npm Packages
TRENDING TOPICS FEB 25, 2026 Malicious npm Package ambar-src Shows Fast Moving Supply Chain Risk Tenable research reported that a malicious npm package named ambar-src reached roughly 50,000 downloads before removal, showing how quickly supply chain threats can spread across developer environments. The package appears to have been built
OpenClaw
TRENDING TOPICS FEB 18, 2026 Update: OpenClaw Ecosystem Hit by Skill Marketplace Malware and Log Injection Weakness A coordinated supply-chain campaign named ClawHavoc targeted OpenClaw’s official skill marketplace, ClawHub, by flooding it with at least 1,184 malicious Skills published over time. Attackers registered developer accounts, uploaded Skills that
ClawHub
TRENDING TOPICS FEB 09, 2026 Update: ClawHub Malicious Skills Shift From Embedded Payloads to Off-Platform Lures Threat actors behind an ongoing ClawHub malicious-skills campaign have changed tactics to evade newer registry defenses. Instead of hiding encoded malware inside SKILL[.]md files, they now keep the skill pages clean and use
GitHub
TRENDING TOPICS JAN 28, 2026 GitHub Repository Abuse Enables Malware Delivery Through Trusted Installer Paths GMO Researchers have identified a malware campaign that exploits GitHub's repository-forking mechanism to distribute trojanized installers under the guise of official projects. Attackers fork the legitimate GitHub Desktop repository, alter download links in
DPRK
TRENDING TOPICS JAN 27, 2026 Update: DPRK “Fake Font” Contagious Interview Campaign Abuses VS Code Tasks to Deploy InvisibleFerret North Korean Lazarus Group operators have launched a new evolution of the long-running “Contagious Interview” campaign that abuses Microsoft VS Code’s task automation feature to execute malware disguised as web
GlassWorm
TRENDING TOPICS DEC 02, 2025 Update: Glassworm Campaign Escalates Across Developer Extension Ecosystems Glassworm has advanced into a broader, more aggressive phase, with adversaries planting two dozen new malicious extensions on the Microsoft Visual Studio Marketplace and OpenVSX. These platforms distribute critical tooling for VS Code–compatible editors, which positions
Shai-Hulud
TRENDING TOPICS NOV 25, 2025 Round 2: Shai-Hulud Worm Exploits npm at Massive Scale The Shai-Hulud campaign has resurfaced with a far more aggressive, disruptive operation that has moved well beyond the smaller, account-level compromise seen in September. This round introduced a self-spreading worm that activated during package installation, enabling
SmudgedSerpent
TRENDING TOPICS NOV 05, 2025 SmudgedSerpent Hackers Target U.S. Policy Experts with Iranian-Themed Phishing Lures A newly identified threat cluster dubbed UNK_SmudgedSerpent has launched a series of espionage-driven phishing attacks against U.S.-based academics and foreign policy experts focusing on Iran. According to Proofpoint researchers, the campaign
Session Smuggling
TRENDING TOPICS NOV 03, 2025 Agent Session Smuggling: How Malicious AI Hijacks Victim Agents The newly uncovered agent session smuggling attack exposes a critical flaw in multi-agent AI ecosystems, allowing a malicious AI agent to hijack active communication sessions through the Agent2Agent (A2A) protocol. Unlike traditional one-shot prompt injections, this
Microsoft 365
TRENDING TOPICS OCT 22, 2025 Microsoft 365 Copilot Attack Enables Data Exfiltration via Malicious Mermaid Diagrams A newly discovered attack in Microsoft 365 Copilot enabled attackers to exploit the AI assistant’s integration with Mermaid diagrams to exfiltrate sensitive tenant data. The flaw leveraged an indirect prompt injection hidden inside
TigerJack
CVE-2025-59218 Critical Azure Entra ID AUTH BYPASS Azure Entra ID vulnerability (CVSS 9.6) allowing authentication bypass or privilege escalation within identity services. CVE-2025-59236 Critical Microsoft Excel USE-AFTER-FREE Use-after-free in Microsoft Excel enabling arbitrary code execution when a user opens a malicious document. CVE-2025-59246 Critical Azure Entra ID PRIVILEGE ESCALATION
YiBackdoor
TRENDING TOPICS SEPT 24, 2025 YiBackdoor Malware Linked to IcedID and Latrodectus as ZLoader Evolves with Advanced Evasion Researchers at Zscaler have discovered a new malware family, known as YiBackdoor, that exhibits significant code overlaps with the loaders IcedID and Latrodectus. YiBackdoor can execute arbitrary commands, collect system information, capture