http://www.cybersecurityos.net/tags/npm/Recent content in Npm on CybersecurityOSHugoen-usSun, 12 Jul 2026 18:53:29 -0500http://www.cybersecurityos.net/posts/os-weekly/os-weekly-2026-07-12/Sun, 12 Jul 2026 00:00:00 +0000http://www.cybersecurityos.net/posts/os-weekly/os-weekly-2026-07-12/<p>The software supply chain stayed the softest target in the room this week: a poisoned npm package was quietly dropping an infostealer on developer machines within minutes of publishing. CISA gave federal agencies a hard deadline on an actively exploited AI-framework flaw, and two separate pieces this week wrestled with the same question from opposite directions — is AI tipping the scales toward attackers or defenders? Here&rsquo;s the rundown.</p> <h2 id="critical-threats--active-exploits">Critical Threats &amp; Active Exploits</h2> <h3 id="a-compromised-npm-package-was-dropping-an-infostealer-within-six-minutes-of-publishing">A compromised npm package was dropping an infostealer within six minutes of publishing</h3> <p><img src="https://www.dropbox.com/scl/fi/zmib48m9lfuvpvmzm5t6m/Compromised-npm-release-of-jscrambler-8.14.0-drops-Rust-infostealer..png?rlkey=x680ut34rdqat63dsj1kumatb&amp;raw=1" alt="Illustration representing the compromised jscrambler npm package supply-chain attack"></p>