[rapuncel]

September 19, 2026

• Fake LastPass Authenticator repositories on GitHub pushed a new infostealer, Rapuncel (BleepingComputer). Separately, analysts assess the PhantomRaven npm stealer was likely built with an LLM by someone claiming to be a bug bounty hunter (The Hacker News). · Supply Chain & Malicious Packages

in From a Help Forum to OpenAI's Monorepo in 72 Hours