SecurityWeek

‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain Attacks

Vulnerabilities in the NPM, PNPM, VLT, and Bun package managers could lead to protection bypasses and arbitrary code ...
ZDNet

This 'unique' phishing attack uses Morse code to hide its approach

Microsoft has revealed the inner-workings of a phishing attack group's techniques that uses a 'jigsaw puzzle' technique plus unusual features like Morse code dashes and dots to hide its attacks. The ...
Dark Reading

Attack Code 'MarioNet' Is Pulling Strings in Your Web Browser

Modern browsers are really small but powerful operating systems that execute web applications. They run implicitly trusted script code which is confined inside of the browser. JavaScript APIs have ...
TMCnet

Anura Stops AI-Assisted SIVT Threat That Bypasses JavaScript-Based Fraud Detection Solutions

About Anura Anura.io is a trusted leader in ad fraud prevention, known for delivering high-accuracy, low-false-positive ...
SecurityWeek

Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack

A compromised Open VSX publisher account was used to distribute malicious extensions in a new GlassWorm supply chain attack.
Dark Reading

Supply Chain Attack Deploys Hundreds of Malicious NPM Modules to Steal Data

A routine scan of the NPM open source code repository in April turned up several packages using a JavaScript obfuscator to hide their true function. After further investigation, analysts with ...
Network World

JavaScript-based ASLR bypass attack simplifies browser exploits

Researchers have devised a new attack that can bypass one of the main exploit mitigations in browsers: address space layout randomization (ASLR). The attack takes advantage of how modern processors ...
Bleeping Computer

'Trojan Source' attack method can hide bugs into open-source code

Academic researchers have released details about a new attack method they call “Trojan Source” that allows injecting vulnerabilities into the source code of a software project in a way that human ...