DanSec

Vendor

npm

In 78 briefs, most recently 17 October 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Coverage in DanSec Daily

  1. Burger King Japan breach of 11.18M records, BAE Systems incident halting US bankruptcy notices, and critical Magento BlockStrap RCE flaw.
  2. The ASOS breach, Google domain hijacking via .gh/.sl/.as registries, FortiBleed attacks on Fortinet FortiGate, and Atlassian CVE-2026-21589 exploitation.
  3. DoFun car head-unit Android malware, 9,300 exposed AWS keys, and Cisco's nine Crosswork and Secure Workload patches, plus an exploited Entra ID flaw.
  4. Metabase zero-day breaches customer data, Unlimited Technology Systems reports a 3.8M-person healthcare breach, and Claude Code and Gemini CLI flaws expose CI …
  5. Unitel cyberattack before its IPO, a tl;dv Firebase flaw exposing private meetings, and ChainDrop malware compromising 1,300+ npm packages.
  6. Anthropic's Claude agent breaching real organizations, the Brinks Home ShinyHunters breach, and a critical JetBrains TeamCity authentication bypass …
  7. The Minnesota water system OT attack, OpenAI's Hugging Face breach expansion, and Cisco FMC zero-day CVE-2026-20316 exploitation.
  8. KDDI breach hits 12M people, AssuranceAmerica exposes 6.9M customers' license data, and the RoguePlanet Defender flaw enables SYSTEM access.
  9. AssuranceAmerica breach hits 6.9M drivers, KDDI zero-day breach affects 12M, and GodDamn ransomware uses a signed Microsoft driver to kill security tools.
  10. Polymarket $3M frontend hack via vendor, Klue-Salesforce breach hitting two dozen firms, and Signal backup-key phishing by Russian-linked hackers.
  11. Tata Electronics cyberattack and Klue OAuth-token breaches hitting LastPass and Salesforce customers, plus FortiBleed hitting 430,000 FortiGate firewalls with …
  12. Kodak breach by ShinyHunters, iRhythm ransom theft, and three Fortinet FortiSandbox flaws actively exploited across up to 30,000 devices.
  13. Iowa school district ex-IT worker jailed 21 months; decade-long Chinese espionage via hijacked authentication; critical Splunk Enterprise flaw patched.
  14. ShinyHunters leaks 234 GB of DentaQuest data, Miasma worm breaches 73 Microsoft GitHub repos, and Cisco SD-WAN Manager CVE-2026-20245 exploited unpatched.
  15. The Hola Browser supply chain cryptominer, the DentaQuest breach of 2.6M accounts, and Cisco zero-days in Unified Communications Manager and SD-WAN Manager.
  16. Megalodon attack compromises 5,500+ GitHub repos; Ghost CMS SQL injection CVE-2026-26980 actively exploited; TrapDoor hits npm, PyPI, Crates.io.
  17. Supply chain attacks on Packagist and Laravel-Lang PHP packages abusing GitHub releases, Anthropic's Project Glasswing finding 10,000+ flaws, and the …
  18. GitHub internal repos breached via malicious VS Code extension; Grafana Labs source code breach via npm supply-chain attack; 7-Eleven ShinyHunters breach.
  19. Grafana source code theft, the ShinyHunters-linked 7-Eleven breach, and an unpatched zero-day in Microsoft Exchange under active exploitation.
  20. South Staffordshire Water fined £963,900 after breach; TeamPCP Mini Shai-Hulud worm hits npm/PyPI; ShinyHunters attack Instructure Canvas twice.
  21. Roblox credential theft via fake game enhancements, an actively exploited cPanel zero-day, and the Mini Shai-Hulud SAP npm supply chain attack.
  22. Malicious checkmarx/kics Docker images, a self-propagating npm worm stealing developer tokens, and Lotus Wiper attacks on Venezuela's energy sector.
  23. Wynn Resorts breach affecting 21,000 employees, Drift Protocol's $280M in-person crypto heist, and Flowise and FortiClient EMS exploits.
  24. Cisco source code theft, Axios npm hijack spreading malware, and Iranian Pay2Key pseudo-ransomware campaigns.
  25. LeakBase admin arrest, HackerOne employee data breach via Navia, and Microsoft 365 device code phishing hitting 340+ organizations.
