Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

JounQin’s npm account, the maintainer of popular packages such as eslint-config-prettier, was compromised in a phishing attack. The attackers used the breached credentials to publish six malicious versions of eslint-config-prettier, along with three additional infected packages tied to the same account. In total, the compromised packages see roughly 78 million weekly downloads. Notably, the account had publishing rights for packages with a combined weekly download count of 180 million!

A newly discovered exploit, “ToolShell,” is fueling a wave of targeted attacks against on-premises Microsoft SharePoint servers. The zero-day exploit chains two vulnerabilities—CVE-2025-53770, a remote code execution (RCE) vulnerability and CVE-2025-53771, a spoofing vulnerability that allows attackers to bypass authentication. When combined, this critical zero-day vulnerability gives attackers persistent unauthenticated remote access to on-premises SharePoint servers.

Aligning with the Australian Government’s Information Security Manual (ISM) and the Essential Eight (E8) remains a foundational step for organizations working with or alongside government agencies. Trustwave’s Essential Eight Control Effectiveness Assessment is a great first step, but relying solely on compliance as a goal can leave security programs stagnant.

That was the message from major UK retailers like Marks & Spencer and the Co-op during recent Parliamentary hearings on cyber resilience. Their stories weren’t hypothetical, they were recovering from real-world incidents involving identity compromise, supply chain breaches, and operational disruption that cost hundreds of millions of pounds. The lesson is clear. Prevention is necessary, but it is no longer enough.