Vulnerabilities & Threats

Subscribe to hear about critical security incidents

We'll send you updates on incidents as and when they happen

Featured

September 8, 2026

Compromised Flutter package on pub.dev contains XCSSET malware

We detected XCSSET malware inside a compromised Flutter package on pub.dev. Here is a full breakdown of the infection chain, propagation modules, and stealer logic we found inside.

#Malware

September 7, 2026

Shai-Hulud Rises From the Dead after 111 days

A known Shai-Hulud worm payload sat dormant for 111 days, then republished to npm, right past the malware scanning meant to catch it.

#intel

#Malware

#Vulnerabilities

September 7, 2026

StyleSmuggler fix: patch the Magento and Adobe Commerce RCE

StyleSmuggler is an unauthenticated RCE hitting Magento and Adobe Commerce, with no CVE and no Adobe patch yet. Aikido already has the fix.

No items found.

Subscribe to our newsletter.
No spam, guaranteed.

March 13, 2026

Glassworm Is Back: A New Wave of Invisible Unicode Attacks Hits Hundreds of Repositories

The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.

Tags/

#NPM

March 12, 2026

How Security Teams Fight Back Against AI-Powered Hackers

AI has lowered the bar for hackers dramatically. Here's what that means for defenders and how continuous AI pentesting changes the equation.

Tags/

#AI

#Continuous Pentesting

#Self-securing Software

March 3, 2026

Persistent XSS/RCE using WebSockets in Storybook’s dev server

CVE-2026-27148 exposes a WebSocket hijacking flaw in Storybook that can escalate into supply chain compromise. Learn the attack path, impact, and how to remediate.

Tags/

#Vulnerabilities

#open-source

#Pentesting

February 23, 2026

Astro Full-Read SSRF via Host Header Injection

Aikido Security's AI pentesting agent discovered a Server-Side Request Forgery vulnerability in Astro's SSR implementation. Learn how Host header injection in prerendered error pages allowed full internal network access.

Tags/

#open-source

#Vulnerabilities

#NPM

February 19, 2026

SvelteSpill: A Cache Deception Bug in SvelteKit + Vercel

SvelteSpill is a cache deception vulnerability affecting default SvelteKit apps deployed on Vercel. Authenticated responses can be cached and exposed across users. Learn how to check if you’re vulnerable and how to mitigate risk.

Tags/

#Vulnerabilities

#DAST

#AI Penetration Testing

February 16, 2026

npm backdoor lets hackers hijack gambling outcomes

A targeted npm supply chain attack installs an Express backdoor, enables remote SQL/file access, and rewrites gambling balances while keeping logs consistent.

Tags/

No items found.

February 4, 2026

npx Confusion: Packages That Forgot to Claim Their Own Name

We claimed 128 unclaimed npm package names that official docs told developers to npx. Seven months later: 121,000 downloads. All would have run arbitrary code.

Tags/

#Malware

#open-source

#NPM

January 27, 2026

Fake Clawdbot VS Code Extension Installs ScreenConnect RAT

A malicious VS Code extension impersonating Clawdbot is installing ScreenConnect RAT on developer machines.

Tags/

#Malware

#VS Code

January 23, 2026

G_Wagon: npm Package Deploys Python Stealer Targeting 100+ Crypto Wallets

npm package ansi-universal-ui delivers GWagon infostealer targeting 100+ crypto wallets, browser credentials, and cloud keys. We analyzed all 10 versions as the attacker iterated in real-time.

Tags/

#Malware

#NPM

#Software Supply Chain Security

January 23, 2026

Gone Phishin': npm Packages Serving Custom Credential Harvesting Pages

A targeted spear-phishing campaign used npm packages and jsDelivr as free phishing infrastructure, serving custom credential harvesters per victim

Tags/

#Malware

#NPM

#Software Supply Chain Security

January 23, 2026

Malicious PyPI Packages spellcheckpy and spellcheckerpy Deliver Python RAT

Attackers published fake spellchecker packages to PyPI with malware hidden in plain sight. We break down the attack and what developers need to watch for.

Tags/

#Malware

#Software Supply Chain Security

#NPM

January 21, 2026

Agent Skills Are Spreading Hallucinated npx Commands

AI agent skills are propagating hallucinated npx commands, creating real security and reliability risks for developers and supply chains.

Tags/

#NPM

#Malware

#Software Supply Chain Security

#AI

#Vibe Coding