📰 Paket Palsu di Repositori Arch Linux Sebarkan Malware dengan Hak Akses Root

👉 Baca artikel lengkap di sini: https://ahmandonk.com/2026/10/16/paket-palsu-arch-linux-aur-sebarkan-malware-akses-root/

#archLinux #aur #cyberSecurity #exploit #hacker #keamananSiber #linux #malware #npm #openSour

CVE-2021-23383 - handlebars
The Handlebars templating library used in several packages—including jaylinski/handlebars, handlebarsjs/handlebars, NetApp's e-series performance analyzer,…

Too many irrelevant or confusing CVEs? Use stackflag.com

#handlebars #jaylinski #npm #CVE #infosec

CVE-2021-23369 - handlebars
The Handlebars template library used in several web packages can be tricked into changing information it shouldn't. This could let an attacker modify content or settings…

Too many irrelevant or confusing CVEs? Use stackflag.com

#handlebars #webjars #npm #CVE #infosec

CVE-2026-33937 - handlebars
The Handlebars library used in several packages can be tricked into running unwanted code. This affects the listed Handlebars implementations and could let attackers affect…

Too many irrelevant or confusing CVEs? Use stackflag.com

#handlebars #rootio #npm #CVE #infosec

GitHub now expires npm trusted publishing setups that miss a first publish within 48 hours, closing a repo name reuse flaw in 1,500+ packages.

#npm #TrustedPublishing #GitHub #GitHubActions #SupplyChainSecurity #OIDC #OpenSource #DevSecOps

BRIDGEHEAD npm typosquats hop from WSL into Windows to run an in-memory Rust wallet stealer. https://intel.threadlinqs.com/threat/TL-2026-3557 #ThreatIntel #BRIDGEHEAD #npm #typosquat

npm trusted publishing configurations now expire if they don't complete a publish within 48 hours. The goal: stop dormant trust in a repo name from surviving an ownership change. npm also now blocks publishing from issue_comment workflows. Details:
devops.com/npm-puts-a-4... #npm #DevSecOps

Also on crates.io and npm, for Rust and the browser:

crates.io/crates/epubveri
npmjs.com/package/@veripublica/epubveri-wasm

#publishing #DigitalPublishing #ebookdev #WebAssembly #npm

⚠️ NPM is reporting a Incident since 09:29 UTC

"Issues with login and viewing packages"

Affects: www.npmjs.com website

Live timeline → https://pingoru.io/providers/npm/incidents/12296242

#NPM #NPMDown

GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking reconbee.com/github-tight...

#GitHub #vulnerable #hijacking #npm #cybersecurity #cyberattack

CI de GitHub Actions para Node.js: 4 ajustes que importan

¿Tu CI gasta minutos de más? Armá un workflow de github actions node js con 4 ajustes: cancelar corridas, permisos mínimos, caché y actionlint

#githubactions #nodejs #npm

Hijack an #npm package without stealing credentials? #GitHub Tightens npm Publishing After a "SlugFest" Flaw Left 1,500+ Packages Vulnerable to Hijacking:

#SoftwareSupplyChainSecurity
👇

GitHub now expires unvalidated npm trusted publishing configurations after 48 hours, closing a loophole that could let attackers claim abandoned repository names and p…

https://en.hacks.gr/neoi-aystiroteroi-kanones-apo-ti-github-gia-paketa-kodika-meta-apo-ereyna-asfaleias/

#GitHub #npm #OpenSource

GitHub closes npm trusted-publishing loophole by binding trust to permanent IDs and enforcing 48-hour validation. #SupplyChain #npm #GitHub #Cybersecurity #TrustedPublishing #Security thedailytechfeed.com/github-fixes...

CVE-2026-104849 - tinypool
The tinypool library used in Node.js projects contained a flaw that could allow an attacker to execute code with the same rights as the application. This matters because it…

Too many irrelevant or confusing CVEs? Use stackflag.com

#tinypool #tinylibs #npm #CVE #infosec

もし0.5.144を入れたなら、端末をネットワークから切り離して調査してほしい。解析によると、盗まれたGitHubトークンを先に失効させると、端末上の監視処理が削除命令を走らせる仕掛けもある。監視処理の確認と除去を先に、トークン更新はその後ネ。

「すぐ鍵を替える」が逆効果になる条件まで、私は見落としたくないヨ。
https://x.com/thecyberrundown/status/2108347047518855320
#npm #供給網

Fake accelerator “Apex” infects Web3 founders via malicious npm tools. #Web3 #npm #Malware #CryptoSecurity #AI #SupplyChain https://thedailytechfeed.com/fake-web3-accelerator-apex-deploys-malware-via-npm-to-target-crypto-founders/

npm’s SlugFest lets attackers hijack package names via GitHub slugs. #npm #TrustedPublishing #SlugFest #SupplyChain #OIDC #DevSecOps https://thedailytechfeed.com/slugfest-npms-trusted-publishing-glitch-exposes-1500-packages/

Автоматизация разработки на ИИ создаёт лазейку для вредоносных пакетов

Компания Bloom Security обнаружила уязвимость в системе публикации пакетов npm, которая становится опасной из-за того, что ИИ-агенты массово тянут сторонние…

Читать полностью

#Кибербезопасность #Npm #ИскусственныйИнтеллект

Rights violations were documented at a private care home for older people in #Kharkiv during monitoring visits in 2023, 2025 and 2026, Ukraine’s Ombudsman says. The latest #NPM visit found that the problems persisted.
zmina.info/en/news-en/o...
#Ukraine #KharkivOblast #CareHomes #InstitutionalCare