4 casos · pág. 1/1
Wiz published the first part of a blog series on operationalizing Application Security Posture Management (ASPM) with Wiz Code. It argues that AI models that find vulnerabilities and generate exploits, combined with AI-accelerated development, break manual AppSec triage workflows. The article uses React2Shell (CVE-2025-55182), a critical …
Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …
Unit 42 reports that threat actors are moving supply chain malware C2 from hardcoded endpoints to Web3 mechanisms, so an entire botnet or worm infrastructure can be re-pointed with a single blockchain transaction. The ChainDrop npm worm (Shai-Hulud family, 400+ npm packages) and the PolinRider campaign (npm, Go modules, Packagist) target …
SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …
