How a Single Vulnerability Can Bring Down the JavaScript Ecosystem

landh.techsite

Cache poisoning attack on the NPM registry rendering packages unavailable.

from

CI/CD Attacks

added

2026-10-10

likes

0

similar

1. ▲
   The massive bug at the heart of the npm ecosystem blog.vlt.sh

   site category #cicd-attacks link ↗

   NPM Manifest Confusion.

   
2. ▲
   How We Hacked a Software Supply Chain for $50K landh.tech

   site category #cicd-attacks link ↗

   Scraped JavaScript front-end files of the target and used ASTs to identify import/require statements which lead to discovering a public container with NPM credentials.

   
3. ▲
   Prototype pollution attack in NodeJS application github.com

   site category #web-security link ↗
4. ▲
   How we exploited a remote code execution vulnerability in math.js capacitorset.github.io

   site category #web-security link ↗
5. ▲
   Exploiting Node.js deserialization bug for Remote Code Execution opsecx.com

   site category #web-security link ↗
   
6. ▲
   Erosion of Trust: Unmasking Supply Chain Vulnerabilities in the Terraform Registry boostsecurity.io

   site category #cicd-attacks link ↗

   Terraform modules are not protected by the Dependency Lock File, consequently, a seemingly harmless module could potentially introduce malicious code.

   

CI/CD Attacks › Techniques > Defense Evasion: “Cache poisoning attack on the NPM registry rendering packages unavailable.”