Expert analysis on threats, compliance, and the evolving security landscape.
India's Finance Minister Nirmala Sitharaman has flagged Anthropic's Claude Mythos as an unprecedented cybersecurity threat to the banking sector and directed IBA-led hardening with CERT-In intelligence sharing. Mythos has already autonomously discovered thousands of zero-days across every major OS and browser at trivial cost. This is the preemptive playbook every CISO needs to run before similar capabilities reach the offensive ecosystem.
2026-05-03 · 12 min read
A single operator runs four burner GitHub accounts publishing fake Shai-Hulud detection tools that actually deliver a Windows credential-stealer kit (LuaJIT + obfuscated Lua, Mini Shai-Hulud / Trojan.Lazy family). SecureNexus SOVA detected the cluster on 2026-05-02 via capability-shift scanning. This writeup covers the four trust signals the lure exploits, byte-identical kit binaries across operator accounts, leaked operator emails, the 7-byte PEB-walk shellcode captured by our instrumented sandbox, the 37-victim census, and structural-fingerprint guidance defenders can deploy today.
By Mohit Kumar
2026-05-01 · 10 min read
By Sunil Yadav
2026-04-30 · 23 min read
On April 29, 2026, four packages in the SAP Cloud Application Programming (CAP) ecosystem — @cap-js/db-service, @cap-js/postgres, @cap-js/sqlite, and mbt — were trojanised in a three-hour window via a Shai-Hulud worm variant published through compromised GitHub Actions OIDC. SecureNexus SOVA flagged all four with deterministic BLOCK verdicts on tarball capability shape. This walkthrough covers the surgical drop pattern, deobfuscated payload internals, IMDSv2 credential harvesting, GitHub GraphQL exfiltration, and a capability-based gate policy you can deploy today.
By Omkar Pote
2026-04-23 · 9 min read
On April 22, 2026, Checkmarx disclosed a supply chain security incident affecting several of its publicly distributed artifacts. Malicious versions of KICS Docker images, a GitHub Action (ast-github-action 2.3.35), and two VS Code extensions (ast-results 2.63/2.66 and cx-dev-assist 1.17/1.19) were published during a short window. Previously published safe versions were not overwritten, so customers pinned to pre-window versions are not affected. Less than 24 hours later, the same campaign reached Bitwarden with a malicious @bitwarden/[email protected] published via a compromised CI/CD GitHub Action on npm. The authoritative C2 indicators are the typosquat domains checkmarx.cx (91.195.240.123) and audit.checkmarx.cx (94.154.172.43).
By Yash Kumar
2026-04-23 · 8 min read
On April 22, 2026, a malicious version of @bitwarden/[email protected] was published to npm through a compromise of Bitwarden's own publishing workflow. The exposure window was approximately 93 minutes (5:57 PM to 7:30 PM ET). Bitwarden confirmed the compromise was connected to the ongoing Checkmarx supply chain incident disclosed the same day. End-user vault data, production systems, and the legitimate Bitwarden codebase were not impacted; only users who installed @bitwarden/[email protected] from npm during that narrow window were potentially affected. This post covers what Bitwarden has officially confirmed, the response steps for affected teams, and the broader lesson that CI/CD publishing pipelines are themselves the attack surface.
2026-04-20 · 10 min read
npm package [email protected] — marketed as a Node.js integration layer for Autodesk Forge — is a multi-platform RAT and infostealer. This technical breakdown walks through the postinstall kill chain, the LaunchAgent/systemd/Task Scheduler persistence primitives, the .env and shell-history harvesting modules, and the AES-256-GCM-obfuscated C2 blob, with SecureNexus SOVA analysis evidence.
2026-04-20 · 5 min read
Anthropic’s MCP introduces a critical design flaw where AI agents can execute actions based on untrusted tool responses. This turns AI systems into unintended remote execution engines, exposing risks like RCE, data leaks, and full workflow compromise. The issue isn’t a bug—it’s a broken trust model requiring a shift to secure, zero-trust AI architectures.
By Arjun Gupta
2026-04-11 · 9 min read
Minification isn't encryption. Every JavaScript bundle your app ships is readable in seconds — and attackers know it. This post breaks down exactly what they find: hardcoded API keys, internal endpoints, client-side business logic, and exposed source maps. Plus the five controls that make sure none of it leaves your codebase.
2026-04-10 · 8 min read
Every npm install silently executes lifecycle scripts from every package in your dependency tree — no prompts, no sandboxing, with full system access. This post breaks down how post-install scripts work, why they are the most exploited vector in npm supply chain attacks, and the five controls that eliminate the risk.
Page 1 of 3
