⌛
Loading…
Curated news, CVE analysis, and threat reports from the world's top cybersecurity sources.
This technical analysis report was prepared as part of the joint cybersecurity advisory titled “Advisory on Cyberattacks Targeting Korean Citizens and Businesses by State-Sponsored Hacking Groups” issued by the Republic of Korea’s National Intelligence Service (NIS), National Police Agency (NPA), Korea Internet & Security Agency (KISA), and Financial Security Institute (FSI).
Hackers launched a coordinated cyberattack targeting operational technology (OT) systems at more than 30 community water systems across Minnesota over Sunday and Monday, July 26-27, 2026. The Minnesota IT Services (MNIT) agency activated statewide cybersecurity incident response capabilities.
This AWS Security post explains how to secure npm and pip package updates on Amazon Linux by implementing a dependency cooldown. The cooldown skips packages published in the last 24 hours, reducing exposure to supply chain attacks.
Recent supply chain attacks targeting NodeJS and Python packages have highlighted the risks associated with installing newly published npm and PyPI packages. Malicious packages, such as those in the Nx s1ngularity (Aug 2025), axios (Mar 2026), Bitwarden CLI (Apr 2026), TanStack (May 2026), and node-ipc (May 2026) incidents, were detected and removed within hours, but during their exposure window, they posed significant security risks.
If you use and install packages from npm or PyPI, the first hours after a package is published are the riskiest because scanners can’t analyze packages before publication.
This AWS Security post explains how to secure npm and pip package updates on Amazon Linux by implementing a dependency cooldown. The cooldown skips packages published in the last 24 hours, reducing exposure to supply chain attacks.