Node.js

An attacker compromised AsyncAPI repositories to publish malicious npm packages that deploy the Miasma RAT credential stealer. The attack impacts millions of weekly downloads and utilizes advanced obfuscation and multi-channel C2 infrastructure.

The article advocates for a proactive 'sniff test' methodology to validate the integrity of SBOMs in containerized environments. It highlights how identifying omissions like unpinned packages or missing dependencies is crucial for preventing supply chain attacks.

Cybersecurity researchers from Microsoft and Trend Micro have uncovered sophisticated phishing campaigns targeting hospitality organizations in Europe and Asia. These attacks leverage malicious archives to deploy persistent malware like Node.js implants and blockchain-based RATs to maintain long-term access.

A security scan discovered that 25% of 6,000 web applications fail to verify Stripe webhook signatures, allowing for unauthorized payment bypass. This flaw enables attackers to forge successful payment events and upgrade account statuses without actual charges.