Strapi plugins exploit Redis and PostgreSQL via postinstall scripts, enabling persistent access and data theft.

网络安全研究人员在npm注册表中发现了36个恶意包，这些包伪装成Strapi CMS插件，但携带不同的有效载荷，用于Redis和PostgreSQL利用、部署反向Shell、收集凭据并投放持久化植入程序。

Supply chain attacks feel like they're becoming more and more common.

After hacking Trivy, TeamPCP moved to compromise repositories across NPM, Docker Hub, VS Code, and PyPI, stealing over 300GB ...

UTC, Aikido Security detected an unusual pattern across the npm registry: dozens of packages from multiple organizations were ...

针对流行扫描工具Trivy的供应链攻击背后的威胁行为者，被怀疑正在进行后续攻击，导致大量npm包遭到破坏，其中包含一个此前未被记录的自传播蠕虫病毒，名为CanisterWorm。

Apple's freshly minted iOS 26.4 packs more punch than a double-shot macchiato. Headlining the release is Playlist Playground ...