profile now shows the pending deal.
  • Eighteen news posts across the two weeks since Issue 15, each verified against its primary source, with three new identity CVE briefs for NetScaler and SAP.

From the community

We are recruiting volunteers: news curators, country ambassadors, and jobs scouts. A few hours a week, credited by name.

That's Issue 17. Subscribe for the next one.

Free to read and share. Independent and community-driven, no sponsorship. Subscribe to get the next issue.