🕵️ RESEARCH & DEEP DIVES
Malicious npm package 'indexed-btree' hides malware in runtime code to bypass install defenses
A malicious npm package called 'indexed-btree' evades npm's install-script defenses by triggering its malware loader at runtime.- Targets developers using npm; the fake 'indexed-btree' package impersonates the legitimate 'sorted-btree' library and amassed 2 million weekly downloads, with nine related packages also removed from npm.
- The malware hides in the package's BTree.prototype.set() method, executing only when the app calls it with a specific key, so installation appears clean and bypasses npm v12's lifecycle-script approval checks.
- Once triggered, it collects system details (architecture, hostname, CPU, memory, uptime) and exfiltrates them via hardcoded Slack and Telegram channels.
- It polls an Ethereum smart contract on the Sepolia test network for C2 info, using X25519 key exchange to derive an AES key and decrypt a second-stage payload, and can delete its files and remove the trigger to wipe traces.
- The operators built a legitimate-looking GitHub repo with fabricated commit history and a curated developer account; Checkmarx says the attackers' wallet holds 109 ETH.
Researchers escape OpenAI Codex sandbox to run commands on host
Researchers found two sandbox escape vulnerabilities in OpenAI Codex, both now patched.- Applies to developers using OpenAI Codex CLI agent, including its most locked-down sandbox mode.
- Two sandbox escapes allowed running arbitrary commands on the developer's host machine.
- OpenAI has patched both escape methods.
📋 ADVISORIES
- 📄 Source for SQL injection flaw in itsourcecode Leave Management System 1.0 (CVE-2026-94032) — vuldb.com
🔓 CVEs & KEV
CVE-2026-90817 — Vanderbilt University REDCap — CVSS 9.8 — An unauthenticated Remote Code Execution vulnerability was found in the surve...
CVE-2026-94036 — D-Link DIR-X1860 — CVSS 7.4 — D-Link DIR-X1860/DIR-X1860Z routerd ubus access controlA security flaw has be...