Attackers used a single hardcoded Cloudflare API key to hijack Brevo's CDN edge for five and a half hours on September 14, serving fake Cloudflare verification pages and silently installing a backdoor…
A self-propagating npm worm called ChainDrop compromised 444 packages, including keyv (600M monthly downloads), flat-cache, and file-entry-cache, on August 4, 2026, spreading in under four hours and e…
Socket's Threat Research Team reported an active supply chain attack on August 4, 2026, that compromised the npm packages keyv and cacheable, affecting tens of millions of weekly downloads. The attack…
Snyk introduced Agentic AppSec with two new capabilities: Remediation Agent, now in public preview, and Malicious Code Defense, in private preview. The Remediation Agent automatically fixes vulnerabil…
The npm package keyv published version 6.0.0 on 4 August 2026 with a preinstall script that executes an obfuscated dropper, compromising any developer who installed it directly or as a transitive depe…