Cybersecurity articles tagged #JavaScript on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawshttps://runtimerebel.com/blog/polymorphic-phishing-page-analysis-javascript-obfuscation-flawsAnalysis of a polymorphic phishing page utilizing heavy JavaScript obfuscation and variable scope bugs that cause browser loops.Tue, 01 Sep 2026 02:51:10 GMTPhishingCredential TheftObfuscationJavaScriptMalware Analysishttps://runtimerebel.com/blog/deobfuscating-malicious-javascript-for-threat-analysishttps://runtimerebel.com/blog/deobfuscating-malicious-javascript-for-threat-analysisUnderstanding JavaScript obfuscation techniques used in phishing and malware. Learn static and dynamic deobfuscation methods to uncover malicious intent.Tue, 01 Sep 2026 02:45:47 GMTJavaScriptObfuscationPhishingMalwareDeobfuscationhttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialshttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialsMassive ChainDrop npm supply chain attack compromises over 1,300 packages, stealing developer and cloud credentials through malicious preinstall scripts.Tue, 04 Aug 2026 17:30:58 GMTNPMSupply Chain AttackInfostealerJavaScriptChainDrophttps://runtimerebel.com/blog/adform-script-poisoning-crypto-wallet-swapping-attackhttps://runtimerebel.com/blog/adform-script-poisoning-crypto-wallet-swapping-attackAdform's JavaScript was poisoned to swap crypto wallet addresses on customer sites.Sat, 01 Aug 2026 10:00:39 GMTAdformJavaScriptCryptocurrencyWallet SwappingSupply Chain AttackClient Side Attackhttps://runtimerebel.com/blog/adblock-for-youtube-extension-dormant-script-injection-threathttps://runtimerebel.com/blog/adblock-for-youtube-extension-dormant-script-injection-threatA popular Chrome ad blocker, "Adblock for YouTube," with over 10 million installs, contains a dormant capability for arbitrary JavaScript injection.Thu, 25 Jun 2026 17:17:00 GMTChrome ExtensionAdblock for YouTubeScript InjectionJavaScriptBrowser SecuritySupply ChainMalicious Extensionhttps://runtimerebel.com/blog/malicious-npm-packages-impersonate-postcss-to-deliver-windows-rathttps://runtimerebel.com/blog/malicious-npm-packages-impersonate-postcss-to-deliver-windows-ratSecurity researchers uncover malicious npm packages such as postcss-minify-selector-parser delivering Windows RATs via supply chain attacks. Audit your builds.Tue, 23 Jun 2026 13:10:31 GMTNPMPostCSSTyposquattingRATJavaScripthttps://runtimerebel.com/blog/ironworm-malware-36-npm-packages-identified-in-supply-chain-attackhttps://runtimerebel.com/blog/ironworm-malware-36-npm-packages-identified-in-supply-chain-attackSecurity researchers discover a campaign delivering IronWorm infostealer malware via 36 malicious npm packages using preinstall script execution hooks.Thu, 04 Jun 2026 17:09:30 GMTNPMIronWormInfostealerSupply Chain AttackJavaScripthttps://runtimerebel.com/blog/netsupport-rat-infection-how-to-detect-unidentified-loader-exploitshttps://runtimerebel.com/blog/netsupport-rat-infection-how-to-detect-unidentified-loader-exploitsAnalyze the multi-stage infection chain of an unidentified loader delivering NetSupport RAT, featuring technical breakdowns of JavaScript and PowerShell TTPs.Mon, 01 Jun 2026 01:04:07 GMTNetSupport RATMalware AnalysisPowerShellJavaScriptLoaderhttps://runtimerebel.com/blog/chromium-rce-risk-unfixed-flaw-allows-background-javascripthttps://runtimerebel.com/blog/chromium-rce-risk-unfixed-flaw-allows-background-javascriptGoogle accidentally exposed details of an unfixed Chromium flaw. This enables RCE via persistent background JavaScript