npm Packages Poisoned, AI Now Runs the Attack

Four packages in the @asyncapi namespace — a popular open-source toolkit used by software developers to build and document event-driven APIs (programming interfaces that let applications communicate) — were quietly poisoned and pushed to npm (Node Package Manager, a public library where developers download reusable code), according to The Hacker News.

The attacker did not steal any passwords or publishing tokens. Instead, they gained push access to the project's code repositories and used the projects' own legitimate automated release pipelines to publish the infected versions. The resulting packages carried valid, official-looking provenance certificates — digital stamps that are supposed to confirm a package was built by the project's authorised workflow. Those stamps were technically accurate. The workflow did build the packages. The commits that triggered it just were not legitimate.

Once a developer installed one of the affected packages and their application loaded the module, a hidden implant quietly fetched an encrypted second-stage payload called Miasma from IPFS (InterPlanetary File System, a decentralised peer-to-peer file storage network). Miasma is a full command-and-control framework that supports six separate communication channels, including HTTP, Ethereum smart contracts, and peer-to-peer mesh networks — making it unusually difficult to block.

Beyond credential theft and spreading to other machines on the local network, the malware sets up persistent autostart entries across Windows, macOS, and Linux. It also carries a dead man's switch: if a monitored token is revoked, the malware wipes its own directory. It avoids systems running CrowdStrike, SentinelOne, Microsoft Defender, CarbonBlack, Cylance, Osquery, Tanium, or Qualys, and skips machines with their language set to Russian.

All five malicious versions have been removed from npm. If you or your team installed any of the affected packages, treat that machine as compromised and audit it fully.

Check Point's AI Security Report 2026 documents something that has quietly shifted over the past year: researchers have now observed intrusions where AI ran the exploitation process autonomously, generating thousands of commands across dozens of sessions with minimal human involvement. According to Help Net Security, attackers obtain capable AI models by abusing commercial services, using stolen API credentials, or self-hosting open-source models with their safety controls stripped out.

One persistent technique targets AI coding agents by embedding malicious instructions inside configuration files such as CLAUDE.md, which are automatically loaded at the start of every session. The injected instruction stays active until the file is removed — a jailbreak that survives restarts.

The report also notes that the gap between a vulnerability being made public and a working exploit appearing in the wild continues to narrow, often down to hours. The speed at which defenders patch is now the single biggest variable.

What SonicWall SMA 1000 is: A hardware and virtual appliance that organisations use to give remote workers secure access to internal corporate networks and applications.

What it is: An SSRF vulnerability (Server-Side Request Forgery — a flaw where an attacker tricks a server into making network requests on their behalf, effectively using the server as a proxy to reach internal systems) that can be triggered by anyone on the internet, no login required. SonicWall confirmed active exploitation in multiple investigated cases.

Who's at risk: Any organisation running an internet-exposed SMA 1000 appliance on a firmware version below the patched releases. No authentication is required to trigger this flaw.

CVSS: 10.0 (Critical — patch today. Stop reading, go patch.)

Root cause: The appliance's web-facing API does not adequately validate or restrict the destination of outbound requests it generates. When the server accepts a user-controlled value and uses it to construct an outbound request without checking whether that destination is legitimate, an attacker can point it anywhere — including internal infrastructure that should never be reachable from outside.

Attack vector: A remote, unauthenticated attacker sends a crafted HTTP request to the appliance's public-facing API endpoint. The request contains an attacker-controlled destination address. Because the appliance fails to validate this input, it forwards the request to the specified location — which may be an internal server, a cloud metadata service, or other network resource behind the firewall. The appliance's response to the attacker reveals information about that internal destination, giving the attacker a foothold to map internal infrastructure or pivot further. No credentials are needed at any step.

Detection strategies:

1. In extraweb_access.log, look for HTTP 200 responses to requests targeting /__api__/login or /__api__/logout — these URIs do not exist in legitimate appliance configuration and should never appear with a success status.
2. In extraweb_access.log, look for requests to /wsproxy with unusual or unexpected host parameters returning HTTP 101 (connection upgrade) status codes.
3. Check whether /var/lib/unit/conf.json contains routing entries for /__api__/login or /__api__/logout — their presence in that file indicates the configuration has been tampered with.
4. In ctrl-service.log, look for hotfix rollbacks that reference path traversal names (file paths containing sequences like ../ that are designed to escape expected directories).

Recommended actions:

1. Upgrade immediately to firmware version 12.4.3-03453 or 12.5.0-02835 (or higher). CISA's patch deadline for federal agencies is July 17, 2026 — everyone else should treat that date as their own deadline.
2. If any of the detection indicators above are present, re-image physical appliances or redeploy virtual ones from scratch. Do not attempt to clean a potentially compromised appliance in place.
3. After patching or reimaging, rotate all user and administrator passwords and reset any time-based one-time password (TOTP) tokens associated with the appliance.

Microsoft is making passkeys the default login method for Entra ID (an enterprise identity service used by millions of organisations to manage employee logins) starting September 2026, according to Bleeping Computer. SMS and voice authentication codes will be fully retired in February 2027.

Passkeys work like a secure key stored on your device — no code to intercept, no phishing link that works. Microsoft reports that AI-assisted phishing campaigns now achieve click-through rates of 54%, compared to roughly 12% for traditional attacks. SMS codes are vulnerable to exactly that.

If you use Microsoft work accounts: ask your IT team whether you are on SMS-based login. If you are, register a passkey or Windows Hello before the September rollout. Microsoft's step-by-step setup guide is here.

CISA has added three actively exploited Microsoft SharePoint Server vulnerabilities to its Known Exploited Vulnerabilities catalogue and ordered US federal agencies to patch by July 17, 2026, per Bleeping Computer. Attackers are using these flaws to bypass authentication, run remote code, and deploy malware on exposed on-premises SharePoint servers. Nearly 10,000 internet-facing SharePoint servers are currently visible online, with over 800 confirmed unpatched. If your organisation runs SharePoint on its own servers rather than in the cloud, apply Microsoft's latest patches now and avoid exposing SharePoint directly to the internet.