npm Archives • Daily CyberSecurity

Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public

Body-parser vulnerability CVE-2026-111181 enables Express denial of service with a single request

Body-Parser Flaw CVE-2026-111181 Lets One Request Crash Express Servers, PoC Public

Do Son October 28, 2026

Body-parser vulnerability CVE-2026-111181 (CVSS 7.5) enables Express denial of service with one request. Upgrade to body-parser 2.4.0 or 1.20.9.

Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code Storybook dev server vulnerability CVE-2026-114125 allows code injection from malicious websites

Storybook dev server vulnerability CVE-2026-114125 allows code injection from malicious websites

Storybook Fixes CVSS 9.4 Dev Server Flaw That Lets Malicious Sites Inject Code

Do Son October 26, 2026

Storybook dev server vulnerability CVE-2026-114125 (CVSS 9.4) enables code injection from malicious websites. Upgrade to 10.6.2, 9.1.21 or 8.6.19.

npm Trusted Publishing Now Expires After 48 Hours npm trusted publishing configuration tied to a GitHub repository name, exposed to a repository name reuse attack before its first publish

npm trusted publishing configuration tied to a GitHub repository name, exposed to a repository name reuse attack before its first publish

npm Trusted Publishing Now Expires After 48 Hours

Do Son October 15, 2026

GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.

TanStack CVE-2026-102989 (CVSS 9.3) Reflected XSS Hits Ecosystem With 98M Monthly Downloads TanStack Start vulnerability CVE-2026-102989 reflected XSS in server function responses

TanStack Start vulnerability CVE-2026-102989 reflected XSS in server function responses

TanStack CVE-2026-102989 (CVSS 9.3) Reflected XSS Hits Ecosystem With 98M Monthly Downloads

Do Son October 14, 2026

A TanStack Start vulnerability, CVE-2026-102989 (CVSS 9.3), allows unauthenticated reflected XSS via crafted links. Upgrade to the patched packages.

Critical Capacitor Flaw CVE-2026-103922 Hits Framework With 5.5M Weekly Downloads Capacitor vulnerability CVE-2026-103922 affects npm package with 5.5 million weekly downloads

Capacitor vulnerability CVE-2026-103922 affects npm package with 5.5 million weekly downloads

Critical Capacitor Flaw CVE-2026-103922 Hits Framework With 5.5M Weekly Downloads

Do Son October 2, 2026

Critical Capacitor vulnerability CVE-2026-103922 (CVSS 9.3) affects a package with 5.5M weekly downloads. Update to a patched release now.

LLM-Generated PhantomRaven Information Stealer Discovered Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

Python NodeStealer malware upgraded with keylogging, clipboard monitoring, screenshot capture, and dual Telegram bot C2 for Facebook data theft

LLM-Generated PhantomRaven Information Stealer Discovered

Do Son September 21, 2026

Learn how the LLM-generated PhantomRaven information stealer targets developers. The PhantomRaven information stealer uses npm to hijack CI/CD secrets.

NPM Typosquatting Malware Targets WSL Developers Diagram showing npm typosquatting malware and the npm typosquatting malware campaign infection chain

Diagram showing npm typosquatting malware and the npm typosquatting malware campaign infection chain

NPM Typosquatting Malware Targets WSL Developers

Do Son August 31, 2026

A new npm typosquatting malware campaign targets WSL environments to steal crypto wallets. Learn how this npm typosquatting malware infects systems.

npm Supply Chain Attack Hijacks Keyv and Spreads Shai-Hulud Malware npm supply chain attack on keyv and cacheable packages spreading Shai-Hulud malware credential stealer to CI/CD pipelines

npm supply chain attack on keyv and cacheable packages spreading Shai-Hulud malware credential stealer to CI/CD pipelines

npm Supply Chain Attack Hijacks Keyv and Spreads Shai-Hulud Malware

Do Son August 4, 2026

A new npm supply chain attack hijacked keyv and dozens of packages, spreading Shai-Hulud malware that steals cloud and CI/CD secrets. Rotate keys now.

Amazon Links North Korean Hackers to NPM Supply Chain Attacks North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

North Korean hackers behind open-source supply chain attacks on axios, debug, and chalk NPM packages

Amazon Links North Korean Hackers to NPM Supply Chain Attacks

Do Son August 4, 2026

Amazon ties North Korean hackers to open-source supply chain attacks on the axios, debug, and chalk NPM packages. Here's how the campaign worked.

Vitest Flaw Rated CVSS 9.4 Hits an npm Package With 65 Million Weekly Downloads Vitest vulnerability in Browser Mode bypassing the file-access permission gate (CVSS 9.4)

Vitest vulnerability in Browser Mode bypassing the file-access permission gate (CVSS 9.4)

Vitest Flaw Rated CVSS 9.4 Hits an npm Package With 65 Million Weekly Downloads

Do Son July 22, 2026

A Vitest vulnerability rated CVSS 9.4 lets Browser Mode commands bypass the file-access gate. The npm package sees 65M weekly downloads.

North Korea-Linked PolinRider Supply Chain Attack Expands Across Open Source

PolinRider supply chain attack diagram showing North Korean hackers hiding loaders in open-source packages

North Korea-Linked PolinRider Supply Chain Attack Expands Across Open Source

Do Son July 9, 2026

Socket links the PolinRider supply chain attack to North Korean hackers. The campaign hid loaders in 108 open-source packages across four ecosystems.

