MALFEX: Eight Malicious npm Packages, 40,767 Downloads, and an ASCII Art Font That Drops a RAT
No Comments on MALFEX: Eight Malicious npm Packages, 40,767 Downloads, and an ASCII Art Font That Drops a RAT
A lone, Portuguese-speaking operator has been seeding npm with malware since 2023, and three of the eight flagged packages are reportedly still live. Here's how the MALFEX campaign works and what I'd check in my own projects today.
GitLab Warns of a Max-Severity Code Execution Flaw in Its CI/CD Regex Compiler
GitLab is urging users to patch a maximum-severity flaw in its CI/CD Regular Expression Compiler that could let remote attackers run arbitrary code. Here's what's known, what isn't, and what I'd do right now if I ran a GitLab instance.