GoKawiil
Tech News
Security researchers at SafeDep discovered that a malicious npm package called mathmain, disguised as a copy of the popular mathjs library, contains a hidden remote access implant. The malicious code stays encrypted and dormant until a specific equation is solved using the library's lusolve() solver function, which acts as a decryption key to unlock and execute the payload.
Checkmarx researchers uncovered a malicious npm package called 'indexed-btree,' which mimics the legitimate 'sorted-btree' library and has racked up 2 million weekly downloads. Rather than embedding malicious code in install scripts—now restricted by npm's June 2026 security measures—the attackers hid a malware loader inside the package's commonly used BTree.prototype.set() method, which activates only when called with a specific key. Once triggered, the malware gathers system data such as hostname, CPU, memory, and uptime, and sends it to attackers who reportedly control a wallet holding 109 ETH, though its link to this campaign is unconfirmed.
A joint advisory from law enforcement in Japan, the US, Australia and Germany says the North Korean-linked group WaterPlum infected over 30,000 devices across more than 100 countries between December 2025 and July 2026. The hackers drained more than 7,000 cryptocurrency wallets and moved over $10.7 million worth of crypto assets to North Korea, using fake job interviews and malicious code disguised as coding tests or software projects to infect victims.
The htmx team released version 4.0.0 after eight months of development, rewriting the library's internals to use the fetch() API instead of XMLHttpRequest. Key user-facing changes include making attribute inheritance explicit by default, standardizing event names, and dropping localStorage as the default for history support. The team is not marking 4.0 as 'latest' on NPM, keeping 2.x as the default for CDN users until early 2027 while 4.0 becomes the 'next' line.
The Australian Federal Police arrested two men, aged 21 and 23, from Western Australia over their alleged roles in TeamPCP, a group accused of running the longest-running spree of software supply chain attacks. TeamPCP is said to have poisoned hundreds of open-source packages using a self-propagating worm called Shai-Hulud, stealing developer credentials to spread malicious code further. KrebsOnSecurity reports it had identified the 21-year-old suspect months earlier and had been in contact with a person claiming to speak for the group.
Researchers found threat actors uploading npm packages containing only a malicious HTML file disguised as a Cloudflare verification page. When mirrored by sites like UNPKG and npmmirror, these files become directly viewable in a browser under a trusted domain, redirecting victims to attacker-controlled sites. OX Security identified 24 such packages, following an earlier discovery in July involving a package called 'china_airlines'.