Topic
Exposure created when widely embedded free components carry thin maintainership and undisclosed licence or support terms.
Attackers hid the malware trigger in the indexed-btree npm package inside a library method, sidestepping the install-script block npm 12 shipped in July. Install-time checks, including a look at package.json for hooks, pass a package that runs its payload on first use.
Reality
Imperva found remote denial-of-service flaws in GraphQL Java's query parsing and validation, fixed in releases 24.4, 25.1 and 26.1. Imperva says the bugs sit ahead of the depth and cost limits most teams rely on, so exposure depends on the library version a stack ships.
Reality
The proof of concept in strukturag's advisory declares a 33800 by 63520 picture at 16-bit depth, wraps the signed size calculation, and lets fill_plane write 4,294,968,336 bytes into the undersized heap buffer.
Reality
Endor Labs says a type confusion in isolated-vm's ExternalCopy turns a single ivm.Reference into host control-flow hijack. The remedy is a version bump to 7.0.1 or 6.2.0.
Reality
Flux Mirror ships as a v2.9 CLI plugin that copies images, charts and desired-state artifacts from a config file. The Bitnami catalogue freeze is the argument for using it.
Reality
Graphify was a weekend project given away free. It is now callable by Claude Code, Cursor, Codex and Gemini CLI, which makes its maintenance a procurement question nobody is asking.
Reality