Javascript
Update Chrome: Google patches actively exploited vulnerability and 73 others
Google's latest Chrome update fixes 74 security vulnerabilities, including one under active attack ...
Axios Front-End Library npm Supply Chain Poisoning Alert
Overview On March 31, NSFOCUS CERT detected that the npm repository of the HTTP client library Axios was poisoned by the supply chain. The attacker bypassed the normal GitHub Actions CI/CD pipeline ...
Revived CryptoJS library is a crypto stealer in disguise
An illicit npm package called 'crypto-encrypt-ts' may appear to revive the unmaintained but vastly popular CryptoJS library, but what it actually does is peek into your crypto wallet and exfiltrate your secrets ...
‘Polyfill’ Supply Chain Threat: 4x Worse Than We Thought
Spackle attack: Chinese company takes over widely used free web service—almost 400,000 websites at risk ...
Polyfill.io supply chain attack hits 100,000+ websites — all you need to know
In a significant supply chain attack, over 100,000 websites using Polyfill[.]io, a popular JavaScript CDN service, were compromised ...
Web Injection Campaign Targets 40 Banks, 50,000 Users
Dozens of banks around the word are in the crosshairs of a threat group using JavaScript web injections to steal users’ bank account credentials. The campaign, which the hackers have been preparing ...
Silent Skimmer: The Rising Threat in Card-Skimming Attacks
A notorious Chinese-speaking threat actor, known for skimming credit card numbers off e-commerce sites and point-of-sale service providers across Asia/Pacific, has expanded its target scope to North and Latin America. The post ...
Foliage 2023
The days are getting shorter and when we were visiting Down East Maine the other week, there was just a hint of some trees starting to change up their leaf palettes. It ...
Keeping Track Of URLs Shared On Bluesky
While the future of Bluesky is nowhere near certain, it is most certainly growing. It’s also the largest community of users for the AT Protocol. Folks are using Bluesky much the same ...
JavaScript: A Taxing Situation
An authorized IRS eFile website is the latest victim of a JavaScript attack. eFile.com has become the victim of an attack which originated in a previously innocent JavaScript file. The javascript file, ...
