Security Insights
Latest threat analysis, industry news, and security best practices from our expert team.
Shai-Hulud npm Supply Chain Attack: Why SBOMs Fail and How to Detect Self-Propagating Package Worms
Introduction The Shai-Hulud npm supply chain campaign is a watershed moment for software supply chain defense, and not for the reasons most ...
Fake Web3 Accelerator Drops Infostealers via Malicious npm Packages — Detection and Response Guide for Windows and macOS
Overview Elastic Security Labs has disclosed an active campaign in which a fraudulent Web3 accelerator is distributing malicious npm package...
CVE-2026-110634 & CVE-2026-110635: Critical Command Injection in npm Packages — Detection and Remediation Guide
Introduction In the last 72 hours, NVD published seven CRITICAL-severity CVEs affecting packages in the Node.js/npm ecosystem, all carrying ...
ClickFix, ClingSTUN, and MALFEX: Defending Against Newsletter Round 118's Multi-Platform Threat Wave
Introduction The latest Security Affairs malware research roundup (Round 118) is a snapshot of where the threat landscape actually sits in 2...
Mantax Otax Mobile Ransomware + NEBULA npm Supply-Chain RAT: OTX Pulse Analysis — Cross-Platform Detection Pack
Mantax Otax Mobile Ransomware + NEBULA npm Supply-Chain RAT: OTX Pulse Analysis — Cross-Platform Detection Pack Two fresh AlienVault OTX pul...
Tensorlake npm SDK Compromise, Poem-Guided Botnet C2, and Exposed NVIDIA GPU Telemetry: A Defender's Response Guide
Introduction This week's roundup from SecurityWeek is a useful snapshot of where attacker tradecraft is heading in 2026: upstream developer ...
MALFEX npm Supply Chain Campaign: Detecting and Removing the Overlord RAT and Info-Stealer in Your Developer Environment
Introduction CloudSEK and Checkmarx have jointly disclosed a long-running npm supply chain campaign, codenamed MALFEX, that has been quietly...
PhantomSub Campaign: 101 Malicious npm Packages Weaponize Baileys to Hijack Developers' WhatsApp Accounts — Detection and Remediation Guide
Introduction OX Security researchers Nir Zadok, Moshe Siman Tov Bustan, and Vitalii Chepurko have disclosed a coordinated supply-chain campa...
Malicious 'indexed-btree' NPM Package Typosquats sorted-btree: Detection and Supply-Chain Remediation Guide
Introduction SecurityWeek reports that a malicious npm package named indexed-btree has accumulated millions of downloads by masquerading as ...