PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Still Trusting Automated Patches Blindly? Think Again

jfrog.com | blog | #supply-chain | #malware | #npm | #phishing | #patch-management | #eslint-config-prettier
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

How a phishing breach of the eslint-config-prettier maintainer's npm account shipped six malicious versions and three more infected packages (~78M weekly downloads) with a Windows malware payload.
Published
Collected

Related coverage

vulnerability · volexity.com
Mind the (Patch) Gap: Multiple Chinese Threat Actors Chain 0-day Exploits in Chrome & Windows
On September 1, 2026, Volexity’s Network Security Monitoring service detected a spear-phishing campaign from a Chinese threat actor it tracks as UTA0560 targeting customers at multiple non-governmental organizations (NGOs). The emails contained a message encouraging the users to a click a link that led to the website of a US-based university. These links abused a reflected cross-site scripting (XSS) vulnerability on the website, redirecting recipients to threat-actor-controlled infrastructure hosting a multi-stage exploit chain that included a Google Chrome zero-day, CVE-2026-85046. Volexity analyzed its email telemetry and discovered that another Chinese threat actor it tracks as JungleBamboo (also known as APT31/Violet Typhoon/TA412) was also exploiting the same vulnerability chain against a different set of targets using different infrastructure and post-exploitation malware.
research · volexity.com
OceanLotus: Extending Cyber Espionage Operations Through Fake Websites
Since Volexity’s 2017 discovery that OceanLotus was behind a sophisticated massive digital surveillance campaign, the threat group has continued to evolve. In 2019, Volexity gave a presentation at RSA Conference […]
blog · jfrog.com
“Are We Exposed?” What CISOs Need to Know About Their Software Risk
When critical vulnerabilities strike Curl, PHP, or LiteLLM, can you answer "Are we exposed?" Discover how CISOs evaluate visibility and software supply chain risk.
blog · jfrog.com
JFrog Names Nine Global Winners for Inaugural Software Supply Chain Excellence Awards
Discover the winners of the inaugural JFrog Software Supply Chain Excellence Awards, recognizing 9 global leaders managing and securing software for AI delivery at enterprise scale.
blog · jfrog.com
Scanning AI Assets: Catching What SCA and SAST Might Miss
JFrog AI Security scans prompt instructions for malicious intent to protect your software supply chain from AI agent skill and APM package blind spots that conventional scanners might miss.
blog · jfrog.com
Lessons from the SolarWinds Breach: A Discussion With CISO Tim Brown
Former SolarWinds CISO Tim reflects on the historic Sunburst breach, fighting SEC charges, and securing the build pipeline against emerging AI threats.
Back