Loading story…
The Wikimedia Foundation responded to a security incident in which a self-propagating JavaScript worm vandalized pages and modified user scripts across multiple wiki projects, including Wikipedia. Editors reported waves of automated edits that inserted hidden JavaScript loaders and random vandalism, prompting Wikimedia engineers to temporarily restrict editing while investigating and reverting malicious changes.
Reporting indicates the outbreak began after a malicious script hosted on Russian Wikipedia (notably User:Ololoshka562/test.js, previously uploaded and allegedly tied to earlier wiki attacks) was executed, leading to infection of both user-level and global JavaScript. The worm propagated by injecting loaders into User:<username>/common.js and the global MediaWiki:Common.js, enabling it to run in other editors’ browsers and spread further when accounts with sufficient privileges were affected. Approximately 3,996 pages were modified and about 85 users had their common.js overwritten before containment actions and mass reverts began; it remains unclear whether the initial execution was accidental testing activity, intentional, or the result of account compromise.
See attribution, scope, and your downstream exposure.
4 events from the most recent confirmed update back to the earliest known activity.
Wikimedia staff rolled back affected scripts, suppressed modified pages from change histories, removed the injected code, and restored editing access. At the time of reporting, no detailed post-incident report had yet been published.
Editors first noticed the malicious activity on Wikipedia's Village Pump (technical), prompting Wikimedia engineers to investigate, revert changes, and temporarily restrict editing across affected projects.
The self-propagating worm spread across Wikimedia projects, editing random pages to insert vandalism and hidden JavaScript loaders while replacing about 85 users' common.js files. Reporting estimated that roughly 3,996 pages were modified.
A malicious user script hosted on Russian Wikipedia, identified as User:Ololoshka562/test.js, was executed in editors' browsers and began propagating by overwriting users' common.js files and, where privileges allowed, the global MediaWiki:Common.js.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution, scope, and whether this vendor sits anywhere in your supply chain.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
dCERT issued an advisory for **multiple vulnerabilities in MediaWiki**, followed by a second advisory covering **multiple vulnerabilities in MediaWiki extensions that allow cross-site scripting (XSS)**. The notices indicate that organizations running MediaWiki-based platforms may be exposed through flaws in both the core software and its extension ecosystem. The combined advisories point to a broader security issue for MediaWiki deployments, where weaknesses in core components and add-on extensions can increase the risk of malicious script injection and related compromise of user sessions or administrative actions. Organizations using MediaWiki should review affected versions, assess installed extensions, and apply vendor fixes or mitigations as they become available.
Jun 29, 2026
Wikipedia’s English-language community moved to **deprecate and spam-blacklist Archive.today** (including related domains such as *archive.is* and *archive.ph*) and begin removing its links across the encyclopedia after allegations that the service **“hijacks users’ computers”** to participate in a **distributed denial-of-service (DDoS)** attack. Editors cited reports that visitors to Archive.today’s CAPTCHA page unknowingly executed JavaScript that generated requests to blogger **Jani Patokallio’s** Gyrovague site, allegedly to drive up hosting costs and force attention; Wikipedia discussions referenced this behavior as incompatible with external-linking policies and initiated steps to block new links and remove existing ones. During the deprecation discussion, editors also raised integrity concerns, citing evidence that Archive.today **altered archived snapshots**—including inserting references to the targeted blogger—undermining the service’s reliability as a citation source. The decision affects a large footprint on Wikipedia (reported as **~695,000 links** across roughly **~400,000 pages**), with editors noting that many uses can be replaced by other archives; Ars Technica also reported that Archive.today is subject to an investigation in which the **FBI is attempting to identify the site’s founder/operator**, whose identity has been described as opaque.
Jun 29, 2026
Researchers reported a worm-enabled npm supply-chain attack dubbed **CanisterWorm** that backdoored at least 29 legitimate packages, including 28 in the `@EmilGroup` scope and `@teale.io/eslint-config`. The attackers appear to have used stolen npm publishing tokens or equivalent CI/CD access to replace package contents, republish trojanized updates under the latest tag, and spread the malware across additional packages available to the compromised credentials. Aikido linked the activity to **TeamPCP** and assessed it as a likely follow-on from the earlier Trivy compromise, while Socket said the operation showed high-confidence signs of a legitimate publisher-space takeover with worm-like propagation. The infection chain used a Node.js `postinstall` loader, a Python backdoor, and an Internet Computer Protocol canister as a dead-drop command-and-control channel for dynamic payload delivery. On Linux, the malware established persistence through a user-level systemd service, disguised files as PostgreSQL-related artifacts, delayed execution to evade sandboxing, and used a propagation script to enumerate publishable packages, bump patch versions, preserve READMEs, and publish malicious updates at scale. At the time of reporting, the ICP canister returned a Rickroll URL as a dormant kill switch, but researchers warned it could be changed at any time to deliver a real second-stage binary to developers, CI runners, and build systems that installed the compromised packages.
Jun 29, 2026