Tom Abai

Analysis of an npm account flooding the registry with malformed font packages.

Discover a critical security flaw that enables remote code execution in React Server Components.

See how the latest Shai-Hulud attack works.

A major NPM breach exposed 187 packages.

A sophisticated npm supply chain attack compromised popular packages

Learn about a fake VS-code extension on npm—truffelvscode—typosquatting the popular truffle for VS-code extension.

An Apache Tomcat web server vulnerability has been published, exposing the platform to remote code execution through a race condition failure.

This post covers the attack flow, how it happened, and the importance of supply chain security.

The new Chinese owner tampers with the code of cdn.polyfill.io to inject malware targeting mobile devices.

Discover how CVE-2024-3094 affects XZ Utils and enables SSH compromise. Get insights on detection, mitigation, and system security.

Discover the latest security threat as over 100 malicious packages target popular ML PyPi libraries. Learn about the attack methods.

Learn what LDAP Injection is, its types, examples, and how to prevent it. Secure your applications against LDAP attacks.

Discover the latest threat in town - a new info-stealer variant using Electron to remain undetected. Learn about its attack flow.

Mend.io research discovered a threat actor takeover of the name ‘gemnasium-gitlab-service', a retired Ruby gem with two million+ downloads.

Discover the threat of the 'Vibranced' npm package masquerading as 'Colors'. Learn about its stages of execution, obfuscation techniques.