Security guides

Each guide answers one question about a security incident in developer software: am I affected, which version fixes it, and what to check. Facts come from the vendor, advisory or research sources listed on each guide and from FixLane's verified incident data.

• Shai-Hulud worm: how to check if you are affected
  Check for the Shai-Hulud npm worm: known bad versions, the files it leaves, and why you must not revoke tokens before its token monitor is removed.
• How to check if an npm package is compromised
  Did a malicious npm version reach your machine? List exact installed versions, compare with known bad releases, and see what npm audit misses.
• keyv and cacheable npm supply chain attack (keyv 6.0.0)
  keyv 6.0.0 and 400+ npm packages were hijacked on 4 Aug 2026. Bad versions, files to look for, and the safe order to remove it and rotate secrets.
• Backdoored Claude Code extension in Cursor (2.1.312 and 2.1.313)
  Who is affected by the trojanized Claude Code extension on Cursor, how to find the SSH key it plants, and why updating is not enough.
• Git CVE-2026-111760: a recursive clone can run attacker code
  Git 2.56.1 and 2.50.2 to 2.55.1 fix CVE-2026-111760: a recursive clone of a malicious repo runs its code. Check your version.
• OpenSSH CVE-2026-123158: password bypass on Alpine and other musl systems
  sshd before 10.6p2 on musl Linux without PAM, such as Alpine, accepts some long wrong passwords. Exploited per CISA. Who is affected.
• Chrome zero-day CVE-2026-125350: which version fixes it
  Google says an exploit for CVE-2026-125350 exists in the wild. Chrome 157.0.8103.50 fixes it. How to check your version, with or without updating.
• Outlook zero-day CVE-2026-124194: what it does and how to patch
  The Outlook spoofing zero-day fixed in November 2026 Patch Tuesday was used to steal NTLM hashes. Affected Office versions and how to update.
• wfx-loot: CI secret stealer pushed through compromised GitHub accounts
  Since 10 Nov 2026, stolen GitHub accounts open docs: dependency audit notes PRs and push a CI secret stealer. Signs to search for and what to rotate.
• Fake Homebrew installers and a trojanized pyenv: how to check a Mac
  The Binance theft began with a tampered Homebrew install and a fake interview task that swapped pyenv. How the lures work, what to check.
• A free CVE and vulnerability lookup MCP server
  Connect Claude Code, Codex, Cursor or ChatGPT to FixLane's free, read-only MCP server to check software and CVE ids against fixed versions.