Cyber Attacks
Organisations face persistent threat from imgdecode npm package still hosting encrypted shellcode loader
The malicious imgdecode package downloads encrypted payloads from GitHub and injects them into a new process on Windows systems.
Node.js
Everything Sandbox Desk has reported about Node.js: 2 stories, newest first. Part of our Cyber Attacks coverage.
Vulnerabilities
Node.js Library Flaw Lets Attackers Run OS Commands via Archive Paths
An unpatched command injection flaw in the @mborne/extract npm package allows remote attackers to execute arbitrary system commands with Node.js privileges.