# snyk-open-source Published articles for snyk-open-source. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Is prevention essentially a solved problem? DevFeed: [Is prevention essentially a solved problem?]() Original publisher: [Read original article]() Author: Ezra Tanzer Published: 2026-09-10T04:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI Development](), [Vulnerabilities](), [Architecture & Design](), [Code]() Tags: [agent](), [agentic](), [ai](), [application-security](), [awareness](), [blog](), [code](), [code-security](), [cost](), [developer](), [devops](), [devsecops](), [secrets](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [vulnerabilities](), [vulnerability-insights]() ### AI overview The article argues that preventing vulnerabilities in agent-generated code is architecturally understood, but organizations must apply the appropriate controls throughout a changing development lifecycle. It says prompts can influence code but cannot reliably constrain agents, and that earlier security intervention reduces model-token cost, human attention, and the risk of an incorrect fix. ### Source excerpt Prevention in agent-generated code is architecturally solved--but choosing controls that protect security without slowing development remains the challenge. ## Remediation Agents, Demystified: Why Fixing Beats Finding DevFeed: [Remediation Agents, Demystified: Why Fixing Beats Finding]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-08-19T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Vulnerabilities](), [AI-assisted coding](), [pull-requests](), [Responsibility & Safety](), [Artificial Intelligence]() Tags: [agentic](), [ai](), [ai-agents](), [application-security](), [aspm](), [awareness](), [ci-cd](), [code-security](), [community](), [developer](), [devops](), [devsecops](), [enablement](), [interest](), [javascript](), [live-stream](), [node-js](), [pull-requests](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [validation](), [vs-code](), [vulnerabilities]() ### AI overview Snyk's Remediation Agent is presented as a public-preview solution for the growing security-issue backlog. The article explains how coding agents can increase vulnerabilities, why deterministic remediation advice has not been enough, and how validation helps turn fixes into mergeable pull requests. ### Source excerpt See how Snyk's Remediation Agent uses security intelligence, breakability analysis, and validation to turn vulnerabilities into mergeable pull requests. ## A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense DevFeed: [A First Look at Evo Agentic AppSec: Agentic Remediation and Malicious Code Defense]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-08-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [agent](), [agentic](), [ai](), [ai-agents](), [ai-security](), [application-security](), [aspm](), [autonomous](), [blog](), [cli](), [code-security](), [developer](), [devops](), [interest](), [javascript](), [node-js](), [open-source-security](), [pull-request](), [python](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [vulnerabilities](), [vulnerability-insights]() ### AI overview Snyk introduces Evo Agentic AppSec capabilities for automatically remediating vulnerabilities and blocking malicious packages before they reach code. The Remediation Agent triages issues, creates and checks fixes, and opens pull requests for review. ### Source excerpt Explore Snyk's first Agentic AppSec capabilities: an autonomous Remediation Agent that fixes vulnerabilities and Malicious Code Defense that blocks risky packages before they ship. ## Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks DevFeed: [Inside the keyv npm Compromise: preinstall Malware, Trusted Provenance, and IDE Hooks]() Original publisher: [Read original article]() Author: Liran Tal; Lion Kontorer Published: 2026-08-04T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [releases]() Tags: [awareness](), [blog](), [ci](), [ci-cd](), [code](), [developer](), [devops](), [embedded](), [enablement](), [ide](), [incident](), [javascript](), [malware](), [manifest](), [node-js](), [npm-packages](), [open-source-security](), [payload](), [persistence](), [releases](), [research](), [scm](), [secrets](), [security](), [security-labs](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [software](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Snyk reports an active supply-chain incident in which keyv 6.0.0 and ten related npm releases contained install-time malware. The article describes the malicious preinstall hook, its second-stage payload, affected-release investigation, and remediation guidance. ### Source excerpt keyv 6.0.0 and ten related npm releases shipped install-time malware. See affected versions, hashes, detection steps, and safe remediation order. ## Secure at Inception: Announcing the Snyk Studio Integration for Snowflake Cortex Code DevFeed: [Secure at Inception: Announcing the Snyk Studio Integration for Snowflake Cortex Code]() Original publisher: [Read original article]() Author: Snyk Team Published: 2026-07-30T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [AI