[npm]

October 19, 2026

• MALFEX returned with a native-addon shellcode loader on npm. The imgdecode package uses a nine-line JavaScript wrapper to load a Windows DLL, retrieve encrypted shellcode from GitHub and inject the decrypted payload into dllhost.exe. It had 979 downloads and remained available when the report was published on October 17; the actor has previously replaced removed packages within two days (The Hacker News). · Threat Activity & Supply Chain

in AOMEI Backup Packages Were Swapped in Brief Supply-Chain Bursts

October 15, 2026

• npm blocked malicious changes targeting zod, nub and standard-schema before normal distribution. All three repositories received variants of the same remotely controlled installation loader, but only @nubjs/nub@0.9.4 reached npm’s publishing pipeline. Publish-time scanning quarantined it before public availability; the other two changes were never published. GitHub security advisory · Supply Chain & Hardware Security

in A Crafted Attachment Can Root Cisco’s Secure Email Gateway

October 9, 2026

• The Shai-Hulud / ChainDrop worm jumped to AI infrastructure. Malicious tensorlake v0.5.144 carried a preinstall hook launching an obfuscated loader that runs the worm under Bun, harvesting AWS credentials, Kubernetes creds, Vault and CI secrets, crypto wallets, and configuration/MCP files for Claude, Cursor, Kiro, Windsurf and Zed, plus the HackBrowserData binary. It propagates by enumerating the victim's published packages, building Sigstore provenance and republishing them; C2 resolves through an Ethereum contract (iseekaigogo[.]com) with GitHub as fallback, and a PowerShell "hostage token" monitor polls api.github.com/user to check the stolen token is still valid. The version has been pulled from npm (The Hacker News, The Register). · AI & Model Security

in Third NetScaler RCE in a Month Lands on the Same SAML Surface

October 7, 2026

• The MALFEX npm campaign has been running since August 2023, with eight malicious packages accumulating roughly 40,000 downloads before being caught (SecurityWeek). · Supply Chain

in Pre-Auth File Read Hits Eight Atlassian Data Center Products

October 2, 2026

• Malicious npm package dotenv-async executes a concealed downloader when imported. Version 1.0.0 poses as an environment-configuration utility but hides Windows payload logic in JPEG metadata. The next stage is an unsigned NSIS installer that deploys an obfuscated Electron infostealer targeting browser passwords, cookies, and payment data. Nextron Research · Threat Activity & Supply Chain

in OpenAI Disrupts a Coordinated Model-Reasoning Extraction Campaign

September 24, 2026

• Terraform providers used as a malware channel for the first time. Aikido flagged gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads) in HashiCorp's registry plus two Go modules, delivering Go malware overlapping with the DPRK-linked Graphalgo campaign. Related npm packages take orders from an Ethereum Sepolia testnet contract, keep a second channel over Slack, and inflate download counts with GitHub Actions workers (The Hacker News) (earlier coverage). · Supply Chain & CI/CD
• MemTensor packages compromised on both npm and PyPI to deliver a Go implant dubbed sckit with Windows, Linux and macOS builds, per reports from Aikido, SafeDep, Socket and StepSecurity (The Hacker News). · Supply Chain & CI/CD

in The Exploit Is Public, the Ubuntu Patch Isn't

September 21, 2026

• indexed-btree hides its loader inside BTree.prototype.set() — the function every consumer calls — so installation is clean and npm v12's install-script approval controls never fire. The typosquat of sorted-btree has reached 2 million weekly downloads. Once triggered, it collects architecture, hostname, CPU, memory and uptime, exfiltrates via hardcoded Slack and Telegram channels, and polls an Ethereum smart contract on the Sepolia testnet for C2, using X25519 to derive an AES key for a second-stage payload. It can also delete its files and strip the trigger from the package to erase traces. Checkmarx notes an attacker wallet holding 109 ETH — the report does not claim those funds came from crypto theft — and a curated GitHub repo with fabricated commit history to sell legitimacy (BleepingComputer, Checkmarx). · Supply Chain

in ShinyHunters Takes Cl0p's Leak Site Hostage

September 17, 2026

• Nextron flagged a coordinated npm campaign hiding malicious behaviour in packages posing as runtime, process, layout and image utilities. On import they spawn a hidden Node.js process that fetches and executes code from api.npoint[.]io JSON storage; the payload collects system and network details, steals Chrome extension data, monitors the clipboard and can enable a Windows keylogger. IOCs in the thread. @nextronresearch. · Supply Chain

in One Extension Hijacks the AI Assistant in Five Major Browsers

August 30, 2026

CISA Adds a Kernel Bug That OpenAI's Own Agents Exploited

OpenAI's agents exploited CVE-2026-53362 (a Linux kernel flaw) and a JFrog vulnerability on the company's own infrastructure, prompting CISA to add both to the Known Exploited Vulnerabilities catalog—marking the first KEV entries involving AI agent exploitation. Anthropic is cutting Claude Code usage limits by 17% following demonstrated hijacks of its Opus 5 Auto Mode that succeed roughly 80% of the time via website summarization requests. Rhysida claims 5.79 TB stolen from Berlin's state agencies and is auctioning it; the city has publicly refused to pay ransom ahead of elections. Node.js disclosed six HackerOne-reported vulnerabilities across versions 22.x, 24.x, and 26.x, including HTTP/2 heap use-after-free (CVE-2026-56848) and request smuggling via header truncation (CVE-2026-58044).

