GitHub has announced that it’s introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. “The firewall inspects both metadata… Continue reading
Tag: Malicious
Two critical flaws in Wasmtime, a WebAssembly runtime that can be built into other software, could allow a malicious WebAssembly module to escape the sandbox intended to contain it,… Continue reading
AI agents paying for API calls with the x402 SDKs could sign a payment for their full balance of a supported token if a malicious API asked for it, security firm… Continue reading
A flaw in the OpenCode AI coding agent allowed a malicious or hijacked MCP server to run code on a developer’s Windows or WSL machine when the developer… Continue reading
LiteLLM on Wednesday disclosed that threat actors compromised “multiple independent security controls” to push a malicious version of the Python package containing a credential stealer and a backdoor…. Continue reading
Google on Tuesday said it’s rolling out improved safeguards in its Chrome browser to secure users against ClickFix attacks when Enhanced Protection is enabled. ClickFix is a popular… Continue reading
Ravie LakshmananOct 08, 2026Browser Security / Malware Cybersecurity researchers have discovered a cluster of 16 malicious Mozilla Firefox extensions that are capable of stealing cryptocurrency wallet recovery phrases… Continue reading
Ravie LakshmananOct 07, 2026Supply Chain / Malware Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans… Continue reading
Hacker news
LibreOffice and OpenOffice Flaws Let Malicious Spreadsheets Run Code Without Macro Warnings
Swati KhandelwalOct 06, 2026Vulnerability / Open Source A malicious spreadsheet can make LibreOffice and Apache OpenOffice run an attacker’s code as soon as the file is opened, security… Continue reading
Ravie LakshmananSep 29, 2026Supply Chain / Malware Cybersecurity researchers have identified a cluster of 101 npm packages that are used to trap developers into a WhatsApp group subscriber… Continue reading
