The design flaw in Flowise’s Custom MCP node has allowed attackers to execute arbitrary JavaScript through unvalidated ...

Hackers are exploiting a maximum-severity vulnerability, tracked as CVE-2025-59528, in the open-source platform Flowise for ...

Hackers hijacked the npm account of the Axios package, a JavaScript HTTP client with 100M+ weekly downloads, to deliver remote access trojans to Linux, Windows, and macOS systems. One malicious ...

North Korean hackers published backdoored versions of the Axios NPM package using a compromised long-lived access token.

Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying ...

A credit card skimmer campaign discovered in early 2025 and still actively tracked as of April 2026 has compromised an ...

This is GlassWorm: a software supply chain attack that security researchers are calling one of the most sophisticated and ...

The widely used Axios HTTP client library, a JavaScript component used by developers, was recently hacked to distribute malware via a compromised account. Attackers exploited a hijacked account on npm ...

Google is now working to kill back button hijacking on its browsers by effecting a new policy change everyone has to abide by ...

A critical Adobe Acrobat zero-day has been exploited for months via malicious PDFs to steal data and potentially take over ...

The Food and Drug Administration recently approved a once daily Wegovy semaglutide pill for weight management, offering an alternative to weekly injections. Fatima Cody Stanford says it works through ...