  26. The Trivy supply chain attack by TeamPCP, Oracle Identity Manager flaw CVE-2026-21992, and Iranian cyberattacks disrupting Maryland hospitals.
  27. The Intuitive phishing breach, GlassWorm supply-chain malware hitting 400+ repos, and Sears exposing AI chatbot conversations to the public web.
  28. The Oracle E-Business Suite breach at Madison Square Garden, APT28's MSHTML zero-day CVE-2026-21513, and North Korea's Contagious Interview npm campaign.
  29. ShinyHunters breaches at Wynn Resorts and CarGurus, a worm-like Sandworm_Mode npm supply chain attack, and Reddit's £14.47M UK fine.
  30. Odido breach hits 6 million customers, BeyondTrust RS/PRA CVE-2026-1731 exploited within 24 hours of PoC, and Chrome extensions steal Meta Business Suite …
  31. Flickr third-party email breach, SmarterMail RCE (CVE-2026-24423) exploited in ransomware, and TGR-STA-1030 espionage across 37 countries.
  32. Crunchbase breach by ShinyHunters, failed Sandworm wiper attack on Polish power grid, and nearly 800,000 exposed Telnet servers via GNU InetUtils flaw.
  33. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  34. The Trust Wallet Chrome extension theft, Ivanti EPMM zero-day attacks, and the DarkSpectre browser extension campaign hitting 2.2 million users.
  35. Coupang's $1.17B breach compensation, Aflac's 22M-person data breach and the actively exploited MongoBleed MongoDB flaw.
  36. The French postal service cyberattack, the Nissan and Red Hat GitLab data exposure, and the Baker University breach affecting 53,000 people.
  37. Coupang breach exposing 33.7M users, Shai-Hulud 2.0 npm attack leaking 400,000 developer secrets, and North Korean threat actors renting engineers' identities …
  38. FFF data breach, 17,000+ secrets exposed in public GitLab repos, and North Korean Contagious Interview npm packages spreading OtterCookie malware.
  39. Gainsight breach expands to more Salesforce customers, Shai-Hulud v2 npm-to-Maven supply chain attack, and Qilin ransomware hits South Korean MSP. Plus London …
  40. Dartmouth breach via Oracle E-Business Suite by Clop, OnSolve CodeRED emergency alert disruption, and SitusAMC hack hitting US banks, plus Fluent Bit flaws and …
  41. The Oracle EBS extortion campaign hitting Cox, Canon and Mazda, the Shai-Hulud npm malware wave, and Harvard's voice phishing breach, plus new zero-days.
  42. The Oracle E-Business Suite-linked Cl0p breaches including Logitech, Chrome and FortiWeb zero-days, and the record 15.72 Tbps Aisuru DDoS attack on Microsoft …
  43. The Oracle EBS data theft fallout, Operation Endgame takedowns, and actively exploited Fortinet and WatchGuard flaws in today's cybersecurity news.
  44. Citrix Bleed 2 and Cisco ISE zero-day exploitation, the Synnovis ransomware data breach, and a 67,000-package npm spam worm.
  45. Ribbon Communications nation-state breach, Conduent 10.5M-record ransomware-claimed breach, and China-linked VMware Tools zero-day exploitation.
  46. Dentsu/Merkle breach, Canadian water and energy hacktivist intrusions, and DELMIA Apriso and XWiki exploitation, plus TEE.fail and PhantomRaven.
  47. Envoy Air's Oracle EBS data theft claimed by Clop, Prosper's breach of 17.6 million accounts, and Zendesk email bombing.
  48. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  49. FBI seizes BreachForums amid ShinyHunters Salesforce extortion; Gladinet CentreStack zero-day CVE-2025-11371 and Oracle EBS zero-day attacks actively exploited.
  50. Co-op's £80M cyberattack loss, Shai-Hulud npm worm infecting 500+ packages, and Cisco zero-days under CISA emergency directive.
  51. Boyd Gaming breach, GeoServer flaw (CVE-2024-36401) hitting a US federal agency, and RTX ransomware disrupting European airports via Collins Aerospace.
