explore | Grilled Cheese

An npm package that never runs at install. It fires inside `BTree.prototype.set` when your code stores key 100.

No install hook, so --ignore-scripts saves nothing. Loader beacons to Slack/Telegram, pulls stage two from an Ethereum contract. ~2M weekly downloads.

#npm #DevSecOps

Critical Capacitor vulnerability CVE-2026-103922 (CVSS 9.3) affects a package with 5.5M weekly downloads. Update to a patched release now.

#Capacitor #Ionic #CVE2026103922 #MobileSecurity #npm #Android #iOS

Packages supported currently #npm #javascript #typescript. Next on the list is #poetry #pip #pip-tools #python. Thank you for reaching to this point, here's the repo github.com/kinuthiajr/a...

CVE-2025-47949 - samlify
A security issue in the samlify library for Node.js allows an attacker to pretend to be any user by forging a SAML response. This requires the attacker to have a signed document…

Too many irrelevant or confusing CVEs? Use stackflag.com

#samlify #tngan #npm #CVE #infosec

Heads up, fellow devs! npm is rolling out opt-in dist-tag permissions for trusted publishing. This is a smart, granular security upgrade that makes a lot of sense for supply chain safety. Less 'oops' with important tags. 🔒 #npm #DevTools

🚀 Deploy Self-Hosted #OpenClaw on #VPS (3 Minute Quick-Start Guide 🤖)

This article provides a quick, yet thorough step-by-step guide to deploy self-hosted OpenClaw on VPS servers. A lot of users have been deploying directly to Mac Minis, ...
Continued 👉 #npm #selfhosted #clawdbot #selfhosting

How to Install #Directus on #AlmaLinux #VPS

Here's a step-by-step guide detailing how to install Directus on AlmaLinux VPS.
What is Directus?
Directus ...
Continued 👉 #cmsapps #npm #vpsguide #contentmanagement #postgresql #selfhosted #opensource #nodejs #letsencrypt #installguide #selfhosting

⏱ Before the advisory: our scan flagged npm @bottino/[email protected] 50 days ahead of MAL-2026-17351.

#flaggedfirst #npm #malware #supplychainsecurity

MALFEX has been active since 2023, using malicious npm packages to spread Overlord RAT and steal Discord tokens, browser credentials, crypto wallet data and Telegram sessions.

Listen/Read: hackread.com/malfex-npm-w...

#MALFEX #npm #Malware #SupplyChain #Cybersecurity

A long-lived npm and GitHub supply chain used malicious postinstall packages and payloads, tied to malfexteam2027 and cavecrew, with active arms function-flag and cdn-img-fetch. #MALFEX #npm #Portugal

🚀 How to Deploy #Phanpy on #AlmaLinux #VPS

This article provides a guide demonstrating how to deploy Phanpy on AlmaLinux VPS.
What is Phanpy?
Phanpy is a modern alternative web frontend for #Mastodon and ...
Continued 👉 #selfhosting #fail2ban #selfhosted #firewalld #npm #letsencrypt

CVE-2023-42282 - ip
The ip package used in Node.js applications can mistakenly treat some private addresses as public, allowing a request to be sent to internal systems. This can let a remote user trick the…

Too many irrelevant or confusing CVEs? Use stackflag.com

#ip #indutny #npm #CVE #infosec

CVE-2026-44791 - n8n
An authenticated user with permission to create or modify workflows in n8n can bypass a security patch and potentially gain full control over the host. This can happen if users…

Too many irrelevant or confusing CVEs? Use stackflag.com

#n8n #GitHubActions #npm #CVE #infosec

CVE-2026-44789 - n8n
An attacker with permission to edit workflows can exploit a weakness in n8n's HTTP Request node, potentially allowing them to execute malicious code on the instance. This issue…

Too many irrelevant or confusing CVEs? Use stackflag.com

#n8n #GitHubActions #npm #CVE #infosec

CVE-2022-25893 - vm2
Versions of the vm2 package earlier than 3.9.10 can be tricked into executing any code the attacker wants, breaking the isolation it provides. This could let a malicious user gain access…

Too many irrelevant or confusing CVEs? Use stackflag.com

#vm2 #rootio #npm #CVE #infosec

CVE-2023-29017 - vm2
Versions of vm2 before 3.9.15 do not correctly handle certain error objects, allowing a malicious script to break out of the sandbox. This could let an attacker execute commands on the…

Too many irrelevant or confusing CVEs? Use stackflag.com

#vm2 #rootio #npm #CVE #infosec

CVE-2025-7783 - form-data
Versions of the form-data library (up to 2.5.3, 3.0.0‑3.0.3, and 4.0.0‑4.0.3) may generate predictable values, letting an attacker add extra parameters to web requests. This…

Too many irrelevant or confusing CVEs? Use stackflag.com

#formdata #ljharb #npm #CVE #infosec

CVE-2026-43999 - vm2
The vm2 library used in several GitHub repositories could let a malicious user run code they shouldn't be able to. This creates a risk that an attacker could take control of your system…

Too many irrelevant or confusing CVEs? Use stackflag.com

#vm2 #rootio #npm #CVE #infosec

⏱ 3 days of lead time on npm [email protected]: we flagged it, then MAL-2026-17228 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity