Check exposure:ChainDrop. Any team whose lockfile, container image or CI cache contains a flagged version (e.g. keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6), or whose repos gained unexpected .claude/ or .vscode/ hook files.
Check exposure:Evil Twin. Developers and teams whose editors install extensions from Open VSX, especially where workspace or devcontainer files auto-install recommended extensions in CI or cloud dev environments.
Do you run any of these? IBM Langflow, Apache Tomcat, N-able N-central. They are being exploited in the wild (CISA KEV). Patch or mitigate if you do; CISA’s federal deadline is 2026-08-07.
npm: 10 critical advisories (flowise-components, flowise). Check with npm audit (or: npm ls <package>).
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.
Langflow is now the most repeatedly exploited AI-agent builder on CISA's list; any network-reachable instance below 1.10.1 should be patched today and checked for compromise.
Must act: Anyone running self-hosted Langflow 1.0.0 through 1.10.0 that is reachable from the internet or an untrusted network.
Can relax: Instances already on 1.10.1 or later that are bound to localhost on a single-user machine; people who do not run Langflow.
Check the version (pip show langflow, or the image tag) and upgrade to 1.10.1 or later: pip install -U 'langflow>=1.10.1'
Remove Langflow from the public internet; put it behind a VPN or an authenticating reverse proxy
Set LANGFLOW_AUTO_LOGIN=false and configure real superuser credentials
These are deep transitive dependencies of ESLint-style tooling and HTTP stacks, so many projects resolved them without choosing them; if a lockfile picked up a flagged version in August 2026, treat that host as compromised.
Must act: Any team whose lockfile, container image or CI cache contains a flagged version (e.g. keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6), or whose repos gained unexpected .claude/ or .vscode/ hook files.
Can relax: Projects whose lockfiles never resolved a flagged version, and installs run with install scripts disabled, did not execute the payload.
Search lockfiles, images and CI caches for flagged versions and setup.mjs / Math_*.js
If a gh-token-monitor service exists, disable and remove it before revoking GitHub tokens
Rotate npm, GitHub, cloud, Kubernetes, Vault, SSH and Terraform credentials from a clean machine
Check whether any of the 77 extension IDs are installed or recommended in your workspaces and remove them; this was reconnaissance, not credential theft, so blanket secret rotation is not needed.
Must act: Developers and teams whose editors install extensions from Open VSX, especially where workspace or devcontainer files auto-install recommended extensions in CI or cloud dev environments.
Can relax: VS Code users who install only from Microsoft's Visual Studio Marketplace, and teams that pin Open VSX extensions by verified publisher and version.
List installed extensions (codium --list-extensions --show-versions, or your editor's equivalent) and compare them with Manifold's published list and Open VSX's malicious list.
Search repositories and dev images for the IDs in .vscode/extensions.json, .devcontainer/devcontainer.json and .devcontainer.json, and remove them.
Uninstall any match (codium --uninstall-extension <id>) and rebuild dev containers or CI images that baked it in.