Four undici Vulnerabilities Affect a Package With 133M Weekly Downloads undici vulnerabilities in the Node.js HTTP client affecting a package with 133M weekly downloads

undici vulnerabilities in the Node.js HTTP client affecting a package with 133M weekly downloads

Four undici Vulnerabilities Affect a Package With 133M Weekly Downloads

Do Son June 22, 2026

Four undici vulnerabilities (CVE-2026-6734, CVE-2026-9697) affect the Node.js HTTP client, which sees 133M weekly downloads. Update undici now.

Mastra Supply Chain Attack Compromises 140+ npm Packages Mastra supply chain attack delivering an npm infostealer through the typosquatted easy-day-js dependency during npm install

Mastra supply chain attack delivering an npm infostealer through the typosquatted easy-day-js dependency during npm install

Mastra Supply Chain Attack Compromises 140+ npm Packages

Do Son June 17, 2026

A Mastra supply chain attack compromised 140+ npm packages, using the typosquatted easy-day-js dependency to drop a crypto-stealing infostealer.

Vitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633) Vitest RCE vulnerability CVE-2026-53633, Browser Mode RCE, config file overwrite Vitest remote code execution critical 9.8 CVSS flaws

Vitest RCE vulnerability CVE-2026-53633, Browser Mode RCE, config file overwrite Vitest remote code execution critical 9.8 CVSS flaws

Vitest RCE Vulnerability (CVSS 9.8): Public PoC Disclosed for Testing Tool With 57M Weekly Downloads (CVE-2026-53633)

Do Son June 16, 2026

A critical Vitest RCE vulnerability (CVE-2026-53633, CVSS 9.8) has public PoC code. Browser Mode flaw enables config overwrite and remote code execution.

Minirat’s Stealth Supply Chain Attack Targets macOS Developers Minirat macOS Malware Go-based RAT

Minirat’s Stealth Supply Chain Attack Targets macOS Developers

Do Son May 1, 2026

Minirat, a Go-based macOS RAT, exploits npm supply chains to bypass security. It features VM detection, AES encryption, and persistence. Secure your dev tools.

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm npm Supply Chain Attack DPRK Malware Factory

The Malware Factory: Unmasking the 108-Package North Korean Siege on npm

Do Son April 29, 2026

Panther Research exposes a massive 2026 DPRK npm campaign using blockchain dead-drops to steal crypto keys and AI secrets. Secure your CI/CD pipelines now.

TeamPCP Hijacks Checkmarx in Sprawling Supply Chain Strike Checkmarx Supply Chain Attack TeamPCP

TeamPCP Hijacks Checkmarx in Sprawling Supply Chain Strike

Do Son April 23, 2026

Checkmarx Docker images and VS Code extensions hijacked by TeamPCP to siphon cloud secrets and spread via npm. Audit your "Dune" repositories today.

The Next.js Nightmare? Vercel Investigates “Critical” Internal Breach and Supply Chain Threat Vercel Supply Chain Next.js Security

The Next.js Nightmare? Vercel Investigates “Critical” Internal Breach and Supply Chain Threat

Do Son April 19, 2026

Vercel investigates a major breach by ShinyHunters. With Next.js source code and tokens at risk, developers must rotate secrets immediately. Stay updated.

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

Seedworm Espionage Campaign 2026 ChromElevator Stealer DLL Sideloading SIM Swapping Crypto Theft Lazarus Comebacker, Aerospace Espionage Delete PlugX Malware

North Korea’s “OtterCookie” Hides Inside Benign npm Wrappers

Do Son April 16, 2026

Panther uncovers "OtterCookie," a North Korean npm campaign hiding malware in benign wrappers. It steals crypto wallets and installs SSH backdoors. Audit now!

The 1,700-Package Blitz: North Korea’s “Contagious Interview” Infiltrates Every Major Dev Registry Contagious Interview Malicious Packages

The 1,700-Package Blitz: North Korea’s “Contagious Interview” Infiltrates Every Major Dev Registry

Do Son April 8, 2026

North Korea’s "Contagious Interview" campaign expands to 1,700+ malicious packages across npm, PyPI, and more. Learn how to protect your dev environment.

Malicious VeloraDEX SDK Compromises Developer Machines via npm npm Supply Chain Attack @velora-dex/sdk Malware

Malicious VeloraDEX SDK Compromises Developer Machines via npm

Do Son April 8, 2026

A malicious update to @velora-dex/sdk (v9.4.1) drops a stealthy macOS backdoor on import. Learn how to detect the zsh.profiler infection and rotate secrets.

The Human Variable: How a Masterful Phishing Ruse Hijacked Axios and 100 Million Users Axios proxy vulnerabilities prototype pollution gadget Axios Vulnerability Cloud Hijacking Axios npm supply chain attack Axios Vulnerability Node.js DoS CVE-2025-58754 CVE-2025-27152 Axios Vulnerability, Form-Data Flaw

Axios proxy vulnerabilities prototype pollution gadget Axios Vulnerability Cloud Hijacking Axios npm supply chain attack Axios Vulnerability Node.js DoS CVE-2025-58754 CVE-2025-27152 Axios Vulnerability, Form-Data Flaw

The Human Variable: How a Masterful Phishing Ruse Hijacked Axios and 100 Million Users

Do Son April 3, 2026

The Axios npm hijack exposed millions to a RAT. Discover how North Korean-nexus actor UNC1069 used a masterful phishing ruse to bypass 2FA and steal credentials.