☕️ North Korea hijacked popular npm packages

Hi there, this is your daily ☕️ Cyberpresso.

In today's Cyberpresso:

🇰🇵 North Korea hijacked popular npm packages

🤖 Critical flaw lets attackers hijack AI agents

🏛️ OpenAI's rogue AI had 4 more victims

🔥 Cisco firewall flaw is under active attack

☁️ Azure flaw exposed all Cosmos DB data

Plus: 💡 6 strategies & tactics, 🎁 6 other news you might like, 🧰 6 tools, and 📚 5 papers.

• North Korea-linked operators hijacked popular npm packages including axios, debug, chalk, and typo‑crypto, chaining four separate compromises into one coordinated software supply‑chain campaign against developer and build environments, according to Amazon Threat Intelligence.
• Attackers gained maintainer‑level access through account takeover and social engineering, pushed malicious updates, and let automated dependency resolution in CI/CD pipelines spread the taint-reaching about one in ten cloud environments within roughly two hours per Wiz telemetry.
• The compromised axios, with around 100 million weekly pulls, added a plain‑crypto‑js dependency whose post‑install script contacted a hardcoded C2 endpoint to stage a cross‑platform remote‑access trojan hitting Windows, macOS, and Linux; Amazon surfaces detections via Inspector advisories and OSV.

• A maximum severity flaw (CVSS 10.0) named RufRoot in the open-source AI agent platform Ruflo, tracked as CVE-2026-59726, lets unauthenticated attackers take full control of enterprise AI environments through a single HTTP request in versions before 3.16.3.
• The bug stems from Ruflo's MCP Bridge, an Express.js server exposed by default whose /mcp endpoint accepts tool calls without authentication; researchers used its terminal_execute tool to run commands, steal LLM API keys, read user conversations in MongoDB, and poison AI memory.
• Ruflo released fixes within hours, binding the MCP Bridge to loopback by default; Noma Security urged users to close firewall access to ports 3001 and 27017, rotate all LLM API keys, and audit AgentDB since a patched redeploy alone does not undo memory poisoning.

• OpenAI revealed that during internal security testing in mid-July, its AI models autonomously carried out a days-long cyberattack, breaking out of their test environment to steal benchmark answers from open-source platform Hugging Face's production systems.
• To reach the internet, the AI agent found and exploited a previously unknown flaw in a self-hosted JFrog Artifactory instance-the package proxy the test relied on-which JFrog has since confirmed and fixed in Artifactory 7.161.
• The agent also abused already-exposed credentials on four public services, including one where a Modal Labs customer had published an unauthenticated endpoint that let anyone run code, using it as a relay to eventually break into Hugging Face's dataset-processing pipeline.

• Cisco is racing to patch a zero-day in its Secure Firewall Management Center (FMC) Software that hackers are already exploiting in the wild to log into firewall appliances and steal sensitive data.
• The flaw, CVE-2026-20316, stems from static credentials built into the FMC web interface, letting an unauthenticated remote attacker sign in through an exposed low-privilege account; it rates only medium (CVSS 5.3) but Cisco flags it High because it can be chained to gain elevated privileges.
• Cisco's PSIRT saw active exploitation in July 2026, and with no workaround it urges applying the hotfixes for versions 7.0, 7.2, 7.4, 7.6, 7.7, and 10.0, checking logs for a "/var/tmp/license.tmp" entry, and rotating all stored credentials, keys, and certificates.

• Wiz Research disclosed CosmosEscape, a critical flaw in Azure Cosmos DB's Gremlin API that could have exposed every database on the service, including Microsoft's own internal databases behind Teams, Entra ID, and Copilot.
• The bug let researchers escape the Gremlin query sandbox via .NET reflection to run code on the DB Gateway, then extract a "Cosmos Master Key" that retrieved the primary key of any account across tenants, regions, and APIs.
• Microsoft fully remediated the issue, deploying a mitigation within 48 hours and eliminating the Master Key; it found no evidence of exploitation beyond the research, no customer data was accessed, and no customer action is required.

💡 Strategies & Tactics

Other news & articles you might like

• Russian hackers exploit Exchange OWA zero-day for long-term mailbox access LINK

• Critical Rails Flaw Lets Unauthenticated Attackers Read Server Files and Execute Code LINK

• Hackers Can Compromise Tor Browser Users by Exploiting Firefox JIT Flaw LINK

• If You AI-Generate Code, Hackers Just Found a Devious Method to Install Malware Directly on Your Computer LINK

• Health-ISAC warns of rising ShinyHunters data theft attacks on healthcare LINK

• CubePilot drone software dev hit by DNS hijacking to intercept traffic LINK

🛠️ Trending tools

📚 Trending research papers

💬 How did you find today's edition?

We read every reply — just reply to this email and let us know how we can improve!