Everything RedTeam Monitor has reported about npm: 5 stories, newest first. Part of our Vulnerabilities coverage.
A high-severity flaw in the MCP SDK allowed shared clients to access each other’s tasks. Version 1.32.0 patches the issue by tying tasks to their creating sessions.
Threat actors posing as a venture accelerator distributed malicious code to crypto developers, stealing AI prompts and credentials via fake packages.
A critical remote code execution vulnerability in the Handlebars template engine is resolved in version 4.7.10, which stops attackers from bypassing security filters.
A critical remote code execution vulnerability in the Handlebars template engine allows attackers to inject arbitrary JavaScript via manipulated AST objects.
A critical flaw in the dot-access library allows attackers to run arbitrary OS commands on Node.js servers through crafted inputs.