Critical

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

SecurityWeek

October 6, 2026 at 10:34 AM

Actively Exploited

Overview

Since August 2023, a malicious campaign known as MALFEX has targeted users of the Node Package Manager (NPM) by distributing eight harmful packages. These packages have been downloaded around 40,000 times, indicating a significant reach. Attackers use these malicious packages to potentially compromise projects relying on NPM, which is widely used in JavaScript development. This incident raises concerns for developers and organizations that depend on NPM for their software, as the malicious code could be used to steal data or introduce vulnerabilities. Users are urged to verify package integrity and avoid untrusted sources to protect their projects.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: NPM packages, JavaScript development projects
Action Required: Users should verify package integrity and avoid using untrusted packages from NPM.
Timeline: Ongoing since August 2023

Original Article Summary

Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign. The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek.

Impact

NPM packages, JavaScript development projects

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Ongoing since August 2023

Remediation

Users should verify package integrity and avoid using untrusted packages from NPM.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Malware.

Read Original Article

Related Coverage

PEERSTITCH Malware Deployed via FortiOS Flaw Bypasses Checks on Tagged VPN Sessions

The Hacker News

A sophisticated threat actor is exploiting a vulnerability in Fortinet's FortiOS, which affects several of its products including FortiPAM, FortiProxy, and FortiSwitchManager. The flaw, identified as CVE-2025-61624, allows attackers to bypass security checks on tagged VPN sessions. This exploitation leads to the deployment of a new type of malware called PEERSTITCH, which operates in memory on ARM64 architecture. The CVSS score for this vulnerability is 5.4, indicating a moderate level of risk. Companies using these Fortinet products should be vigilant and assess their systems for potential attacks, as the exploitation is currently active in the wild.

Oct 16, 2026

AI Slop Isn't Just for Social Media; It's Ruining Cyberattacks, Too

darkreading

The article argues that artificial intelligence (AI) is making cyberattacks less sophisticated rather than more dangerous. It claims that serious cybercriminals are not utilizing AI tools extensively, suggesting that these technologies are not living up to the hype in the cybersecurity realm. Instead, the author indicates that traditional methods of attack are still prevalent and effective. This perspective raises questions about the true impact of AI on cybersecurity and whether it is genuinely enhancing threats or merely complicating the landscape. Companies and security teams should remain vigilant, as the article hints at a disconnect between AI capabilities and practical, malicious use.

Oct 15, 2026

Hackers exploit Collabora RCE flaw to backdoor Nextcloud servers

BleepingComputer

Hackers are taking advantage of a serious command execution vulnerability, identified as CVE-2026-110447, in the Collabora Online - Built-in CODE Server app, which is used within Nextcloud. This flaw allows attackers to run arbitrary commands on affected systems, potentially leading to unauthorized access and backdoors in Nextcloud servers. Organizations using this application are at risk, as the exploitation of this vulnerability is already occurring in the wild. Users need to take immediate action to secure their systems and ensure they are not compromised. The issue highlights the ongoing challenges in securing collaborative tools that are increasingly used for remote work and data sharing.

Oct 15, 2026

Critical PwnEscape Linux Kernel Vulnerability Lets Guest VMs Read Host Memory

The Hacker News

A serious vulnerability in the Linux kernel, identified as CVE-2026-99999 and dubbed PwnEscape, has been revealed, allowing virtual machines (VMs) to access the memory of the host system. This flaw is located within the networking code of the Linux kernel, meaning it affects multiple cloud environments, not just one particular setup. A researcher demonstrated this vulnerability on Vercel's cloud sandboxes, and the company confirmed the issue. This breach poses significant risks, as it could enable attackers to extract sensitive data from the host machine, potentially compromising the integrity and confidentiality of the systems involved. Companies using Linux-based virtual machines should be vigilant and take appropriate measures to safeguard their environments.

Oct 15, 2026

The next election influence campaign will target your AI chatbot

CyberScoop

Researchers have discovered that someone is actively creating hyperlocal content about political races, which is intended to influence AI chatbots. This content is being used to train these chatbots to favor specific candidates on various issues. The implications are significant, as this practice could undermine the integrity of information provided by AI systems, potentially skewing public perception and decision-making during elections. Users of AI chatbots, especially those seeking unbiased information, may find themselves receiving manipulated responses that reflect these hidden agendas. This situation raises concerns about the ethical use of AI and the importance of transparency in how these systems are trained.

Oct 15, 2026

Hackers hijack D-Link, Ubiquiti devices to resell your stolen bandwidth

BleepingComputer

A recent campaign has targeted D-Link and Ubiquiti devices across 34 countries, allowing hackers to hijack these devices to create a commercial residential proxy network. This practice, known as proxyjacking, enables attackers to monetize stolen bandwidth from unsuspecting users. The impact is significant as it not only affects individual users' internet speeds and data privacy but also raises concerns about the security of these widely used devices. Users whose devices have been compromised may find their internet connections slower and could potentially face additional security risks if their devices are manipulated for illicit purposes. The situation underscores the need for users to secure their devices and remain vigilant against unauthorized access.

Oct 15, 2026