Bots]() Tags: [ai](), [ai-agent](), [application-security](), [article](), [cloud-security](), [code](), [code-security](), [containers](), [developer](), [devops](), [devsecops](), [enablement](), [finserv](), [health-care](), [integration](), [python](), [security](), [snyk-code](), [snyk-container](), [snyk-open-source](), [snyk-platform](), [supply-chain-security](), [vulnerabilities]() ### AI overview Snyk Studio is integrated with Snowflake Cortex Code to scan AI-generated application code, dependencies, and container images for vulnerabilities during development. ### Source excerpt Snyk Studio integrates with Snowflake Cortex Code to scan AI-generated code, dependencies, and containers for vulnerabilities during development. ## The Attacker Never Sleeps, Neither Can Your Testing DevFeed: [The Attacker Never Sleeps, Neither Can Your Testing]() Original publisher: [Read original article]() Author: Manoj Nair Published: 2026-07-30T00:00:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [AI-assisted coding](), [Developer Tools]() Tags: [agents](), [ai](), [application-security](), [awareness](), [blog](), [code](), [code-security](), [devops](), [devsecops](), [executive](), [finserv](), [interest](), [open-source-security](), [security](), [snyk-apprisk](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [software](), [supply-chain-security](), [tech](), [testing](), [vulnerability-insights]() ### AI overview AI-driven code generation is expanding software attack surfaces while giving attackers machine-speed reasoning capabilities. The article argues that security teams need continuous testing, agent governance, and independent validation of findings. ### Source excerpt AI is accelerating software development and giving attackers machine-speed capabilities. Security teams must continuously test AI-built code, govern agents, and independently validate every finding. ## Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice? DevFeed: [Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-06-29T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Vulnerabilities](), [AI-assisted coding]() Tags: [agentic](), [ai](), [application-security](), [awareness](), [benchmark](), [blog](), [claude](), [code-security](), [developer](), [devops](), [engineering](), [interest](), [llms](), [node-js](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk VulnBench JS 1.0 evaluates how consistently agentic LLM security reviews find vulnerabilities across identical repeated scans. Reference-matched findings were comparatively stable, while LLM-only reports varied substantially; the article argues for combining LLM review with deterministic SAST rather than replacing either approach. ### Source excerpt Snyk VulnBench JS 1.0: 300 repeated scans show LLM security findings vary by run, while SAST and models catch different vulnerability gaps. ## NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence DevFeed: [NVD in the AI Era: The Case for Multi-Source Vulnerability Intelligence]() Original publisher: [Read original article]() Author: Michelle Ginzburg; Noa Yaffe-Ermoza Published: 2026-06-25T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [open-source-security](), [Security](), [data]() Tags: [ai](), [article](), [awareness](), [developer](), [devops](), [interest](), [open-source](), [open-source-security](), [security](), [snyk-open-source](), [snyk-security-intel](), [software](), [supply-chain-security](), [technology](), [vulnerability](), [vulnerability-insights]() ### AI overview The article explains why vulnerability intelligence is moving beyond reliance on the National Vulnerability Database. It describes NIST's shift toward prioritized triage and presents Snyk's multi-source approach, combining vulnerability advisories, analyst validation, internal enrichment, open-source context, and multiple risk assessments to help teams prioritize remediation. ### Source excerpt NIST's shift to risk-based enrichment makes one thing clear: modern security teams need more than a single public source. In the AI era, trusted vulnerability intelligence depends on multiple signals, human validation, and clear context. ## The full Snyk AI Security Platform, free for open source maintainers DevFeed: [The full Snyk AI Security Platform, free for open source maintainers]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-06-18T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Maintainers](), [Open Source](), [Security](), [vulnerability](), [open-source-security](), [Artificial Intelligence](), [Frontier Model](), [Remote Access Trojan](), [AI Infrastructure]() Tags: [agent](), [ai](), [ai-infrastructure](), [ai-security](), [article](), [awareness](), [bugs](), [developer](), [enablement](), [engineering](), [frontier-model](), [interest](), [maintainers](), [open-source](), [open-source-security](), [remote-access-trojan](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-team](), [software](), [supply-chain-security](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk's Secure Developer Program gives qualifying open source