vm2: NodeVM builtin:['*'] Exposes os and dns — Host Process Exposure From the Sandbox

vm2: NodeVM builtin:['*'] Exposes os and dns — Host Process Exposure From the Sandbox

A critical vulnerability in the vm2 npm package breaks the sandbox isolation that NodeVM is designed to enforce. When configured with builtin: ['*'], two Node.js built-in modules — os and dns — slip through the dangerous-builtin filter. Both expose host-process state that the vm2 boundary cannot contain, and both carry write APIs that mutate global host-process state from the sandbox.

Aug 26, 2026 • 11:18 UTC

14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2

Cybersecurity researchers have discovered a set of trojanized npm packages that masquerade as working calendar and streak utilities but are engineered to stealthily deliver an artificial intelligence (AI)-powered Linux implant dubbed RedC2 4.0. When the module loads, it locates the bundled binary, marks it executable, and launches it as a detached background process. No install hook function call is needed — a single import anywhere in the dependency graph, even a transitive one, is enough to execute the payload.

Aug 22, 2026 • 10:21 UTC

ChainDrop: The npm Worm That Poisoned 444 Packages in Under Four Hours
ChainDrop: The npm Worm That Poisoned 444 Packages in Under Four Hours

On the morning of 4 August 2026, a single compromised developer account set off the fastest self-spreading software supply chain incident the open source ecosystem has seen. Within four hours, malicious code had inserted itself into 444 software packages across 2,212 published versions, jumping automatically from one company's build system to the next by stealing credentials along the way. This briefing explains what happened in plain terms, who is exposed, and the small number of decisions leadership needs to make this week.

Aug 05, 2026 • 07:40 UTC

External SBOM Compliance is No Longer Optional
External SBOM Compliance is No Longer Optional

For years, Software Bills of Materials (SBOMs) have largely been treated as compliance artifacts. Organizations collected them during procurement, archived them for audits, and produced them when regulators asked. Yet from a security perspective, most SBOMs remained static documents that offered little operational value.

Jul 24, 2026 • 11:03 UTC

SBOM, CBOM, and AIBOM: The New Visibility Layer Every Security and Compliance Program Needs
SBOM, CBOM, and AIBOM: The New Visibility Layer Every Security and Compliance Program Needs

Understand why SBOM, CBOM, and AIBOM are essential visibility layers for modern security and compliance programs.

Jun 09, 2026 • 15:00 UTC

Shai-Hulud Strikes the TanStack Ecosystem: 160+ NPM Packages Compromised
Shai-Hulud Strikes the TanStack Ecosystem: 160+ NPM Packages Compromised

A supply chain attack compromised 160+ NPM packages in the TanStack ecosystem through dependency confusion.

May 13, 2026 • 11:00 UTC

Your CI/CD Pipeline Is a Breach Waiting to Happen
Your CI/CD Pipeline Is a Breach Waiting to Happen

Attackers backdoored element-data 0.23.3 via a GitHub Actions flaw, exposing cloud keys and API tokens.

May 01, 2026 • 10:00 UTC

Poisoning the Well element-data
Poisoning the Well element-data

Analysis of the element-data supply chain poisoning attack targeting npm packages.

Apr 28, 2026 • 13:00 UTC

The Worm That Breeds Through Your Code
The Worm That Breeds Through Your Code

A self-replicating supply chain worm that propagates through developer dependencies.

Apr 24, 2026 • 05:00 UTC

Marimo RCE Flaw Weaponized in 10 Hours
Marimo RCE Flaw Weaponized in 10 Hours

A zero-authentication terminal WebSocket vulnerability in Marimo was weaponized within 10 hours of disclosure.

Apr 10, 2026 • 03:00 UTC

When Trust Becomes a Weapon: Axios npm Supply Chain Attack
When Trust Becomes a Weapon: Axios npm Supply Chain Attack

A precision attack against the npm ecosystem hijacked the Axios maintainer account and published poisoned versions reaching 100M+ weekly downloads.

Apr 01, 2026 • 00:21 UTC

THE NEED FOR TRUE SHIFT LEFT SECURITY
THE NEED FOR TRUE SHIFT LEFT SECURITY

Why organizations need to adopt true shift-left security practices in their development lifecycle.

Nov 13, 2025 • 08:30 UTC

Typosquatting Attack on Rust Crate: fast_log
Typosquatting Attack on Rust Crate: fast_log

Analysis of a typosquatting attack targeting the Rust crate ecosystem through a malicious fast_log package.

Sep 25, 2025 • 11:00 UTC

Supply Chain Attack on @ctrl/tinycolor and 180+ NPM Packages
Supply Chain Attack on @ctrl/tinycolor and 180+ NPM Packages

A coordinated supply chain attack compromised @ctrl/tinycolor and over 180 NPM packages.

Sep 16, 2025 • 10:30 UTC

The eslint-config-prettier Supply Chain Attack
The eslint-config-prettier Supply Chain Attack

Analysis of the eslint-config-prettier supply chain attack that compromised npm packages.

Jul 23, 2025 • 04:00 UTC