🐘https://twitter.com/securestep9
#OWASP London Chapter Leader(@OWASPLondon). Application Security (#AppSec) Architect & Consultant. OWASP Global Board Member. OWASP Nettacker Project co-leader. #CISSP
| Blog | https://medium.com/@securestep9 |
#Checkmarx is breached again via its Jenkins plugin GitHub repo compromised in a software suply chain hack:
#SoftwareSupplyChainSecurity
👇
#npm: TanStack npm packages (84 in total) compromised in a supply chain hack utilising a malicious payload designed to destroy files on developer machines if a stolen GitHub token is revoked ("dead-man's swithch"):
#SoftwareSupplyChainSecurity
👇
On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory — producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now.
#Nuget: Malicious NuGet packages mimicked trusted .NET libraries to steal credentials, key crypto wallets.
Packages:
IR.DantUI, IR.OscarUI, IR.Infrastructure.Core, IR.Infrastructure.DataService.Core, IR.iplus32
included an infostealer #malware:
👇
https://gbhackers.com/malicious-nuget-packages-2/
#vm2 NodeJS Library Vulnerabilities Enable Sandbox Escape and Arbitrary Code Execution - patch now!
Vm2 is used by 900+ #NPM packages:
👇
https://thehackernews.com/2026/05/vm2-nodejs-library-vulnerabilities.html
#NextJS and #React Server Components hit with 12 vulnerabilities with 3 high-severity vulns (CVE-2026-44574, CVE-2026-44578, CVE-2026-44581) requiring the most urgent attention and impacting virtually every production NextJS deployment - patch now!
https://www.cyberkendra.com/2026/05/react-and-nextjs-hit-with-12-security.html
Vercel and the React team have fixed 13 vulnerabilities affecting Next.js and React Server Components, with three high-severity flaws drawing the most urgent attention from the security community. The issues span middleware bypasses, server-side req…
#PyPI 3 Python Packages Deliver ZiChatBot #Malware via Zulip APIs on Windows and Linux:
* uuid32-utils
* colorinal
* termncolor
👇
https://thehackernews.com/2026/05/pypi-packages-deliver-zichatbot-malware.html