projects free access to the Snyk AI Security Platform. It is designed to help maintainers prioritize real vulnerability reports and produce validated, merge-ready fixes through the Snyk Remediation Agent. ### Source excerpt Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Snyk's Secure Developer Program gives qualifying projects free access to the Snyk AI Security Platform. ## A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope DevFeed: [A Forgotten Contributor Account Compromised the Entire Mastra npm Package Scope]() Original publisher: [Read original article]() Author: Liran Tal; Marian Corneci Published: 2026-06-16T21:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [awareness](), [blog](), [ci-cd](), [cross-platform](), [cryptocurrency](), [developer](), [devops](), [devrel](), [devsecops](), [incident](), [javascript](), [node-js](), [open-source-security](), [payload](), [persistence](), [remote-access-trojan](), [sbom](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [tls](), [vulnerability-insights]() ### AI overview A dormant former-contributor npm account was compromised and used to republish the Mastra package scope with a malicious dependency that installs cryptocurrency-stealing malware and a persistent remote-access trojan. The article describes the stale access control that enabled the supply-chain incident and advises treating affected installations as credential and wallet exposure events. ### Source excerpt A dormant contributor account was used to republish the entire @mastra npm scope, each injected with a single dependency, easy-day-js, that drops a cross-platform cryptocurrency stealer. Here is how the attack worked, how to check exposure, and how to remediate. ## Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp DevFeed: [Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-06-04T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [Malware](), [Security](), [GitHub Actions](), [GitHub](), [Maintainers]() Tags: [awareness](), [blog](), [ci-cd](), [container-security](), [developer](), [devops](), [devsecops](), [eslint](), [github](), [github-actions](), [javascript](), [maintainers](), [malware](), [node](), [node-js](), [open-source-security](), [payload](), [persistence](), [scm](), [secrets](), [security](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview Snyk reports a critical npm supply-chain compromise in which a weaponized binding.gyp file abuses node-gyp during installation to execute malicious code without relying on lifecycle scripts. The worm affects 57 packages, harvests developer and CI/CD credentials, exfiltrates them through GitHub repositories, injects GitHub Actions workflows for persistence, and republishes packages accessible through compromised maintainer accounts. ### Source excerpt A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-propagates across maintainers. ## The New Security Risks of the Agentic Development Lifecycle DevFeed: [The New Security Risks of the Agentic Development Lifecycle]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2026-06-03T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Application Security](), [sdlc](), [Artificial Intelligence](), [Code]() Tags: [agentic](), [agents](), [ai](), [ai-agents](), [application-security](), [autonomous](), [awareness](), [blog](), [ci-cd](), [code](), [developer](), [development](), [devops](), [devsecops](), [enablement](), [interest](), [scm](), [sdlc](), [security](), [snyk-code](), [snyk-open-source](), [snyk-platform](), [software](), [tech](), [workflows]() ### AI overview The article explains the agentic development lifecycle, in which AI agents plan, build, modify, test, and ship software by interacting with tools, codebases, data sources, and development environments. It argues that security must protect the process creating software as well as the resulting code, because agents can introduce risk through what they use, do, and generate. ### Source excerpt AI agents are changing how software gets built, and with it, where security risk begins. Learn why securing the process matters as much as securing the code. ## Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection DevFeed: [Protestware by open source maintainer to hinder agentic coding: The jqwik 1.10.0 Prompt Injection]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2026-06-02T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [prompt injection](), [agentic-coding](), [AI-assisted coding](), [Open Source](), [Command-line interface](), [Maven](), [CI/CD](), [payload](), [Claude Code](), [cursor](), [GitHub Copilot]() Tags: [agentic-coding](), [agents](), [ai](), [ai-agents](), [ai-coding](), [article](), [awareness](), [ci-cd](), [claude-code](), [code](), [copilot](), [cursor](), [developer](), [devops](), [github](), [interest](), [java](), [open-source](), [open-source-security](), [payload](), [prompt-injection](), [sandbox](), [scm](), [security](), [security-labs](), [snyk-code](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [testing](), [tools](), [vulnerability-insights]() ### AI overview The article examines jqwik 