The design flaw in Flowise’s Custom MCP node has allowed attackers to execute arbitrary JavaScript through unvalidated ...

Hackers are exploiting a maximum-severity vulnerability, tracked as CVE-2025-59528, in the open-source platform Flowise for ...

Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver remote access trojans to Linux, Windows, and macOS systems. One malicious ...

North Korean hackers published backdoored versions of the Axios NPM package using a compromised long-lived access token.

A credit card skimmer campaign discovered in early 2025 and still actively tracked as of April 2026 has compromised an ...

This is GlassWorm: a software supply chain attack that security researchers are calling one of the most sophisticated and ...

The development was highlighted by supply chain security firm Socket (via Toms Guide ), with the report laying out 108 ...

The widely used Axios HTTP client library, a JavaScript component used by developers, was recently hacked to distribute malware via a compromised account. Attackers exploited a hijacked account on npm ...

Russian intelligence-linked hackers are targeting users of popular messaging apps like Signal, gaining access to private messages and impersonating victims in a sweeping global campaign, according to ...

Researchers linked 108 malicious Chrome extensions to a coordinated campaign that exposed about 20,000 users to data theft, ...

Google said it has noticed a sharp rise in websites hijacking the back button to show ads when users press it, so it will now ...

“The full breadth of this incident is still unclear, but given the popularity of the compromised package, we expect it will have far reaching impacts,” a chief Google analyst said. North Korea-aligned ...