ALL POSTS

Key Findings Security firm Koi discovered a set of vulnerabilities collectively tracked as "PackageGate" affecting major JavaScript package managers like NPM, PNPM, VLT, and Bun. These flaws could let attackers bypass supply chain protections and run malicious code hidden inside compromised dependencies. The safeguards widely promoted after the Shai-Hulud attack, such as disabling lifecycle scripts and relying on lockfiles, do not fully hold against these new "PackageGate" vu

Key Findings A new campaign is leveraging GitHub-hosted Python repositories to distribute a previously undocumented JavaScript-based Remote Access Trojan (RAT) dubbed PyStoreRAT. The malicious repositories, often themed as development utilities or OSINT tools, contain code responsible for silently downloading and executing a remote HTA file. PyStoreRAT is a modular, multi-stage implant that can execute various payloads, including an information stealer known as Rhadamanthys.

Key Findings Google released security updates for Chrome to address two security flaws, including one that is being actively exploited in the wild. The actively exploited vulnerability is CVE-2025-13223, a type confusion vulnerability in the V8 JavaScript and WebAssembly engine that could lead to arbitrary code execution or program crashes. Clément Lecigne of Google's Threat Analysis Group (TAG) discovered and reported the flaw on November 12, 2025. Google has not provided de

Key Findings Google has released an emergency security update for Chrome Stable Channel, addressing a high-severity vulnerability in the V8 JavaScript engine (CVE-2025-13042) The vulnerability, described as an "inappropriate implementation in V8", could potentially lead to type confusion, memory corruption, or arbitrary code execution While no active exploitation is reported, V8 flaws have historically been targeted by threat actors for zero-day exploits in spear-phishing and