<![CDATA[No new npm packages compromised?]]>No new npm packages compromised? No new Linux kernel 0days? Is everyone waiting for EOD or is Friday no longer the day to publish shenanigans?

]]>https://board.circlewithadot.net/topic/0910ebf3-6750-466f-a006-4a7be8ef4d51/no-new-npm-packages-compromisedRSS for NodeMon, 25 May 2026 12:38:44 GMTFri, 15 May 2026 17:30:20 GMT60<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 20:15:34 GMT]]>@cR0w @NuclearOatmeal Yeah if DVWA was installed on thousands of endpoints and *checks notes* also exposed to the Internet 😭

Protean Labs | Engineering Blog

favicon

(protean-labs.io)

]]>https://board.circlewithadot.net/post/https://shellsharks.social/users/shellsharks/statuses/116580426371625248https://board.circlewithadot.net/post/https://shellsharks.social/users/shellsharks/statuses/116580426371625248Fri, 15 May 2026 20:15:34 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 20:10:25 GMT]]>@shellsharks @NuclearOatmeal In fairness, isn't OpenClaw basically like a Damn Vulnerable Agent for testing and learning at this point?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116580406103561165https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116580406103561165Fri, 15 May 2026 20:10:25 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 20:09:11 GMT]]>@NuclearOatmeal @cR0w OpenClaw says "my turn" - https://www.cyera.com/blog/claw-chain-cyera-research-unveil-four-chainable-vulnerabilities-in-openclaw

]]>https://board.circlewithadot.net/post/https://shellsharks.social/users/shellsharks/statuses/116580401277620594https://board.circlewithadot.net/post/https://shellsharks.social/users/shellsharks/statuses/116580401277620594Fri, 15 May 2026 20:09:11 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 20:07:35 GMT]]>@Viss I saw that but no timeline and no descriptions. Could be total bummers like a lot of the "coming soon" stuff from ZDI and Talos. Fingers crossed though.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116580394937168070https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116580394937168070Fri, 15 May 2026 20:07:35 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 20:04:04 GMT]]>@cR0w docker 0days coming, stuff embargoed atm. more npm tooooo https://xchglabs.com/blog/

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116580381145600112https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116580381145600112Fri, 15 May 2026 20:04:04 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:55:58 GMT]]>@badsamurai @NuclearOatmeal @cR0w zero days. zero days, erryday

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116580349304494700https://board.circlewithadot.net/post/https://infosec.exchange/users/da_667/statuses/116580349304494700Fri, 15 May 2026 19:55:58 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:55:44 GMT]]>@cR0w @nyanbinary 🤐🤐🤐 pending analysis. Sorry y'all.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/darfplatypus/statuses/116580348380511157https://board.circlewithadot.net/post/https://infosec.exchange/users/darfplatypus/statuses/116580348380511157Fri, 15 May 2026 19:55:44 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:54:49 GMT]]>@nyanbinary That doesn't sound like @darfplatypus ...

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116580344782518232https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116580344782518232Fri, 15 May 2026 19:54:49 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:47:24 GMT]]>@cR0w I heard a rumor that it can but it's hard to confirm what with being on fire and all.

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/huronbikes/statuses/116580315590096119https://board.circlewithadot.net/post/https://cyberplace.social/users/huronbikes/statuses/116580315590096119Fri, 15 May 2026 19:47:24 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:47:19 GMT]]>@cR0w Gearing up for Monday morning...

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/116093572746253175/statuses/116580315270039470https://board.circlewithadot.net/post/https://infosec.exchange/ap/users/116093572746253175/statuses/116580315270039470Fri, 15 May 2026 19:47:19 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:43:21 GMT]]>@cR0w darf asked nicely

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116580299659123681https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116580299659123681Fri, 15 May 2026 19:43:21 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:41:03 GMT]]>@NuclearOatmeal @cR0w

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/badsamurai/statuses/116580290643143611https://board.circlewithadot.net/post/https://infosec.exchange/users/badsamurai/statuses/116580290643143611Fri, 15 May 2026 19:41:03 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:36:08 GMT]]>@huronbikes You mean fire can grow?!

