CVE-2026-43999 - vm2
The vm2 library used in several GitHub repositories could let a malicious user run code they shouldn't be able to. This creates a risk that an attacker could take control of your system…

Too many irrelevant or confusing CVEs? Use stackflag.com

#vm2 #rootio #npm #CVE #infosec

⏱ 3 days of lead time on npm [email protected]: we flagged it, then MAL-2026-17228 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity

📢 DirtyBlanket : neuf faux packages npm propagent un ver Linux auto-répliquant

Cet article présente une analyse technique détaillée d'une campagne de supply chain nommée DirtyBlanket. Neuf packages npm malveillants ont été publiés le même…

🟡 vérification factuelle moyenne
#npm #AUR #Cyberveille

Javascript Experience

#programming #frontend #javascript #npm #nodejs

https://programmerhumor.io/javascript-memes/javascript-experience-5vvs

figlet-chalk-render v1.2.1 (npm) contains CRITICAL malicious code: on import, it downloads & runs a Windows executable, evading CI/sandbox. Remove & audit dependencies now. https://radar.offseq.com/threat/malicious-code-in-figlet-chalk-render-npm-e2cae6cc542e670e #OffSeq #npm #SupplyChainSecurity

Discover how the cross-platform sckit worm infected MemTensor packages on npm and PyPI, stealing developer secrets in a massive supply chain attack.

#SupplyChainAttack #npm #PyPI #CyberSecurity #Malware

nebulaai-sdk v1.0.0 (npm) is CRITICAL: Installs a RAT on Windows, opening C2 access with user privileges. Remove the package & conhost.exe if installed. Monitor for suspicious connections. https://radar.offseq.com/threat/malicious-code-in-nebulaai-sdk-npm-cf83f4133db4c1ba #OffSeq #npm #malware

Anyone have an in with the #npm team? I published github.com/bwthomas/vicary & while the #rubyists & #pythonistas can type `vicary` for cheaper, faster, & better anonymization than #bedrock guardrails, for #JS folk it's `@bwthomas/vicary` or nothing cuz, "vicary" ~ "vary" 🤷🤦‍♂️

#python #ruby

🚀 How to Deploy #CapRover on #Ubuntu #VPS

This article provides a guide demonstrating how to deploy CapRover on Ubuntu VPS.
What is CapRover?
CapRover is a free, open-source Platform-as-a-Service (PaaS) that ...
Continued 👉 #selfhosted #letsencrypt #selfhosting #nodejs #npm #ufw #certbot #git

⏱ 2 days of lead time on npm [email protected]: we flagged it, then MAL-2026-17215 confirmed it.

#flaggedfirst #npm #malware #supplychainsecurity

CVE-2023-29199 - vm2
The vm2 library used in several GitHub Actions and rootio projects may let attackers run code they should not be able to. Updated versions have been released that fix this risk.…

Too many irrelevant or confusing CVEs? Use stackflag.com

#vm2 #GitHubActions #npm #CVE #infosec

#Ukraine's prisoner-of-war camps provide adequate food, shelter and hygiene but operate with no dedicated legal framework, independent monitors warn. Full findings of the National Preventive Mechanism:
zmina.info/en/news-en/u...
#NPM #POWs #Russia #Russians #RussianSoldiers #ICRC

CVE-2022-36067 - vm2
The vm2 software used in several projects can be tricked into running code it shouldn’t. This could let an attacker take control of your system or data. Update to the latest…

Too many irrelevant or confusing CVEs? Use stackflag.com

#vm2 #GitHubActions #npm #CVE #infosec

TypeScriptで書かれたnpmレジストリ向けのパッケージマネージャ。
パッケージサイズが小さく、プログラムから実行できるAPIを持っている "unjs/upm: 📦 A fast, tiny package manager for the npm registry, written in TypeScript." https://github.com/unjs/upm #TypeScript #npm #Tools

⚠️ NPM is reporting a Incident since 00:50 UTC

"Issues with npm package publish and private install"

Affects: Package installation, Package publishing, Replication Feed

Live timeline → https://pingoru.io/providers/npm/incidents/11808880

#NPM #NPMDown

A fake npm package drops a Windows RAT that tunnels its C2 through Tailscale's own tailcat tool. https://intel.threadlinqs.com/threat/TL-2026-2665 #ThreatIntel #Kothamine #tailcat #npm

⏱ We flagged npm [email protected] 7 hours before the public advisory landed (MAL-2026-17190).

#flaggedfirst #npm #malware #supplychainsecurity

chromatitle npm v1.0.0 carries CRITICAL malicious code: obfuscated loader fetches & runs remote payloads on import. Remove & audit dependencies ASAP. No patch available. #OffSeq #npm #Security https://radar.offseq.com/threat/malicious-code-in-chromatitle-npm-1cefd95c647d92b5

CVE-2023-36665 - protobufjs
If an attacker can control the data used to parse or load Protobuf files, they may be able to alter the behavior of JavaScript code by adding or changing functions. This…

Too many irrelevant or confusing CVEs? Use stackflag.com

#protobufjs #rootio #npm #CVE #infosec

CRITICAL: n8n-nodes-moonlet-helpers (npm, v1.0.0/1.0.4) installs attacker code via postinstall script. Remove package, scan for /tmp/.np, and avoid affected versions. https://radar.offseq.com/threat/malicious-code-in-n8n-nodes-moonlet-helpers-npm-12fed58075d25a88 #OffSeq #npm #Security