npm

Everything Threat Times has reported about npm: 25 stories, newest first. Part of our Vulnerabilities coverage.

Vulnerabilities

GitHub Fixes npm Trusted Publishing Flaw Exposing 1,500 Packages to Takeover

Threat TimesOct 13, 2026

Researchers found that npm’s Trusted Publishing feature allowed attackers to publish malicious updates without stealing credentials by claiming abandoned repository names.

Cyber Attacks

Fake Web3 Accelerator Distributes Malicious npm Packages to Steal Data

Threat TimesOct 13, 2026

Threat actors posing as an accelerator used free AI credits to lure crypto founders into installing macOS backdoors and Windows stealers via fraudulent packages.

AI

OpenAI Codex CLI 0.157.0 Installs Persistent Self-Updating Daemon by Default

Threat TimesOct 13, 2026

A GitHub issue reports that the latest OpenAI Codex CLI version installs a background service that auto-updates and persists after sessions end, prompting user requests for change.

Data Breaches

Elastic Security Labs details REF8801’s fake Web3 accelerator and malicious npm packages

Threat TimesOct 12, 2026

Researchers found Apex Accelerator used fake audits and AI tools to deliver malware to crypto startups via compromised npm packages.

Malware & Ransomware

Shai-Hulud worm targets AI infrastructure via compromised Tensorlake npm package

Threat TimesOct 11, 2026

The Shai-Hulud credential-stealing worm has expanded its reach to AI tools by hijacking the Tensorlake package on the npm registry.

Malware & Ransomware

CloudSEK and Checkmarx Identify MALFEX Campaign Pushing RATs via npm

Threat TimesOct 9, 2026

Researchers attribute eight malicious npm packages delivering the Overlord RAT and stealers to a single threat actor since August 2023.

Cyber Attacks

Compromised tensorlake npm package delivers Shai-Hulud credential-stealing worm

Threat TimesOct 9, 2026

The tensorlake TypeScript SDK was hijacked in a supply chain attack, with version 0.5.144 distributing malware that steals credentials and executes remote code.

Data Breaches

Empire Market Co-Founder Sentenced to 40 Years; Tensorlake SDK Compromised

Threat TimesOct 9, 2026

SecurityWeek reports a major sentencing for the Empire Marketplace, alongside news of a compromised npm package and exposed GPU telemetry data.

Vulnerabilities

fast-jwt vulnerability allows attackers to bypass JWT claim validation checks

Threat TimesOct 8, 2026

A flaw in the fast-jwt library permits JSON array payloads to skip security validators, enabling bypass of expiry and issuer checks.

Vulnerabilities

fast-jwt 6.2.x Patch Reopens Critical JWT Algorithm Confusion Vulnerability

Threat TimesOct 8, 2026

A fix for CVE-2026-107722 in fast-jwt versions 6.2.0 through 6.2.4 is incomplete, allowing attackers to bypass authentication by manipulating PEM key headers.

Vulnerabilities

MariaDB Node.js Connector Patched for High-Severity SQL Injection Flaw

Threat TimesOct 8, 2026

A high-severity SQL injection vulnerability in the MariaDB Connector/Node.js package has been patched after researchers discovered that unescaped object keys could execute arbitrary database commands.

Vulnerabilities

Critical Code Injection Flaw in dot-access npm Package Allows Remote Command Execution

Threat TimesOct 8, 2026

A critical vulnerability in the dot-access package enables attackers to execute arbitrary operating system commands via crafted paths.

Vulnerabilities

Critical Handlebars RCE Vulnerability Bypasses Prototype Deny List

Threat TimesOct 8, 2026

A flaw in the npm Handlebars library allows attackers to execute arbitrary JavaScript by bypassing security checks via the Function constructor.

Vulnerabilities

Handlebars 4.7.9 AST Validation Bypassed in Critical Remote Code Execution Flaw

Threat TimesOct 8, 2026

A critical vulnerability in the popular Handlebars templating engine allows attackers to inject arbitrary JavaScript by bypassing recent security controls.

Vulnerabilities

vm2 exposes host HTTPS credentials and TLS traffic through globalAgent (Critical severity, CVE-2026-92940)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2: NodeVM builtin allowlist bypass via node:test.run() execArgv allows sandbox escape (Critical severity, CVE-2026-92948)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process (Critical severity, CVE-2026-92957)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package (Critical severity, CVE-2026-92951)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2: GHSA-m283-3h24-438v fix bypass leads to host RCE via call/apply indirection (Critical severity, CVE-2026-92937)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2: NodeVM nesting guard accepts array-shaped require and permits host RCE (Critical severity, CVE-2026-92935)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2 NodeVM can replace the host process TLS trust store (Critical severity, CVE-2026-92941)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2 sandbox escape on Node.js 26 through a stale PromiseThenLookupChain protector (Critical severity, CVE-2026-92944)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2 crypto builtin loads attacker native code through setEngine (Critical severity, CVE-2026-92939)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.

Vulnerabilities

vm2 allows a sandboxed plugin to execute native code through `node:sqlite` (Critical severity, CVE-2026-92938)

Threat TimesOct 1, 2026

A critical-severity advisory for the npm package vm2 is fixed in version 3.11.7.