⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
Recent supply chain attacks targeting NodeJS and Python packages have highlighted the risks associated with installing newly published npm and PyPI packages. Malicious packages, such as those in the Nx s1ngularity (Aug 2025), axios (Mar 2026), Bitwarden CLI (Apr 2026), TanStack (May 2026), and node-ipc (May 2026) incidents, were detected and removed within hours, but during their exposure window, they posed significant security risks.
This AWS Security post explains how to secure npm and pip package updates on Amazon Linux by implementing a dependency cooldown. The cooldown skips packages published in the last 24 hours, reducing exposure to supply chain attacks.
This AWS Security post explains how to secure npm and pip package updates on Amazon Linux by implementing a dependency cooldown. The cooldown skips packages published in the last 24 hours, reducing exposure to supply chain attacks.
If you use and install packages from npm or PyPI, the first hours after a package is published are the riskiest because scanners can’t analyze packages before publication.
This article from Dark Reading describes a patch-resistant vulnerability in the AI hosting platform Ruflo, dubbed 'RufRoot'. The flaw allows an unauthenticated attacker to take over the system and corrupt memory, enabling persistent malicious behavior even after patching.
The RufRoot vulnerability in Ruflo allows unauthenticated attackers to execute arbitrary malicious AI actions against affected systems without needing valid credentials or prior access. What makes this flaw particularly concerning is that it appears to resist or bypass standard patching mechanisms, leaving systems exposed even after organizations attempt remediation.