Latest JavaScript news

Cloudflare: We never authorized polyfill.io to use our name

Cloudflare, a lead provider of content delivery network (CDN) services, cloud security, and DDoS protection has warned that it has not authorized the use of its name or logo on the Polyfill.io website, which has recently been caught injecting malware on more than 100,000 websites in a significant supply chain attack.
- Ax Sharma
- June 27, 2024
- 05:18 AM
- 1
Polyfill.io JavaScript supply chain attack impacts over 100K sites

Over 100,000 sites have been impacted in a supply chain attack by the Polyfill.io service after a Chinese company acquired the domain and the script was modified to redirect users to malicious and scam sites.
- Lawrence Abrams
- June 25, 2024
- 02:10 PM
- 1
Malicious web redirect scripts stealth up to hide on hacked sites

Security researchers looking at more than 10,000 scripts used by the Parrot traffic direction system (TDS) noticed an evolution marked by optimizations that make malicious code stealthier against security mechanisms.
- Bill Toulas
- January 22, 2024
- 03:15 PM
- 0
NPM ecosystem at risk from “Manifest Confusion” attacks

The NPM (Node Package Manager) registry suffers from a security lapse called "manifest confusion," which undermines the trustworthiness of packages and makes it possible for attackers to hide malware in dependencies or perform malicious script execution during installation.
- Bill Toulas
- June 28, 2023
- 10:28 AM
- 0
New PindOS JavaScript dropper deploys Bumblebee, IcedID malware

Security researchers discovered a new malicious tool they named PindOS that delivers the Bumblebee and IcedID malware typically associated with ransomware attacks.
- Ionut Ilascu
- June 26, 2023
- 12:39 PM
- 0
npm packages caught serving TurkoRAT binaries that mimic NodeJS

Researchers have discovered multiple npm packages named after NodeJS libraries that even pack a Windows executable that resembles NodeJS but instead drops a sinister trojan.
- Ax Sharma
- May 20, 2023
- 09:06 AM
- 0
IRS-authorized eFile.com tax return software caught serving JS malware

eFile.com, an IRS-authorized e-file software service provider used by many for filing their tax returns, has been caught serving JavaScript malware.
- Ax Sharma
- April 04, 2023
- 05:00 AM
- 0
New Linux malware uses 30 plugin exploits to backdoor WordPress sites

A previously unknown Linux malware has been exploiting 30 vulnerabilities in multiple outdated WordPress plugins and themes to inject malicious JavaScript.
- Bill Toulas
- December 30, 2022
- 10:41 AM
- 0
Exploited Windows zero-day lets JavaScript files bypass security warnings

A new Windows zero-day allows threat actors to use malicious JavaScript files to bypass Mark-of-the-Web security warnings. Threat actors are already seen using the zero-day bug in ransomware attacks.
- Lawrence Abrams
- October 22, 2022
- 10:06 AM
- 10
Magniber ransomware now infects Windows users via JavaScript files

A recent malicious campaign delivering Magniber ransomware has been targeting Windows home users with fake security updates.
- Bill Toulas
- October 13, 2022
- 12:04 PM
- 0
Hackers are breaching scam sites to hijack crypto transactions

In a perfect example of there being no honor among thieves, a threat actor named 'Water Labbu' is hacking into cryptocurrency scam sites to inject malicious JavaScript that steals funds from the scammer's victims.
- Bill Toulas
- October 04, 2022
- 02:20 PM
- 0
New tool checks if a mobile app's browser is a privacy risk

A new online tool named 'InAppBrowser' lets you analyze the behavior of in-app browsers embedded within mobile apps and determine if they inject privacy-threatening JavaScript into websites you visit.
- Bill Toulas
- August 19, 2022
- 02:12 PM
- 0
NPM supply-chain attack impacts hundreds of websites and apps

An NPM supply-chain attack dating back to December 2021 used dozens of malicious NPM modules containing obfuscated Javascript code to compromise hundreds of downstream desktop apps and websites.
- Sergiu Gatlan
- July 05, 2022
- 01:55 PM
- 2
Microsoft: Credit card stealers are getting much stealthier

Microsoft's security researchers have observed a worrying trend in credit card skimming, where threat actors employ more advanced techniques to hide their malicious info-stealing code.
- Bill Toulas
- May 24, 2022
- 02:44 PM
- 0
Refine your JavaScript knowledge with this training bundle deal

JavaScript is key to understanding many modern websites and software suites, as well as cybersecurity risks. The Jumbo 2022 Javascript Bundle helps you brush up on your JavaScript for $39, 97% off the $1393 MSRP.
- BleepingComputer Deals
- May 19, 2022
- 07:25 AM
- 0
Caramel credit card stealing service is growing in popularity

A credit card stealing service is growing in popularity, allowing any low-skilled threat actors an easy and automated way to get started in the world of financial fraud.
- Bill Toulas
- May 08, 2022
- 11:06 AM
- 0
Ukraine targeted by DDoS attacks from compromised WordPress sites

Ukraine's computer emergency response team (CERT-UA) has published an announcement warning of ongoing DDoS (distributed denial of service) attacks targeting pro-Ukraine sites and the government web portal.
- Bill Toulas
- April 28, 2022
- 11:38 AM
- 0
Hacked WordPress sites force visitors to DDoS Ukrainian targets

Hackers are compromising WordPress sites to insert a malicious script that uses visitors' browsers to perform distributed denial-of-service attacks on Ukrainian websites.
- Lawrence Abrams
- March 28, 2022
- 05:55 PM
- 0
TrickBot now crashes researchers' browsers to block malware analysis

The notorious TrickBot malware has received new features that make it more challenging to research, analyze, and detect in the latest variants, including crashing browser tabs when it detects beautified scripts.
- Bill Toulas
- January 25, 2022
- 03:06 PM
- 0
Don't copy-paste commands from webpages — you can get hacked

Programmers, sysadmins, security researchers, and tech hobbyists copying-pasting commands from web pages into a console or terminal risk having their system compromised. Wizer's Gabriel Friedlander demonstrates an obvious, simple yet stunning trick that'll make you think twice before copying-pasting text from web pages.
- Ax Sharma
- January 03, 2022
- 08:00 AM
- 11