https://fresh-reads.lovable.app/What developers should know about, and what to do — from advisory databases and the researchers who find supply-chain malware.Sun, 01 Nov 2026 08:57:41 +0000https://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-31Sat, 31 Oct 2026 16:09:39 +0000Including: @mamans2973/maman, skills-analyzer, md-to-slides, doctreelstm, is-it-ai, multi-convert, local-commander-agent — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://github.com/advisories/GHSA-4xm8-rg9h-jhq2cd2cf80431be7755Fri, 30 Oct 2026 22:57:22 +0000Summary Path traversal in the Signal K resources and applicationData APIs lets an unauthenticated or low-privileged user read, write and delete files outside the storage root. Reading /security.json discloses the JWT signing secret, enabling admin token forgery and remote code ex — What to do: Upgrade signalk-server to 2.34.0 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-30Fri, 30 Oct 2026 18:06:15 +0000Including: @pcb-dp/qa-commons, @sxm-content-creators/tools-ds, vas-tops2-reportingui, vas-tops2-core-clients-search, vas-tops2-core-client-cleanup-ui, @tops2/digital-assistant-ui, vas-tops2-core-property-search, vas-tops2-digital-assistant-ui… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-29Thu, 29 Oct 2026 22:14:17 +0000Including: dowload_ebok_lolita_by_vladimir_nabokov_oy1gy, dowload_ebok_el_piso_mil_el_piso_mil_1_by_katharine_mcgee_h1llc, dowload_ebok_nur_mal_schnell_das_mammut_retten_by_knut_kruger_eva_schoffmann_davidov_ouz6t, dowload_ebok_reiki_sviluppa_e_usa_lenergia_reiki_by_matt_harvey_9q55p, dowload_ebok_armageddon_by_max_hastings_kv3s4, bq-helix-recon-6ade983e, bq-helix-build-hook-6ade983e, orderbook-volt-plugin… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://thehackernews.com/2026/10/github-launches-npm-firewall-to-block.htmld282bc7cb5d66e47Thu, 29 Oct 2026 15:56:33 +0530GitHub has announced that it's introducing a new package firewall as a preview to block installation of suspicious npm packages during installation time. "The firewall inspects both metadata requests and package downloads for signs of malicious activity, acting as an install-time [reported · The Hacker News]npmhttps://securitylabs.datadoghq.com/articles/node2shell-cve-2026-111497-nodejs-brotli-decoder/0248309e4dc5c583Thu, 29 Oct 2026 00:00:00 +0000We reproduced CVE-2026-111497, an out-of-bounds write in the Brotli decoder bundled with Node.js and other runtimes, and explain how to detect and remediate it. [confirmed · Datadog Security Labs]npmvulnshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-28Wed, 28 Oct 2026 23:16:46 +0000Including: b20miner, @zaip-ai/cli, black-spindle, itsa-utils, itsa-react-checkbox, @walknpm/todo-cli, dsh-plugin-blender-3d, mock-transactions-sdk… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-27Tue, 27 Oct 2026 23:04:33 +0000Including: csec-form-validatorr, ccsseecc-form-validator, ccsseecc-crypto-toolkit, ccsec-crypto-toolkit, ccsec-form-validator, csec-crypto-toolkit, csec-form-validator, agentenact… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://github.com/advisories/GHSA-965c-763c-88jmd108bfb74ace1ff9Tue, 27 Oct 2026 15:32:05 +0000Am I affected? You may be affected if you use better-auth from 1.4.0-beta.18 through versions before 1.7.7 with the Magic Link plugin and social or Generic OAuth sign-in. You are affected if all of these are true: - Magic Link is enabled with default storeToken: "plain", or with — What to do: Upgrade better-auth to 1.7.7 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-26Mon, 26 Oct 2026 20:42:32 +0000Including: