Daily Brief — October 8, 2026

• The MALFEX activity is attributed to an actor that published 12 packages since August 2023; eight have been flagged as malicious.
• The eight malicious packages were downloaded 40,767 times and used three infection pathways against Windows systems, including Overlord RAT, a Node.js stealer and a downloader.
• TensorLake npm SDK version 0.5.144 was compromised in a ChainDrop/Shai-Hulud attack that delivered credential-stealing malware.
• The MALFEX packages used an npm postinstall supply-chain campaign, making dependency installation itself the execution point.

Bottom line If you build or run npm software, review installs and lockfiles now; investigate TensorLake 0.5.144 use and rotate credentials that may have been exposed.

• DevDay 2026's official recap lists more than 20 announcements spanning GPT-6 Astra, ChatGPT, Codex, APIs, and security tools.
• OpenAI's follow-on developer updates include GPT-6.1 Sol, computer use for the Agents API, cloud-based Codex environments, a Decisions API, and new ChatGPT plugin capabilities.
• A reported comparison says GPT-6.1 Sol matched GPT-6 Astra's accuracy at 18% of the cost.
• OpenAI reported that GPT-6 Astra completed a 50-tab tax workbook twice as fast as GPT-5.6 Sol for Basis.
• Caveat: Astra's reported speed and cost comparisons are workload-specific and do not establish equivalent results across production systems.

Bottom line Teams evaluating the DevDay stack should treat Astra, Codex cloud environments, and decision APIs as a broader platform rollout, then validate workload-specific cost and accuracy before adoption.

• The .gh, .sl and .as registries were hijacked, putting any domain under those suffixes at risk.
• Attackers obtained 12 unauthorized certificates for Google and YouTube domains.
• Google said its own systems were not breached; the exposure came through control of the registries and certificate issuance.
• Chrome used CRLSets to block the unauthorized Google certificates, and the issuing certificate authorities revoked them.
• The certificates could let attackers impersonate legitimate sites without the usual browser certificate warnings and read private data sent to them.

Bottom line If you operate domains under .gh, .sl or .as, audit their certificates and registry control immediately; otherwise, review how your clients respond to emergency certificate blocks.