Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

A new and dangerous self-replicating worm has been identified targeting the JavaScript repository NPM, infecting at least 187 code packages. The novel malware strain is engineered to steal credentials from developers and publish them to a new public GitHub repository. The worm automatically propagates itself by copying its code into the top 20 most popular packages maintained by the compromised user and publishing them as new versions.

Complying with the Digital Operational Resilience Act (DORA) means proving that resilience is built into daily operations through ongoing, evidence-backed practices. SafeBreach, the leader in enterprise exposure validation, helps institutions meet DORA’s key requirements by simulating real-world threats across the MITRE ATT&CK framework.

Every mature security program starts somewhere. For many organizations—especially startups and early-stage companies—this is what the NIST Cybersecurity Framework (CSF) calls the partial stage. ‍ At this level, security is often reactive. Teams operate with minimal resources and ad-hoc processes, working hard to meet customer or compliance demands but without the structure or long-term strategy needed to scale.

Discover how to automatically detect secrets in GitLab CI logs using ggshield and GitGuardian's Bring Your Own Source initiative. Learn to set up real-time scanning to prevent credential leaks, enhance compliance, and secure your entire CI/CD pipeline from hidden risks.

The AI revolution is moving at breakneck speed. Every week, new tools, frameworks, and integrations hit the market. Developers eager to harness the power of large language models and automation platforms are spinning up assets with little thought to long-term security. The result is a wave of exposed services — chatbots, APIs, orchestration tools, and workflow systems — that anyone on the internet can stumble upon. Attackers see this as an open invitation.

This blog is the latest in a series that delves into the deep research conducted daily by the Trustwave SpiderLabs Threat Operations team on major threat actor groups currently operating globally. Trustwave SpiderLabs Cyber Threat Intelligence team has developed a new detailed analysis of Storm-2603, the threat group associated with the recent exploitation of security flaws in Microsoft SharePoint Server.

APIs are the foundation of modern applications, and attackers know it well. A single misconfigured endpoint or exposed token can give adversaries a direct path into sensitive systems and data across your environment. Your already overburdened security teams can’t afford to miss what may be their fastest-growing attack surface. How fast-growing is the threat?