1.10.0, whose maintainer embedded a prompt injection in test output aimed at AI coding agents. ANSI terminal escape codes concealed the instruction from humans while leaving it visible to tools processing raw logs, creating a supply-chain risk for CI/CD pipelines and agentic coding workflows. ### Source excerpt jqwik 1.10.0 added a hidden prompt injection aimed at AI coding agents, using terminal escape codes to conceal destructive instructions from humans while leaving them readable to logs and tools. ## Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages DevFeed: [Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages]() Original publisher: [Read original article]() Author: Brian Clark Published: 2026-06-01T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Malware](), [npm packages](), [redhat](), [incident](), [GitHub](), [OpenID connect (OIDC)](), [API](), [React](), [Cloud]() Tags: [api](), [article](), [awareness](), [ci-cd](), [cloud-security](), [developer](), [devops](), [devsecops](), [enablement](), [github](), [incident](), [interest](), [npm-packages](), [oidc](), [payload](), [react](), [redhat](), [sbom](), [scm](), [scope](), [secrets](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview The Miasma supply chain attack compromised at least 32 @redhat-cloud-services npm package releases used by the Red Hat Hybrid Cloud Console. The malicious installation script steals developer and cloud credentials, attempts to spread through packages victims can publish, and may expose secrets on affected workstations and CI runners. ### Source excerpt A supply chain worm dubbed Miasma has been found in dozens of @redhat-cloud-services npm releases. The malicious preinstall hook steals credentials, probes cloud identities, and can republish other packages. ## Laravel Lang Supply Chain Advisory DevFeed: [Laravel Lang Supply Chain Advisory]() Original publisher: [Read original article]() Author: Brian Clark Published: 2026-05-23T16:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Laravel](), [Composer](), [Credential theft](), [Malware](), [PHP](), [passwords](), [ssh](), [CI/CD](), [Cloud](), [Kubernetes](), [GitHub]() Tags: [application-security](), [article](), [awareness](), [ci-cd](), [cloud](), [code](), [credential-theft](), [developer](), [devops](), [devrel](), [github](), [kubernetes](), [laravel](), [php](), [scm](), [secrets](), [security](), [security-labs](), [snyk-open-source](), [snyk-security-intel](), [ssh](), [supply-chain](), [supply-chain-security](), [tech](), [tokens](), [vulnerability-insights]() ### AI overview The article examines a Laravel Lang supply-chain attack in which hundreds of historical Packagist releases for four community-maintained Laravel localization libraries were republished with malicious code. The injected Composer hook executes on PHP requests, downloads a second stage, and runs a credential stealer targeting cloud keys, Kubernetes and Vault secrets, CI/CD tokens, SSH material, environment files, browser data, password-manager vaults, crypto wallets, and messaging tokens. ### Source excerpt Hundreds of historical Laravel Lang Packagist releases were republished with malicious code, putting Composer installs at risk of credential theft and secret exfiltration. ## Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account DevFeed: [Mini Shai-Hulud Hits AntV: 300+ Malicious npm Packages Published via Compromised Maintainer Account]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-05-18T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Data visualization](), [npm packages](), [Malware](), [npm](), [C2](), [Bun](), [JavaScript](), [GitHub]() Tags: [awareness](), [blog](), [c2](), [data-visualization](), [developer](), [devops](), [devrel](), [javascript](), [malware](), [npm-packages](), [payload](), [secrets](), [security](), [snyk-open-source](), [snyk-platform](), [supply-chain](), [supply-chain-security](), [teampcp](), [tokens]() ### AI overview This article analyzes the Mini Shai-Hulud supply-chain attack targeting the AntV data visualization ecosystem through a compromised npm maintainer account. It describes the mass publication of malicious package versions, the embedded Bun payload, credential and secret theft, C2 persistence, and self-propagation using stolen npm tokens. ### Source excerpt A compromised npm maintainer account triggered an automated burst of over 300 malicious package versions across 323 packages in the AntV data visualization ecosystem, part of the ongoing Mini Shai-Hulud supply chain worm campaign. Here's what the malware does, how to detect exposure, and how to respond. ## Malicious node-ipc versions published to npm in suspected maintainer account compromise DevFeed: [Malicious node-ipc versions published to npm in suspected maintainer account compromise]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2026-05-15T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Node.js](), [incident](), [releases](), [CI/CD]() Tags: [article](), [awareness](), [ci](), [ci-cd](), [credential-theft](), [developer](), [devops](), [enablement](), [incident](), [javascript](), [kubernetes](), [node](), [node-js](), [releases](), [scm](), [secrets](), [security](), [security-labs](), [snyk-open-source](), [supply-chain](), [supply-chain-security](), [vulnerability-insights]() ### AI overview Multiple malicious node-ipc versions were published to npm with an obfuscated credential-stealing payload in the CommonJS bundle. The article describes a suspected maintainer-account compromise and advises affected teams to treat exposed secrets as potentially compromised and remediate vulnerable dependency paths. ### Source excerpt On May 14, 2026, multiple malicious versions of the popular npm package node-ipc were published to the npm registry. Current public reporting identifies node... ## TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack DevFeed: [TanStack Npm Packages Compromised Inside The Mini Shai Hulud Supply Chain Attack]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-05-11T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident]() Tags: [article](), [attacks](), [cache](), [ci-cd](), [cryptographic](), [developer](), [devops](), [devsecops](), [github](), [github-actions](), [identity](), [incident](), [maintainers](), [memory](), [npm-packages](), [open-source-security](), [sbom](), [scm](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [teampcp](), [tech](), [toolchain](), [vulnerability-insights](), [workflow]() ### AI overview TanStack's legitimate release pipeline was hijacked to publish malicious npm packages with valid SLSA provenance. The article describes the Mini Shai-Hulud supply-chain attack, its impact, and remediation guidance to rotate secrets on affected install environments. ### Source excerpt On May 11, 2026, the Mini Shai-Hulud worm compromised 84 npm package artifacts across 42 @tanstack/* packages (as well as @squawk/*, @mistralai/* packages, and others) by chaining a GitHub Actions "Pwn Request," cache poisoning, and OIDC token extraction from runner memory -- producing the first npm supply chain attack with valid SLSA Build Level 3 attestations. Here's what happened, what was stolen, and what you need to do right now. ## lightning PyPI Compromise: A Bun-Based Credential Stealer in Python DevFeed: [lightning PyPI Compromise: A Bun-Based Credential Stealer in Python]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-04-30T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Malware](), [Python](), [Bun](), [JavaScript](), [GitHub](), [snyk-learn](), [npm](), [releases]() Tags: [article](), [awareness](), [ci-cd](), [code](), [developer](), [devops](), [github](), [javascript](), [open-source-security](), [payload](), [python](), [release](), [sbom](), [secrets](), [security](), [security-labs](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [supply-chain-security](), [tech](), [vulnerability-insights]() ### AI overview A compromised lightning PyPI release downloads the Bun JavaScript runtime at import time and executes an approximately 11 MB obfuscated credential stealer. The article covers the package compromise, Snyk advisory, remediation, and similarities to the preceding Mini Shai-Hulud npm campaign. ### Source excerpt A malicious release of the lightning PyPI package ships a credential-stealing Bun payload that runs on import. Snyk has a live advisory. Here's what's in the package, what to rotate, and how the payload pattern connects to the Mini Shai-Hulud npm campaign one day earlier. ## "A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages DevFeed: ["A Mini Shai-Hulud Has Appeared": Bun-Based Stealer Hits SAP @cap-js and mbt npm Packages]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2026-04-29T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [releases]() Tags: [article](), [awareness](), [ci-cd](), [developer](), [devops](), [ecosystem](), [github](), [github-actions](), [incident](), [interest](), [javascript](), [node-js](), [npm-packages](), [open-source-security](), [payload](), [releases](), [sap](), [scm](), [security](), [snyk-open-source](), [snyk-security-intel](), [supply-chain](), [supply-chain-security](), [tech](), [tool](), [toolchain](), [vulnerability-insights]() ### AI overview A supply-chain attack compromised four npm packages in the SAP development ecosystem. Malicious releases download Bun and execute an obfuscated credential stealer, while SAP published clean post-incident versions and Snyk issued advisories. ### Source excerpt A new npm supply chain attack self-branded "Mini Shai-Hulud" compromised four SAP-ecosystem packages on April 29, 2026. Snyk has live advisories. Here's the technical breakdown, IOCs, and what to do. ## Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478) DevFeed: [Don't Panic: The Thymeleaf Template Injection That Only Hurts If You Let It (CVE-2026-40478)]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2026-04-29T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [Security]() Tags: [application-security](), [article](), [developer](), [external](), [java](), [payload](), [security](), [snyk-open-source](), [spring](), [spring-boot](), [vulnerability](), [vulnerability-insights]() ### AI overview