Incident
The authoritative retained-artifact reconciliation found and automatically quarantined four historical Vault macOS artifacts on 2026-07-30.
Evidence: Backfill run 30515482539, jobs backfill (shard:3/32:2/8) (90784247582) and backfill (shard:3/32:0/8) (90784247573); and continuation run 30521434475, job backfill (shard:3/32:7/8) (90802544104).
| Package | Platform | Artifact SHA-256 | Verdict | Signature |
|---|---|---|---|---|
vaultproject.io@2.0.1 | darwin-x86-64 | abc4ec8dcc5c0c48cd9a62795e31ae0ac23c12a49e486ca5f64575d182e2c27d | blocked | Macos.Infostealer.Amos-10056367-1 |
vaultproject.io@2.0.1 | darwin-arm64 | b6d09e86f7693c4479fe2e89d34cacbc34ede8ec2c5a9819afcaf63d83c25bb3 | blocked | Macos.Infostealer.Amos-10056367-1 |
vaultproject.io@2.0.2 | darwin-arm64 | adcf7d117296e3fe50a99889e9a052579f450c50d66bbbafddc4217e644a88de | blocked | Macos.Infostealer.Amos-10056367-1 |
vaultproject.io@2.0.2 | darwin-x86-64 | a8368949b46dbb306373ca4c74b93b9d88e5a018e77f8c1c74dce95aa5611acb | blocked | Macos.Infostealer.Amos-10056367-1 |
Scanner evidence for all four: ClamAV 1.5.3; database 28076 for the first three and 28077 for the fourth. The Registry copied the exact bytes and scan record into its private malware quarantine, removed every matching installable metadata reference, and deleted the original tarball/checksum/attestation objects.
Security invariants
- Do not restore or allow any digest based only on package identity or expected dual-use behavior.
- Preserve quarantined bytes and scan evidence privately for review; do not publish contents.
- Do not allow pkgx fallback augmentation to re-advertise a quarantined
(domain, version, platform)tuple. - A successful quarantine is a completed security action; catalog reconciliation must continue and still prove zero installable unattested artifacts.
Acceptance criteria
- Durable quarantine tombstones suppress fallback re-advertisement across process restarts/deploys.
- Public metadata and tarball/checksum routes do not expose quarantined artifacts.
- Tests prove quarantine removes installable references and fallback cannot recreate them.
- The catalog backfill can continue after a successful quarantine while retaining a prominent audit warning.
- Compare the exact artifacts with authoritative upstream release checksums/signatures and document whether this is upstream compromise, repackaging compromise, or a false positive.
- Reproduce the suspected false positive with current signatures and document the ClamAV/vendor review path; no digest allowlist was added.
- Close only after production strict-enforcement proof and the zero-gap retained-object audit pass.
Refs #220
Refs #224
Refs #226