North Korea malware hidden inside SVG country flag images evaded every antivirus tool when Elastic Security Labs disclosed ...

North Korean hackers hide a four-stage OtterCookie payload in SVG files inside fake coding tests to steal browser data and ...

SFA-Get can be invoked using npx sfa-get. The tool now supports enhanced CLI options, concurrent downloads, retry logic with exponential backoff, progress indicators, and file integrity verification.

Microsoft says these 119 malicious extensions were downloaded a total of 2.6 million times since 2021.

The Wisconsin Badgers and Culver's have agreed to a jersey patch sponsorship deal. Culver's logo will appear on the football, men's basketball, and men's hockey uniforms starting in the 2026-27 season ...

With npm v12, GitHub closes a central attack vector: installation scripts from dependencies will only run after explicit approval from July 2026. With npm v12, GitHub is eliminating several ...

A dozen critical security vulnerabilities have been disclosed in the vm2 Node.js library that could be exploited by bad actors to break out of the sandbox and execute arbitrary code on susceptible ...

Strip the types and hotwire the HTML—and triple check your package security while you are at it. JavaScript in 2026 is just getting started. I am loath to inform you that the first month of 2026 has ...

A new campaign dubbed 'GhostPoster' is hiding JavaScript code in the image logo of malicious Firefox extensions with more than 50,000 downloads, to monitor browser activity and plant a backdoor. The ...

A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be exploited to execute code remotely through maliciously crafted input. The ...

What the Script: Supply chain attacks are traditionally designed to inflict maximum damage on structured organizations or companies. However, when such an attack compromises a supply chain that an ...