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116580271269194995https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116580271269194995Fri, 15 May 2026 19:36:08 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:29:02 GMT]]>@cR0w maybe all the fire is hiding some fire we don't know about

]]>https://board.circlewithadot.net/post/https://cyberplace.social/users/huronbikes/statuses/116580243405152209https://board.circlewithadot.net/post/https://cyberplace.social/users/huronbikes/statuses/116580243405152209Fri, 15 May 2026 19:29:02 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 19:24:25 GMT]]>@cR0w

Day ain't over yet.

]]>https://board.circlewithadot.net/post/https://beige.party/users/NuclearOatmeal/statuses/116580225206967388https://board.circlewithadot.net/post/https://beige.party/users/NuclearOatmeal/statuses/116580225206967388Fri, 15 May 2026 19:24:25 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 18:46:30 GMT]]>@cR0w here you go https://www.openwall.com/lists/oss-security/2026/05/15/2

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/rikusilvola/statuses/116580076151722517https://board.circlewithadot.net/post/https://infosec.exchange/users/rikusilvola/statuses/116580076151722517Fri, 15 May 2026 18:46:30 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 18:22:59 GMT]]>@Viss @ciaranmak @cR0w well runc isn't really a very strong boundary compared to gvisor or kata containers, so I'm not too worried there

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/starchturrets/statuses/116579983649375278https://board.circlewithadot.net/post/https://mastodon.social/users/starchturrets/statuses/116579983649375278Fri, 15 May 2026 18:22:59 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 18:12:33 GMT]]>@ciaranmak @starchturrets @cR0w oh god yes. docker 0day. shoot that shit right into my veins

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116579942643869116https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116579942643869116Fri, 15 May 2026 18:12:33 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 17:59:43 GMT]]>@starchturrets @cR0w I will report back because tbh if I don't end up out in the pub this evening I'm probably gonna test this one out

]]>https://board.circlewithadot.net/post/https://mastodon.ie/users/ciaranmak/statuses/116579892188969193https://board.circlewithadot.net/post/https://mastodon.ie/users/ciaranmak/statuses/116579892188969193Fri, 15 May 2026 17:59:43 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 17:55:42 GMT]]>@ciaranmak @cR0w I'm not so sure how bad this is in comparison to the embargoed KVM one at https://xchglabs.com/blog/

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/starchturrets/statuses/116579876339728689https://board.circlewithadot.net/post/https://mastodon.social/users/starchturrets/statuses/116579876339728689Fri, 15 May 2026 17:55:42 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 17:54:17 GMT]]>@cR0w BleepingComputer are getting slow in their old age (likewise).

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/McCovican/statuses/116579870770409292https://board.circlewithadot.net/post/https://infosec.exchange/users/McCovican/statuses/116579870770409292Fri, 15 May 2026 17:54:17 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 17:51:42 GMT]]>@McCovican I think that one was published yesterday, which is like three years ago in this week time.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116579860667874285https://board.circlewithadot.net/post/https://infosec.exchange/users/cR0w/statuses/116579860667874285Fri, 15 May 2026 17:51:42 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 17:51:02 GMT]]>@cR0w Shenanigans ahoy! https://www.bleepingcomputer.com/news/security/popular-node-ipc-npm-package-compromised-to-steal-credentials/

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/McCovican/statuses/116579858016665203https://board.circlewithadot.net/post/https://infosec.exchange/users/McCovican/statuses/116579858016665203Fri, 15 May 2026 17:51:02 GMT<![CDATA[Reply to No new npm packages compromised? on Fri, 15 May 2026 17:46:03 GMT]]>@starchturrets @cR0w noice, mom and dads malware sandbox got REKT

]]>https://board.circlewithadot.net/post/https://mastodon.ie/users/ciaranmak/statuses/116579838413944847https://board.circlewithadot.net/post/https://mastodon.ie/users/ciaranmak/statuses/116579838413944847Fri, 15 May 2026 17:46:03 GMT