August 28, 2026

• A compromised npm release uses Ethereum as a dead drop. Nextron's artifact scanner caught @testrelic/playwright-analytics 2.13.0, whose obfuscated postinstall resolves a C2 (23.27.20.187:443) via an on-chain lookup, then fetches /boot → /init and evals the JS. Nextron suspects a new EtherHiding variant tied to DPRK operators, and published IOCs and samples (Nextron Research). · Supply Chain & Takedowns

in Australia Charges Two Over the TeamPCP Supply-Chain Spree

August 27, 2026

• REDSHELL has changed its packaging again, now shipping the payload as math.mjs instead of .dat/.bin and surfacing in the npm package hydration-vli-ui (v1.0.0) — executables masquerading as script files, which is a workable YARA hunt (Nextron Research, earlier coverage). · Software Supply Chain

in When the Sandbox Isn't a Boundary

August 22, 2026

• 14 trojanised npm packages drop the RedC2 4.0 Linux backdoor, which ships AI-assisted command-and-control functionality (The Hacker News). · Supply Chain

in A CVSS 10.0 Lands in Entra ID — and Microsoft Can't Keep Its Exploitation Story Straight

August 16, 2026

• ChainDrop worm hits the npm supply chain — a self-propagating worm in npm packages is reported to evade standard defenses, the latest in a steady run of registry-borne supply-chain threats. The Register · Threat Activity

in Bring Your Own EDR: Turning a Commercial Endpoint Agent Into a Trojan Horse

August 1, 2026

• Unit 42 flagged a fresh wave of malicious npm and PyPI packages, 65% previously unknown, spanning .env credential theft, crypto-wallet stealers, RCE droppers, and — notably — MCP server backdoors aimed specifically at AI developers (Unit 42). · Supply Chain

in When the Attacker Is a Model: AI Lands on Both Sides of the Fight

July 30, 2026

• Malicious npm packages are delivering RATs on import. Nextron flagged streak-metricazbd, which drops REDSHELL, a low-detection Linux RAT with credential theft, remote execution and persistence (C2 217.60.77.63), while two @joyfill beta packages carry an import-time implant tied to the DEV#POPPER family. Nextron Research, The Hacker News · Threat Activity
• DPRK's BlueNoroff is now linked to the axios, debug, chalk and typo-crypto npm compromises, per new analysis tying the campaigns to a single threat actor. blackorbird · Threat Activity

in OpenAI's Rogue Agent Widens: Four More Companies Caught in the Blast Radius

July 19, 2026

• npm supply-chain attackers exploited a gap in the CI/CD pipeline itself, with Unit 42 also observing an attacker leveraging GitHub Copilot to trigger infection (Unit 42). · Cloud, Identity & Supply Chain

in WordPress "wp2shell" Escalates From Proof-of-Concept to Active Exploitation

July 15, 2026

• Thumper — an open-source tripwire against the Shai-Hulud npm worm (and its evolved cousin "IronWorm"): plant realistic decoy credentials where the worm scans, and get alerted the instant one is read. GitHub · New Tools & Releases
• A coordinated attack abused a GitHub Actions misconfiguration to steal a privileged token and push malicious npm packages into AsyncAPI repos, delivering multi-stage malware for persistence and exfiltration; separately, three packages (solana-key-utils, crypto-validate-lib, eth-wallet-helpers) impersonate blockchain libraries to steal MetaMask, Phantom, Ledger and Trezor credentials. Wiz, Nextron IOCs, CERT-SE · Supply Chain
• 148 npm packages disguised as student web proxies quietly turned visitors' browsers into a DDoS botnet for about two weeks in May, using the registry as free hosting for a booby-trapped proxy site, per JFrog. The Hacker News · Supply Chain

in Record-Breaking Patch Tuesday Ships With Live Active Directory and SharePoint Zero-Days

July 10, 2026

• npm 12 now disables install scripts by default (allowScripts off) and deprecates granular access tokens that bypassed 2FA — a meaningful reduction of the postinstall attack surface. The Hacker News · Supply Chain

in Signed Drivers and Kernel Rootkits Push the Malware Beat Down to Ring 0

June 29, 2026

Public Root Exploit for Linux "pedit COW" Lands as Offensive Tooling Floods the Week

A public exploit for CVE-2026-46331 ("pedit COW"), a critical Linux kernel privilege-escalation flaw, is now actively weaponized as offensive tooling surges, including DriverScope for BYOVD hunting and GitRunner C2 for GitLab-based command-and-control. CVE-2026-55200 in libssh2 also gained a public PoC, enabling client-side code execution from malicious SSH servers. Russian intelligence operators are now stealing Signal Backup Recovery Keys to persistently hijack accounts, while Turla deployed new malware StockStay against Ukraine and ransomware gangs SafePay and RALord show explosive growth alongside emerging leak-site brands SETTRA and REDACT.