This article explains that CVE-2026-40478 is a severe Thymeleaf server-side template injection vulnerability, but exploitation depends on user-controlled input reaching Thymeleaf's expression engine. It describes the sandbox bypass, the potential for remote code execution, and misuse patterns such as dynamic templates and view resolution. It recommends patching to Thymeleaf 3.1.4 or later and auditing applications for these conditions. ### Source excerpt CVE-2026-40478: The Thymeleaf template injection (CVSS 9.1) is conditional. Patch to 3.1.4+ immediately, and audit your code for dynamic view or template expression misuse, which is the key precondition for exploitability. ## Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining DevFeed: [Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining]() Original publisher: [Read original article]() Author: Julia Kinday Published: 2026-04-27T00:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Vulnerabilities](), [incident](), [Security](), [Express](), [GitHub Issues](), [Docker](), [GitHub](), [Open Source](), [Server](), [Shell](), [JavaScript](), [npm]() Tags: [application-security](), [attacks](), [auth](), [authentication](), [awareness](), [blog](), [ci-cd](), [cloud](), [cloud-security](), [code](), [developer](), [devops](), [docker](), [enablement](), [github](), [github-issues](), [incident](), [javascript](), [malware](), [node-js](), [open-source](), [open-source-security](), [routing](), [security](), [security-labs](), [self-hosted](), [servers](), [snyk-code](), [snyk-container](), [snyk-learn](), [snyk-open-source](), [snyk-security-intel](), [tech](), [typescript](), [vulnerabilities](), [vulnerability]() ### AI overview Qinglong, an open-source self-hosted task scheduling panel, was exploited through two authentication bypass vulnerabilities affecting versions 2.20.1 and earlier. Attackers used unauthenticated remote code execution to deploy cryptocurrency miners on publicly accessible installations. The article describes the vulnerabilities, their Express.js routing and middleware flaws, and the impact on operators using cloud VPS instances and home servers. ### Source excerpt Two authentication bypass vulnerabilities (CVE-2026-3965, CVE-2026-4047) in the Qinglong task scheduling panel were exploited in the wild to deploy cryptomining malware. Here's what happened, how the attacks worked, and what self-hosted application operators should learn from this incident. ## JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? DevFeed: [JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?]() Original publisher: [Read original article]() Author: John Carione Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Resilience](), [Security](), [snyk-iac](), [supply-chain-security](), [vulnerability](), [Infrastructure as code](), [Open Source](), [AI Development](), [releases](), [pull-requests](), [Code]() Tags: [ai](), [ai-development](), [awareness](), [blog](), [cloud-security](), [code](), [contentlab](), [developer](), [devops](), [executive](), [iac-security](), [interest](), [open-source](), [open-source-security](), [pull-requests](), [releases](), [resilience](), [sbom](), [secrets](), [security](), [snyk-cloud](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerability]() ### AI overview JPMorganChase's 10-point cyber resilience checklist addresses enterprise security priorities spanning software versions, open-source dependencies, SBOMs, build pipelines, secrets, infrastructure as code, and AI development. The article explains how Snyk covers eight of the ten actions through developer workflows and its security platform. ### Source excerpt JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack. ## Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT DevFeed: [Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT]() Original publisher: [Read original article]() Author: Liran Tal Published: 2026-03-30T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [npm](), [StreamRAT](), [cross-platform](), [JavaScript](), [CI/CD](), [ide](), [client](), [GitHub]() Tags: [analysis](), [awareness](), [blog](), [c2](), [ci](), [ci-cd](), [code](), [developer](), [devrel](), [github](), [javascript](), [macos](), [malware](), [obfuscation](), [payload](), [remote-access-trojan](), [security](), [server](), [snyk-open-source](), [snyk-platform](), [supply-chain](), [supply-chain-security]() ### AI overview The article analyzes a supply-chain attack in which malicious Axios versions published to npm through a compromised maintainer account introduced a hidden dependency. Installing the affected packages could trigger a postinstall dropper that downloaded a platform-specific remote access trojan, contacted a command-and-control server, and erased evidence after execution. ### Source excerpt Meta description: Malicious versions of the Axios npm package (1.14.1 and 0.30.4) were published via a compromised maintainer account, injecting a hidden dependency that deploys a cross-platform remote access trojan. Here's what happened, who's affected, and how to check your exposure. [Next page]()