Claude Code Attack Persists Through Token Rotation Flaw

A surprising lack of resistance to a proof-of-concept attack has exposed a vulnerability in Claude Code, allowing a five-step attack chain that can turn routine token rotation into a continuous compromise. This exploit requires just one malicious npm package and the ability to run code on a developer's machine, making it a concerning threat.

https://osintsights.com/claude-code-attack-persists-through-token-rotation-flaw?utm_source=mastodon&utm_medium=social

#ClaudeCode #TokenRotationFlaw #SupplyChain #EmergingThreats #NpmPackage

Google Fixes Critical Gemini CLI Flaw Enabling Remote Code Execution

Google patched a critical flaw in Gemini CLI that allowed hackers to inject malicious code and take control of host systems, thanks to a report from Novee Security. The vulnerability, scoring a perfect 10.0 on the CVSS scale, has been fixed in recent updates to the @google/gemini-cli and google-github-actions/run-gemini-cli packages.

https://osintsights.com/google-fixes-critical-gemini-cli-flaw-enabling-remote-code-execution?utm_source=mastodon&utm_medium=social

#GeminiCli #RemoteCodeExecution #Google #NpmPackage #GithubActions

Malicious NPM Package with 56K Downloads Steals WhatsApp Messages
https://cybersecuritynews.com/malicious-npm-package-with-56k-downloads/

#Infosec #Security #Cybersecurity #CeptBiro #NPMPackage #Steals #WhatsAppMessages

🔥 The NPM supply chain attack just got bigger!
DuckDB database packages have been compromised with crypto-stealing malware. A simple phishing email led to packages used by thousands of developers being infected.
The malware is designed to steal cryptocurrency by hijacking wallet transactions - pretty sophisticated stuff!

Read Details - https://www.cyberkendra.com/2025/09/duckdb-packages-compromised-in-latest.html

#supplychain #npmPackage #npmattack #hack

NPM package ‘is’ with 2.8M weekly downloads infected devs with malware
https://www.bleepingcomputer.com/news/security/npm-package-is-with-28m-weekly-downloads-infected-devs-with-malware/

#Infosec #Security #Cybersecurity #CeptBiro #NPMpackage #Devs #Malware

Referenced link: https://hackernoon.com/how-to-publish-your-package-on-npm-registry
Discuss on https://discu.eu/q/https://hackernoon.com/how-to-publish-your-package-on-npm-registry

Originally posted by HackerNoon | Learn Any Technology / @[email protected]: https://twitter.com/hackernoon/status/1571303019840512002#m

"How to Publish Your Package on NPM Registry" cc: @theritikchoure https://hackernoon.com/how-to-publish-your-package-on-npm-registry #npmpackage #javascript

Sometimes, you have to interface with an API that doesn't respond fast enough. Moreover, you might perform the same request multiple times.

The solution?

Return the same promise for the same exact requests until they resolve. This is more useful when you interface with stateless APIs, where you just consume data.

https://github.com/chrispanag/memoized-node-fetch

#node #nodejs #npm #npmpackage #package #javascript #typescript #opensource