npm Security Archives • Daily CyberSecurity

decompress npm Vulnerability CVE-2026-53486 (CVSS 9.1) Threatens 2.8 Million Weekly Downloads

decompress npm vulnerability CVE-2026-53486 path traversal in Node.js archive extraction

decompress npm Vulnerability CVE-2026-53486 (CVSS 9.1) Threatens 2.8 Million Weekly Downloads

Do Son July 12, 2026

TL;DR A high-severity decompress npm vulnerability lets crafted archives write files outside the extraction folder. Tracked as...

NPM Package Tests AI Malware Scanner Evasion Spirals ransomware double extortion attack chain from IIS web shell to network encryption

NPM Package Tests AI Malware Scanner Evasion

Do Son June 21, 2026

At a glance Malware Family: shai_hulululud (Protestware/Testing) Threat Actor: Unknown (Suspected researcher or troll) Targets: AI-based malware...

GemStuffer RubyGems Campaign RubyGems Data Exfiltration TanStack npm Compromise Supply Chain Attack DNS Hijacking APT28 (Fancy Bear) OpenVSX Supply Chain Attack Checkmarx Plugin Breach Stryker Cyberattack CISA Alert Trans-Regional Cyber Conflict Operation Epic Fury Cyber Operation MacroMaze APT28 Cyber Espionage Notepad++ Supply Chain Attack Lotus Blossom Group Defense Industrial Base Threats GTIG Report APT28 Operation Neusploit CVE-2026-21509 Bookworm Malware

Supply Chain Siege: 84 TanStack Packages Compromised to Steal GitHub Secrets

Do Son May 12, 2026

The software supply chain has just weathered another high-impact assault. The Socket Threat Research team has uncovered...

9.6 Severity: Critical “Cline” AI Agent Flaw Allows Stealthy RCE via Your Browser Cline AI Vulnerability Cross-Origin WebSocket Hijacking

9.6 Severity: Critical “Cline” AI Agent Flaw Allows Stealthy RCE via Your Browser

Do Son May 12, 2026

In the rapidly evolving world of AI-assisted development, tools like Cline have become indispensable, living in editors...

New Quasar Linux (QLNX) RAT Hijacks Cloud Keys and NPM Tokens Quasar Linux RAT Supply Chain Hijacking

New Quasar Linux (QLNX) RAT Hijacks Cloud Keys and NPM Tokens

Do Son May 6, 2026

A previously undocumented Linux remote access trojan (RAT) has been exposed for its surgical precision in targeting...

Backdoored React Native Packages Target Developers with Crypto-Stealing Malware PAN-OS Root RCE CL-STA-1132 Exploitation Tianxin RCE CVE-2021-4473 React Native Supply Chain Attack AstrOOnauta Malware Gladinet Zero-Day, LFI RCE Chain WordPress Theme, Account Takeover CVE-2024-50623 - European Space Agency cyberattack

PAN-OS Root RCE CL-STA-1132 Exploitation Tianxin RCE CVE-2021-4473 React Native Supply Chain Attack AstrOOnauta Malware Gladinet Zero-Day, LFI RCE Chain WordPress Theme, Account Takeover CVE-2024-50623 - European Space Agency cyberattack

Backdoored React Native Packages Target Developers with Crypto-Stealing Malware

Do Son March 16, 2026

The JavaScript development community is on high alert following a coordinated supply chain attack targeting two popular...

North Korean “StegaBin” Campaign Targets Developers with Steganographic Malware North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean Laptop Farm DPRK Insider Threat North Korea WMD Cyber Funding, Australia Sanctions Insider threat, North Korean hackers Kimsuky, cyber-espionage NPM Malware, North Korea Cyber-espionage North Korea, Remote IT Job Scam Laptop Farm - DriverEasy - Kimsuky Watering Hole Attack

North Korean “StegaBin” Campaign Targets Developers with Steganographic Malware

Do Son March 3, 2026

Cybersecurity researchers at Socket have uncovered a sophisticated multi-stage malware operation, dubbed “StegaBin,” specifically designed to harvest...

The Interview Trap: Malicious Next.js Repositories Weaponize Coding Tests to Hack Developers Developer Targeting Campaign Next.js Malware Lures

Developer Targeting Campaign Next.js Malware Lures

The Interview Trap: Malicious Next.js Repositories Weaponize Coding Tests to Hack Developers

Do Son February 27, 2026

The job hunt just got a lot more dangerous for software engineers. Microsoft Defender Experts identified a...

Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

TanStack Typosquatting npm Supply Chain Attack Axios Supply Chain Attack npm Poisoning eScan Supply Chain Attack Antivirus Compromise APT-36, NCERT WhatsApp Advisory FBI alert, Salesforce Salt Typhoon, APT group ConnectWise ScreenConnect hack Nation-state cyberattack FortiGate Leak - zkLend vulnerability - TRIPLESTRENGTH Threat Actor Group Dark Storm

Dream Job or Nightmare? Lazarus Group Hunts Crypto Devs with “Graphalgo” Malware

Do Son February 13, 2026

The notorious North Korean hacking syndicate, Lazarus Group, has launched a new, highly sophisticated branch of its...