PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

From DEF CON Research to Automated Supply Chain Defense, finding npx confusion vulnerabilities with npxconfuse

lab.ctbb.show | research | #rce | #supply-chain | #zero-day | #open-source | #mcp | #npm | #npx | #dependency-confusion
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

The npxconfuse scanner automates detection of npx confusion and scoped binary name mismatches, finding unclaimed npm package names in codebases and GitHub orgs, including a Brave MCP server zero-day.
Published
Collected

Related coverage

Critical · vulnerability · aikido.dev
Node2Shell Evolves to HTTP2Shell: Google Brotli Flaw (CVE-2026-111497) Affects HTTP Ecosystem
Brotli is ubiquitous across the modern HTTP ecosystem for web asset compression. Because the flaw allows unauthenticated remote code execution in both directions, any service or client automatically decompressing untrusted Brotli payloads is at critical risk until patched.
Critical · vulnerability · github.com
php2shell-zeros: Unpatched 0-Day RCE Flaws and Weaponized Exploit Chains in PHP and NativePHP
These surviving flaws bypass earlier patches and demonstrate that core PHP deserialization and memory management remain fundamentally fragile, posing critical unauthenticated RCE risks to WordPress and production PHP services.
Critical · advisory · github.com
GHSA-9v8h-qqgm-4m35: Out-of-Bounds Write in Brotli Decoder ("Node2Shell") Affects Python & Node.js Ecosystems (CVE-2026-111497)
Because Brotli is ubiquitous across web servers, browsers, runtimes, and package registries, any application decompressing untrusted user-supplied payload with affected decoders is vulnerable to memory corruption or RCE.
blog · wiz.io
Supply Chain Zero Days: Closing the Gap Between Publication and Detection
Attackers use compromised npm packages to spread malware in minutes. Discover how Wiz detects malicious packages at publication using AI and dynamic analysis.
blog · netspi.com
3 Software Supply Chain Risks in 2023
Software supply chain attacks in 2023 cluster into three categories: package manager attacks like dependency confusion and typosquatting, developer compromise, and breaches at large software vendors.
research · lab.ctbb.show
WAF Bypasses via h2 framing
# WAF Bypasses via h2 framing ~/authors/fsi - profile fsi * * * Diyan Apostolov Jun 01, 2026 # HTTP/2 WAF Bypass: A Black-Box Methodology ## Introduction Modern web infrastructure relies heavily...
Back