Dossier
npm package
Coverage of npm package in the Nexus archive.
- Hackers backdoor Jscrambler npm package with infostealer malware
A threat actor published a malicious version of the Jscrambler npm package, which was downloaded almost 1,500 times. Jscrambler, a client-side web security company, disclosed the breach.
- Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution
Google has patched a critical security vulnerability (CVSS 10) in the Gemini CLI npm package and GitHub Actions workflow, which could have enabled unprivileged attackers to execute arbitrary code on host systems by injecting malicious configuration content.