A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script.

Worker move goods for despatch in a redistribution centre of US online retail giant Amazon in Horn-Bad Meinberg, western Germany, on December 9, 2024. INA FASSBENDER/AFP via Getty Images Cloudflare's ...

JSCeal hides crypto-stealing malware in V8 bytecode, but researchers built a tool to decompile it and expose its advanced theft capabilities.

JSCeal can steal browser credentials, replay Google sessions using stolen cookies, and modify traffic for cryptocurrency services.

The Hacker News is the top cybersecurity news platform, delivering real-time updates, threat intelligence, data breach ...

On 22 July 2026 (the day prior to Proofpoint’s joint release with the NSA), TA488 initiated a new wave of exploitation abusing a cross-site scripting (XSS) vulnerability, CVE-2026-42897, in Outlook ...

Indonesia is increasingly relying on short-term, fragmented solutions to address political, economic, social and security challenges. The same logic behind the country’s “sachet economy” — where goods ...

RL researchers have been observing and detecting malicious versions of the npm package @validate-sdk/v2 since October 2025. The package exports functions that pretend to encode data and validate ...

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...

Today we published an update on our collaboration with Mozilla, in which Claude Opus 4.6 found 22 vulnerabilities in Firefox over the course of two weeks. As part of that work, we evaluated whether ...

A critical sandbox escape vulnerability has been disclosed in vm2, a popular Node.js library used to run untrusted code in a sandboxed environment. CVE-2026-22709 allows attackers to bypass Promise ...