MAL-2025-28367 Malicious code in optimize-css-assets-webpack-plugin-quantum-supervisor-oscillation (npm)

The package optimize-css-assets-webpack-plugin-quantum-supervisor-oscillation was found to contain malicious code...

MAL-2025-33122 Malicious code in shopify-assets (npm)

The package shopify-assets was found to contain malicious code...

MAL-2025-32609 Malicious code in sadr-cache-optimize-css-assets-webpack-plugin-ursa (npm)

The package sadr-cache-optimize-css-assets-webpack-plugin-ursa was found to contain malicious code...

MAL-2025-38966 Malicious code in web-assets (npm)

The package web-assets was found to contain malicious code...

MAL-2025-37601 Malicious code in ui_assets (npm)

The package uiassets was found to contain malicious code...

MAL-2025-25950 Malicious code in marketing_assets (npm)

The package marketingassets was found to contain malicious code...

MAL-2025-25952 Malicious code in marketing_assets_theme (npm)

The package marketingassetstheme was found to contain malicious code...

MAL-2025-25205 Malicious code in levels-optimize-css-assets-webpack-plugin-hermes-callisto (npm)

The package levels-optimize-css-assets-webpack-plugin-hermes-callisto was found to contain malicious code...

MAL-2025-14137 Malicious code in affirm-assets (npm)

The package affirm-assets was found to contain malicious code...

Malicious code in dendrochronology-browserify-cosmiconfig-optimize-css-assets-webpack-plugin (npm)

The package dendrochronology-browserify-cosmiconfig-optimize-css-assets-webpack-plugin was found to contain malicious code...

Have You Turned Off Your Virtual Oven?

You check that the windows are shut before leaving home. Return to the kitchen to verify that the oven and stove were definitely turned off. Maybe even circle back again to confirm the front door was properly closed. These automatic safety checks give you peace of mind because you know the unlike...

CISA and Partners Release Asset Inventory Guidance for Operational Technology Owners and Operators

CISA, along with the National Security Agency, the Federal Bureau of Investigation, Environmental Protection Agency, and several international partners, released comprehensive guidance to help operational technology OT owners and operators across all critical infrastructure sectors create and...

Security Bulletin: Astronomer with IBM is vulnerable to API abuse due to the NATS-Server package (CVE-2025-30215)

Summary NATS-Server is used by Astronomer with IBM as part of the messaging functionality. Vulnerability Details CVEID:CVE-2025-30215 DESCRIPTION: NATS-Server is a High-Performance server for NATS.io, the cloud and edge native messaging system. In versions starting from 2.2.0 but prior to 2.10.27...

6 Lessons Learned: Focusing Security Where Business Value Lives

The Evolution of Exposure Management Most security teams have a good sense of what's critical in their environment. What's harder to pin down is what's business-critical. These are the assets that support the processes the business can't function without. They're not always the loudest or most...

Ghost CMS 5.42.1 - Path Traversal

!/usr/bin/env python3 -- coding: utf-8 -- """ Exploit Title: Ghost CMS 5.42.1 - Path Traversal Date: 2023-06-15 Exploit Author:ibrahimsql https://github.com/ibrahimsql Vendor Homepage: https://ghost.org Software Link: https://github.com/TryGhost/Ghost Version: =2.28.1 """ import requests import s...

Malicious Package

Overview @googlesitekit/assets is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

TraderTraitor: Deep Dive

Inside the Lazarus subgroup that’s hijacking cloud platforms, poisoning supply chains, and stealing billions in digital assets...

Malicious code in @googlesitekit/assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24f7823f5a513a40959c5bd9912593b27c89fb7f0d627ed9a66417d0f0707472 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-6238 Malicious code in @googlesitekit/assets (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 24f7823f5a513a40959c5bd9912593b27c89fb7f0d627ed9a66417d0f0707472 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SoK: Securing the Final Frontier for Cybersecurity in Space-Based Infrastructure

With the advent of modern technology, critical infrastructure, communications, and national security depend increasingly on space-based assets. These assets, along with associated assets like data relay systems and ground stations, are, therefore, in serious danger of cyberattacks. Strong securit...