PackageGate bugs let attackers bypass protections in NPM, PNPM, VLT, and Bun

Security Affairs

January 28, 2026 at 8:43 AM

Overview

Researchers at Koi have discovered a series of vulnerabilities known as 'PackageGate' affecting popular JavaScript package managers: NPM, PNPM, VLT, and Bun. These flaws allow attackers to bypass existing supply chain protections, potentially enabling them to execute malicious code within applications that rely on these package managers. This is particularly concerning given the widespread use of these tools in the development community, meaning that many developers and organizations could be at risk without realizing it. The vulnerabilities pose a serious threat to software integrity and the security of applications built using these package managers. Developers are urged to stay vigilant and implement necessary security measures to protect their projects.

Key Takeaways

Affected Systems: NPM, PNPM, VLT, Bun
Action Required: Developers should monitor for updates from the respective package managers and apply any security patches as they become available.
Timeline: Newly disclosed

Original Article Summary

Koi researchers found “PackageGate” flaws in NPM, PNPM, VLT, and Bun that let attackers perform supply chain attacks and run malicious code. Security firm Koi uncovered a set of vulnerabilities collectively tracked as “PackageGate” affecting major JavaScript package managers like NPM, PNPM, VLT, and Bun. These flaws could let attackers bypass supply chain protections and […]

Impact

NPM, PNPM, VLT, Bun

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Developers should monitor for updates from the respective package managers and apply any security patches as they become available.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Vulnerability.

Read Original Article

Related Coverage

New Lotus data wiper used against Venezuelan energy, utility firms

BleepingComputer

Researchers have identified a new type of data-wiping malware called Lotus, which was used in targeted attacks against energy and utility companies in Venezuela last year. This malware is particularly concerning as it specifically targets critical infrastructure, potentially disrupting essential services. The attacks indicate a growing trend of cyber threats aimed at destabilizing operations in the energy sector, which can have far-reaching consequences for both companies and the general public. Organizations in similar sectors should be vigilant and enhance their cybersecurity measures to protect against such threats. The emergence of Lotus highlights the ongoing risks faced by utilities worldwide.

Apr 21, 2026

Sysdig report signals end of human-led cloud defense

SCM feed for Latest

Loris Degioanni, the founder and CTO of Sysdig, announced that many organizations are moving away from traditional human-led cloud security measures. According to recent data, over 70% of security teams are now using behavior-based runtime detection methods to secure their cloud environments. This shift indicates a growing reliance on automated systems to identify and respond to security threats. As cloud infrastructures become more complex, the need for real-time, automated responses is becoming critical. This change could significantly impact how companies manage security and protect their digital assets moving forward.

Apr 21, 2026

Fortinet architect warns of OT cloud convergence risk

SCM feed for Latest

Federal agencies in the U.S. are facing significant security challenges as they modernize their systems under new fiscal mandates for 2026. Robert Imhof, a federal architect at Fortinet, warns that the merging of cloud services, IT, and operational technology has outpaced existing security measures, which are often disjointed and ineffective. This lack of visibility creates vulnerabilities that could be exploited by cybercriminals. As agencies rush to update their infrastructures, they need to prioritize the integration of their security architectures to protect against potential attacks. This situation affects not only government operations but could also have broader implications for national security and public safety.

Apr 21, 2026

22 BRIDGE:BREAK Flaws Expose 20,000 Lantronix and Silex Serial-to-IP Converters

The Hacker News

Researchers at Forescout Research Vedere Labs have discovered 22 vulnerabilities in serial-to-IP converters made by Lantronix and Silex. These flaws could allow attackers to take control of nearly 20,000 devices and manipulate the data being transmitted through them. This is particularly concerning because serial-to-Ethernet converters are widely used in various industries, making them attractive targets for cybercriminals. Organizations using these devices need to be aware of the potential risks and take steps to secure their systems. The vulnerabilities are significant enough that they could lead to unauthorized access and data breaches if not addressed promptly.

Apr 21, 2026

Mastodon hit by DDoS attack, disrupting flagship server

SCM feed for Latest

Mastodon, a decentralized social media platform, experienced a distributed denial-of-service (DDoS) attack that began early Monday morning. The attack disrupted the functionality of its flagship server, impacting users who rely on the platform for communication and social interaction. Mastodon confirmed that they were investigating the incident around 7 a.m. ET. DDoS attacks can overwhelm a server with traffic, making it unavailable to legitimate users, which raises concerns about the platform's reliability and security. This incident highlights the ongoing challenges that online services face in protecting against cyber threats.

Apr 21, 2026

The Ungoverned Workforce: Cybersecurity Insiders Finds 92% Lack Visibility Into AI Identities

Hackread – Cybersecurity News, Data Breaches, AI and More

A recent study by Cybersecurity Insiders revealed that 92% of organizations lack visibility into AI identities within their systems. This lack of oversight poses significant risks as companies increasingly adopt AI technologies. Without proper monitoring, businesses may struggle to protect sensitive data and manage potential security breaches. The findings indicate a pressing need for organizations to improve their understanding and management of AI-related identities to mitigate these risks. As AI continues to integrate into various business operations, enhancing visibility and control over these identities will be crucial for maintaining cybersecurity.

Apr 21, 2026