Wiz pipeline flags malicious npm packages before a CVE exists
Wiz says notable supply-chain attacks rose from about 10% of significant incidents in late 2025 to 1 in 4.
48
- Mentions · 7d0
- Mentions · 30d2
- All mentions4
- First seenAug 20, 2026
- Last mentioned12d ago
Timeline
4 articles · newest firstEvolution of Web3 in Cloud Supply Chain Attacks
Unit 42 says DPRK-linked actors use Web3 smart contracts as C2 for npm worms stealing cloud credentials.
78
Axios HTTP/2 Flaws Enable SSRF Control Bypass and Node.js Denial of Service
Axios HTTP/2 bugs CVE-2026-101898 and CVE-2026-101901 allow SSRF-control bypass and Node.js denial of service.
58
Rust Supply Chain Attack on arrayref: Significant Overlap with DPRK Campaigns
Malicious versions of the Rust crate arrayref executed a compile-time backdoor, with infrastructure overlapping recent DPRK supply chain attacks on Mastra and axios.
72
Related CVEs
by mentions- Unhandled HTTP/2 session error DoS in Axios
- Axios HTTP/2 bypasses proxy and DNS lookup policy
Appears with
- Wizvendor · 2
- arrayrefproduct · 2
- npmproduct · 2
- Mastra AIproduct · 1
- keyvproduct · 1
- ChainDropmalware · 1
- Rustproduct · 1
- plain-crypto-jsmalware · 1
- Shai-Huludmalware · 1
- PolinRidermalware · 1
- Wiz Defendproduct · 1
- Unit 42organization · 1
- Midnight Neptunethreat actor · 1
- Sapphire Sleetthreat actor · 1
- Wizorganization · 1
- Node.jsproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.