explore | Grilled Cheese

Checking dependency upgrades is now a tool-tip away

plugins.jetbrains.com/plugin/30958...

"WeaselBiscuit Strips BeaverTail and OtterCookie Down to Essentials" published by OpenSourceMalware. #NPM, #WeaselBiscuit https://opensourcemalware.com/blog/introducing-weaselbiscuit

So, I baked pkg-gate with @typesafeai!

npm lifecycle scripts can run arbitrary code on install.

pkg-gate: a ~100ms pre-install gate using Jev

4 typed primitives:

- Choice: intent
- Score: severity
- Nouls: exfil & curl-to-bash

$ npx pkg-gate <pkg>

#node #npm #security

⏱ Caught early: npm [email protected] was on our radar 2 days before MAL-2026-16220 went public.

#flaggedfirst #npm #malware #supplychainsecurity

The advice on supply-chain risk was always: be careful what you install. A new npm worm stepped around it. It plants itself in code repositories so opening the project in an editor is enough to trigger it. No install needed. Read the filing #npm #supplychain #opensource #infosec

CrowdStrike uncovered PhantomRaven, a likely LLM-assisted JavaScript infostealer spread via malicious npm packages, using typosquatting and attacker-controlled infra to exfiltrate system and CI/CD data. #npm #BugBounty #CrowdStrike

This npm password stealer was AI-written - its operator used stolen secrets for fake bug bounty payouts. https://intel.threadlinqs.com/threat/TL-2026-2531 #ThreatIntel #PhantomRaven #NPM #JPD

CVE-2026-61559 - gitlab-mcp
The gitlab-mcp component reads a special header and can be tricked into sending its private access token to any address the attacker chooses. This could let a malicious…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gitlabmcp #zereight #npm #CVE #infosec

CVE-2026-61568 - gitlab-mcp
The zereight/mcp-gitlab component runs a local HTTP service that accepts any web page request without checking the source. An attacker can trick a browser into sending…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gitlabmcp #zereight #npm #CVE #infosec

CVE-2026-57140 - praisonai
Versions 1.6.0 through 1.7.1 of PraisionAI's AgentOS expose two web endpoints that anyone who can reach the server can call without proving who they are. Through these…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #npm #CVE #infosec

CVE-2026-57139 - praisonai
Versions 1.5.0 through 1.7.1 of PraisonAI’s MCPServer open a network port that accepts requests without requiring a login. Anyone who can reach that port can ask the…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #npm #CVE #infosec

CVE-2026-57138 - praisonai
Versions 1.4.0 through 1.7.1 of PraisonAI allow code entered into the codeMode feature to break out of its sandbox and run arbitrary commands on the server. An…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #npm #CVE #infosec

CVE-2026-57141 - praisonai
Versions of PraisonAI before 1.7.2 let a user who can influence the codeMode tool run their own JavaScript, which can break out of the sandbox and access the server.…

Too many irrelevant or confusing CVEs? Use stackflag.com

#praisonai #mervinpraison #npm #CVE #infosec

⏱ 2 days of lead time on npm [email protected]: we flagged it, then MAL-2026-16148 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity

⚠️ NPM is reporting a Incident since 17:20 UTC

"Package Publish Degradation"

Affects: Package publishing

Live timeline → https://pingoru.io/providers/npm/incidents/10985685

#NPM #NPMDown

⚠️ NPM is reporting a Incident since 17:20 UTC

"Package Publish Degradation"

Affects: Package publishing

Live timeline → https://pingoru.io/providers/npm/incidents/10985685

#NPM #NPMDown

⚠️ NPM is reporting a Incident since 17:20 UTC

"Package Publish Degradation"

Affects: Package publishing

Live timeline → https://pingoru.io/providers/npm/incidents/10985685

#NPM #NPMDown

⚠️ NPM is reporting a Incident since 16:13 UTC

"Publishing Packages Degraded Performance"

Affects: Package publishing

Live timeline → https://pingoru.io/providers/npm/incidents/10985565

#NPM #NPMDown

CVE-2026-55451 - gettext-converter
Versions of gettext-converter before 1.3.3 let specially crafted translation files modify the core structure of a JavaScript program. This can cause the…

Too many irrelevant or confusing CVEs? Use stackflag.com

#gettextconverter #locize #npm #CVE #infosec