MAL-2026-14017 Malicious code in bs58-33 (npm)

npm/bs58-33 is a typosquat of the popular bs58 base58 codec cryptocoinjs. The package contains no malicious code of its own: its src/cjs/index.cjs simply does require"base65-33x" and re-exports it. Its sole purpose is to pull in the malicious sink package base65-33x as a runtime dependency declar...

PortSmash Side Channel Attack Siphons Data From Intel, Other CPUs

Yet another side-channel attack, this time dubbed PortSmash, has been discovered in CPUs. The attack allows attackers to manipulate a glitch in the simultaneous multithreading SMT architecture used in CPUs — and siphon processed data from chips. Several attacks have popped up over the past year...

Side-Channel Attack Steals Crypto Key from Co-Located Virtual Machines

Side-channel attacks against cryptography keys have, until now, been limited to physical machines. Researchers have long made accurate determinations about crypto keys by studying anything from variations in power consumption to measuring how long it takes for a computation to complete. A team of...