ctf-agent, @iobandamwer/native-helper, path-stream-utils-testmetest, @sxm-web/client-sdk-core, @greenlake/mfe-login-url, @ppa-web-components/ppa-banner, @drone-js-ext/core, @greenlake/context-pane… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://thehackernews.com/2026/10/malicious-file-in-downloads-folder.html9b47e941f5afe803Mon, 26 Oct 2026 11:33:48 +0530A malicious instruction file sitting in a developer's Downloads folder tried to make their AI coding agent install a known-malicious npm package, security firm Forever Security said in a report published last week. The company caught the attempt on a real customer's machine and s [reported · The Hacker News]npmai-toolshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-25Sun, 25 Oct 2026 21:30:24 +0000Including: nebulallm, @capsense/core-ui, zagents-message-bus, event-bus-lite-testmetest, @capsense/ccx-welcome-page, w-mousekey, @ppa-web-components/ppa-hotel-collection, @ppa-web-components/ppa-headerfooter… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://www.bleepingcomputer.com/news/security/ai-coding-agents-hijacked-using-agentsmd-file-in-downloads-folder/92c53c26133c7edcSun, 25 Oct 2026 11:49:38 -0400Researchers found a malicious AGENTS markdown instruction file in a customer's Downloads folder that tricked an AI coding agent into installing a rogue npm package. [...] [reported · BleepingComputer]npmai-toolshttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-24Sat, 24 Oct 2026 23:55:21 +0000Including: noelc-css-blender, tailwindcss-theme-kit, overarch-windows-x64-yr, @liauto/win32-x64 — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmhttps://github.com/advisories?query=type%3Amalwaremalware-digest-2026-10-23Fri, 23 Oct 2026 22:05:57 +0000Including: @k18k/entrypoint-sdk-darwin-arm64, orqiva-runtime-win32-x64, @k18k/entrypoint-sdk-linux-x64, @k18k/entrypoint-sdk-darwin-x64, taskquay, workslip, runpier, thornqueue… — What to do: snare checks lockfiles and installs against these automatically — `snare deps`. [confirmed · GitHub Advisory Database]npmpypihttps://github.com/advisories/GHSA-pqh8-4pj7-32xxf3f0f8bf6aa215f9Fri, 23 Oct 2026 18:29:02 +0000Impact The Streamable HTTP transport was constructed without enableDnsRebindingProtection/allowedHosts/allowedOrigins and performed no Origin-header validation. With the documented auth.mode: "none" loopback default, a drive-by web page could POST http://127.0.0.1/mcp and receive — What to do: Upgrade obsidian-tc to 1.3.1 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://github.com/advisories/GHSA-84c9-qqpq-2pq5e2c9516ba8106464Fri, 23 Oct 2026 17:29:17 +0000Impact Tool dispatch did not check the caller-supplied input.vault against the caller's bound vault (ctx.vaultId); the folder ACL was a single global instance and the JWT carried no vault claim. As a result, any valid token could read, write, or delete any configured vault by pas — What to do: Upgrade obsidian-tc to 1.3.1 or later. [confirmed · GitHub Advisory Database]npmvulnshttps://www.aikido.dev/blog/node2shell-nodejs-brotli-rce-cve-2026-11149711648cd58d5cd0dcThu, 22 Oct 2026 18:11:00 +0000Node.js CVE-2026-111497 (Node2Shell) is a Brotli flaw that can allow remote code execution. See who is affected, patched versions and the fix. Category: Vulnerabilities & Threats [confirmed · Aikido]npmvulnshttps://thehackernews.com/2026/10/threatsday-ai-secrets-leak-pingcap.html1a0681eeb53f6c23Thu, 22 Oct 2026 23:15:44 +0530This week has already been rough for cybersecurity. Critical PHP and GitLab RCE flaws, serious Linux security bugs, compromised eMudhra certificates, a Node.js RCE flaw, a hacked LiteLLM release, and hundreds of hijacked Tor relays. That's a lot to deal with in just a few days. A [reported · The Hacker News]npmpypivulns