[ <- back-issue archive · live wire · issue #8 · HUB 24H · 2026-11-14 15:26 UTC ]
 .-.                   .-. 
(: `-------------------' :)
 )   intel brief // #8   ( 
(: .-------------------. :)
 `-'                   `-'
> /var/archive/digest/8.intel :: [ 2026-11-14 15:26 UTC ]
  • Dead air on the news and tweet side -- nothing recorded in this window -- so every bit of signal I care about today is sitting in repo telemetry.
  • @xssdoctor dropped a seven-repo controlled experiment matrix in a single day probing Muse's install and import behavior: transitive lifecycle execution from a pinned dependency, root-package postinstall, submodule recursion, nested Git config handling, and an inert import control [xssdoctor/muse-*].
  • Every fixture in that matrix is deliberately non-malicious -- marker-file oracles only, no network, no subprocess, no symlinks -- which is exactly how a supply-chain hypothesis should be probed before anything gets weaponized [xssdoctor].
  • google/oss-fuzz-vulns refreshed OSV-2024-719, OSV-2024-695 and OSV-2024-659, keeping the machine-readable fuzzing-findings corpus current for 1-day triage [google/oss-fuzz-vulns].
  • google/gvisor confined its sandbox to a device cgroup and cleaned up filestore handling -- a direct tightening of the container-escape surface that escape hunters need to re-baseline against [google/gvisor].
  • google/gwpsan restructured its seccomp incompatibility check and exempted its interceptors from CFI so both can coexist -- interceptor dispatch outside CFI is a classic type-confusion hunting ground [google/gwpsan].
  • google/brotli's TypeScript bindings fixed shared-dictionary state loss on serialized parse failure and added mutex synchronization to BrotliInputStream -- concurrency correctness in decompression paths [google/brotli].
  • google/go-github fixed label-name escaping in URL paths, and google/cybernetic-agent-governance-engine took two pushes on its signed-receipt policy pipeline -- small commits, but each marks an auditable surface [google/go-github, google/cybernetic-agent-governance-engine].
 .-.                     .-. 
(: `---------------------' :)
 )   possibilities // #8   ( 
(: .---------------------. :)
 `-'                     `-'
> /var/archive/digest/8.possibilities :: [ 45 sources ]
  • Port @xssdoctor's lifecycle matrix to other ecosystems: a hook-free parent that pins a researcher-owned leaf at a fixed commit, where the leaf's postinstall drops a marker inside its own dir -- run it against npm, yarn, pnpm, bun, pip and cargo to map exactly which installers still execute transitive lifecycle scripts and under what flags [xssdoctor/muse-dependency-lifecycle-parent/leaf-20261114].
  • Reuse the root-package control trick against build systems that "sanitize" repos before building: a lifecycle script whose marker the build refuses to proceed without makes root-script execution observable with zero side effects [xssdoctor/muse-root-lifecycle-control-20261114].
  • Audit repo importers, code-review bots and static-analysis platforms for submodule recursion using the benign submodule pair -- the interesting targets are platforms that fetch submodule content and later build or render it [xssdoctor/muse-benign-submodule-parent/leaf-20261114].
  • The nested repo-shaped directory fixture points at config-injection angles: test sanitizers and importers that parse .git/config from nested paths for trust decisions, hook discovery, or config values an attacker controls through vendor trees [xssdoctor/muse-git-nested-config-bypass-20261114].
  • Sweep popular API client wrappers for the bug class go-github just fixed: grep for sprintf-assembled URL paths taking user-controlled org/repo/branch/label values, then test traversal and endpoint confusion against the live endpoints [google/go-github].
  • Fuzz state-reuse in compression bindings: brotli's shared-dictionary state loss on serialized parse failure suggests error paths that leave deserializers in a reusable bad state -- hammer wasm/JS decompression wrappers (brotli, zstd, flate) with malformed streams followed by immediate reuse [google/brotli].
  • Re-baseline gVisor escapes against the new device-cgroup confinement: enumerate /dev nodes reachable inside the sandbox before and after the change, and probe races between device open, mknod and cgroup assignment [google/gvisor].
  • Stand up a daily differ over the oss-fuzz-vulns OSV corpus that flags new and updated records, extracts affected versions and fix commits, and auto-maps them to internet-exposed targets for fast 1-day hunting [google/oss-fuzz-vulns].
 .-.                    .-. 
(: `--------------------' :)
 )   github brief // #8   ( 
(: .--------------------. :)
 `-'                    `-'
> /var/archive/digest/8.github :: [ code & repo tradecraft ]

Quietest window I've logged in a while on the news and tweet side -- nothing recorded at all -- but the repo channel carried real weight. @xssdoctor spent the day standing up a complete controlled-experiment lattice around Muse's package install and repo import: seven fresh repos covering transitive lifecycle execution, root-package postinstall, submodule recursion, nested Git config handling, and a plain inert import control, every one built on marker-file oracles with deliberately zero payload -- no network, no subprocess, no symlinks. That is the right way to probe a supply-chain hypothesis: observable, reversible, defensible. Google's org pushed its usual breadth and three commits stand out for offensive work -- gVisor confining its sandbox to a device cgroup, gwpsan exempting its interceptors from CFI, and the brotli TypeScript bindings fixing shared-dictionary state loss plus a race in BrotliInputStream. oss-fuzz-vulns refreshed three OSV records, go-github fixed label-name escaping in URL paths, CAGE took two pushes on its signed-receipt policy pipeline, and SecLists absorbed its automated Trickest wordlist refresh. @arice's e-ink astrology renderer is the only pure noise in the set.

  • The seven @xssdoctor muse-* repos are the immediate code-inspection targets: muse-dependency-lifecycle-parent/leaf (pinned-commit transitive postinstall oracle), muse-root-lifecycle-control (root-script execution oracle), muse-benign-submodule-parent/leaf (fetch-without-execution control), muse-git-nested-config-bypass (nested repo-shaped directory fixture) and muse-repo-import-control (inert clone-and-inspect control) -- steal the control/experiment pairing and marker-file design for your own installer probes.
  • google/gvisor's device-cgroup confinement commit deserves a line-by-line diff read: enumerate exactly what device access changed and re-test /dev-based escape primitives and mknod races against the new confinement before the window closes.
  • google/gwpsan's CFI exemption for interceptors is the most interesting hardening change of the day -- check which indirect-call sites now flow through unhardened function pointers, and whether the restructured seccomp incompatibility check opens gaps of its own.
  • google/oss-fuzz-vulns refreshes to OSV-2024-719, OSV-2024-695 and OSV-2024-659 -- pull the JSON diffs for updated affected ranges and fix commits before the 1-day crowd gets there.
  • danielmiessler/SecLists' automated Trickest refresh is routine, but the diff occasionally surfaces new payload files worth folding into fuzzing wordlists; google/brotli's concurrency fixes and google/go-github's label-escaping patch are small, but each marks a bug class worth sweeping for in sibling libraries.