  52. Boyd Gaming data breach, Jaguar Land Rover production shutdown, and fake Malwarebytes and LastPass installers on GitHub targeting Mac users.
  53. Salesforce data theft by ShinyHunters via Salesloft Drift tokens, Shai-Hulud NPM supply chain worm, and Chrome zero-day CVE-2025-10585.
  54. JLR extends shutdown after cyberattack; Microsoft and Cloudflare dismantle RaccoonO365 phishing network; DHS misconfigured data hub exposes sensitive …
  55. Npm supply chain compromise of 40+ packages, KillSec ransomware breach of a Brazilian healthcare software provider, and Google's LERS account abuse.
  56. The Jaguar Land Rover breach, a record NPM supply-chain attack, and Scattered Spider's $380M Clorox heist, plus Microsoft's 80 patches and Chinese APT activity.
  57. Plex data breach, Adobe's SessionReaper Magento flaw and SAP NetWeaver criticals.
  58. The npm supply chain attack, the Salesloft Drift breach hitting Salesforce, and GhostAction's theft of 3,325 CI secrets from GitHub workflows.
  59. S1ngularity NPM attack hits 2,180 GitHub accounts; SVG phishing mimics Colombia's judiciary; Noisy Bear targets Kazakh energy sector.
  60. Jaguar Land Rover cyberattack disrupts operations, Workiva breach via Salesforce CRM, and Salesloft/Drift fallout hits Cloudflare, Palo Alto Networks and …
  61. The Zscaler and Salesloft data breaches, Midnight Blizzard's Microsoft 365 operation disrupted by Amazon, and a WhatsApp zero-click patch.
  62. The Bouygues Telecom breach of 6.4 million customers, the Salesforce vishing campaign tied to ShinyHunters, and the CISA-mandated patch for Exchange …
  63. Akira ransomware exploiting SonicWall SSL VPN zero-days, the Pi-hole GiveWP breach, and Secret Blizzard AitM attacks on Moscow embassies.
  64. Saint Paul city cyberattack prompting National Guard activation, Aeroflot flight cancellations, and Allianz Life breach hitting 1.4M US customers.
  65. The Toptal npm supply chain breach, Cisco ISE and PaperCut exploitation, and the BlackSuit-to-Chaos ransomware shift in one daily brief.
  66. BlackSuit ransomware sites seized, Toptal GitHub breach poisons npm packages, and ToolShell SharePoint flaws hit 400+ servers.
  67. NNSA breach via Microsoft SharePoint zero-days, Clorox's $380M suit against Cognizant, and a backdoored npm 'is' package.
  68. SharePoint zero-days (CVE-2025-53770/53771) breached 75+ servers, 3,500 sites ran stealth crypto miners, and npm packages were trojanized via phishing.
  69. Salt Typhoon's long-running access to US National Guard systems and CrowdStrike outage hit 750+ US hospitals; PoisonSeed bypasses FIDO2 MFA via WebAuthn …
  70. The Belk and McDonald's data incidents, North Korea's npm Contagious Interview campaign, and Chrome 138's fifth zero-day of 2025.
  71. Gluestack NPM packages backdoored with a RAT, destructive NPM wiper packages, and Apple denying iPhone crash links to Chinese hackers.
  72. Malicious npm/VS Code packages stealing data via Discord webhooks, and Russia-linked TAG-110 phishing Tajik government with macro-enabled Word templates.
  73. 70+ malicious npm and VS Code packages exfiltrating data via Discord, ChatGPT Deep Research adding Dropbox and Box integration, and OpenAI's o3 altering a …
  74. Covers the 184M password exposure, $223M Cetus Protocol crypto heist, and Europol's Operation Endgame ransomware crackdown.
  75. The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
  76. Pearson breach, Insight Partners data theft, and Toronto school district ransom, plus SonicWall and Cisco flaws and Qilin ransomware activity.
  77. APT29 phishes European diplomats with wine-themed lures and GRAPELOADER; malicious npm packages plant SSH backdoors; Entra ID leaked-credential alerts lock out …
  78. GOFFEE attacks on Russian organizations, Gamaredon spear-phishing against Ukrainians, and OttoKit WordPress plugin flaw exploited within hours of disclosure.