execution, affecting many browsers.Thu, 21 May 2026 20:40:55 GMTChromiumRCEJavaScriptBrowser SecurityGoogleZero-Dayhttps://runtimerebel.com/blog/320-antv-npm-packages-compromised-in-mini-shai-hulud-attackhttps://runtimerebel.com/blog/320-antv-npm-packages-compromised-in-mini-shai-hulud-attackA maintainer account compromise has led to a major supply chain attack against Alibaba’s @antv NPM namespace, impacting over 320 visualization packages.Wed, 20 May 2026 13:06:33 GMTNPMMini Shai HuludAntvSupply Chain SecurityJavaScripthttps://runtimerebel.com/blog/malicious-pdf-files-analyzing-acroform-javascript-for-initial-accesshttps://runtimerebel.com/blog/malicious-pdf-files-analyzing-acroform-javascript-for-initial-accessSecurity analysts have identified malicious PDF files utilizing AcroForm dictionaries to execute JavaScript and fetch remote payloads from external servers.Mon, 04 May 2026 05:14:53 GMTPDF MalwareAcroFormJavaScriptInitial AccessAdobe Readerhttps://runtimerebel.com/blog/detect-obfuscated-javascript-phishing-delivered-via-rar-archiveshttps://runtimerebel.com/blog/detect-obfuscated-javascript-phishing-delivered-via-rar-archivesSecurity researchers identify a new phishing campaign using heavily obfuscated JavaScript within RAR archives to bypass traditional endpoint detection.Fri, 10 Apr 2026 08:43:36 GMTJavaScriptPhishingRARObfuscationWScriptEvasionhttps://runtimerebel.com/blog/magecart-skimmer-hides-in-pixel-sized-svg-on-magento-storeshttps://runtimerebel.com/blog/magecart-skimmer-hides-in-pixel-sized-svg-on-magento-storesA sophisticated Magecart campaign targets nearly 100 Magento stores, concealing credit card-stealing JavaScript within tiny, pixel-sized SVG images.Thu, 09 Apr 2026 00:34:13 GMTMagecartCredit Card SkimmerMagentoE CommerceSVGJavaScriptSupply Chain Attackhttps://runtimerebel.com/blog/browsergate-linkedin-s-stealthy-chrome-extension-scanning-and-data-collectionhttps://runtimerebel.com/blog/browsergate-linkedin-s-stealthy-chrome-extension-scanning-and-data-collectionAnalysis of 'BrowserGate' reveals LinkedIn's hidden JavaScript scanning over 6,000 Chrome extensions and collecting user device data. Understand the privacy implications.Sat, 04 Apr 2026 00:37:09 GMTLinkedInBrowserGateChrome ExtensionsData CollectionPrivacyJavaScripthttps://runtimerebel.com/blog/axios-npm-compromise-supply-chain-threat-analysishttps://runtimerebel.com/blog/axios-npm-compromise-supply-chain-threat-analysisAnalysis of the Axios NPM package compromise, a potential supply chain attack impacting JavaScript HTTP client library users, possibly by North Korean threat actors.Wed, 01 Apr 2026 00:44:25 GMTAxiosNPMJavaScriptSupply Chain AttackThreat Actorshttps://runtimerebel.com/blog/axios-npm-package-hijacked-cross-platform-malware-distributionhttps://runtimerebel.com/blog/axios-npm-package-hijacked-cross-platform-malware-distributionAnalysis of the Axios npm package hijack distributing remote access trojans to Linux, Windows, and macOS systems. Learn to protect your software supply chain.Tue, 31 Mar 2026 16:29:10 GMTAxiosNPMSupply Chain AttackRemote Access TrojanMalwareJavaScriptLinuxWindowsmacOShttps://runtimerebel.com/blog/sandworm-mode-malicious-npm-cluster-automates-secret-harvesting-and-crypto-thefthttps://runtimerebel.com/blog/sandworm-mode-malicious-npm-cluster-automates-secret-harvesting-and-crypto-theftSecurity researchers have identified a coordinated campaign involving 19 malicious npm packages designed to exfiltrate CI/CD secrets, API tokens, and private…Mon, 23 Feb 2026 12:20:23 GMTNPMSupply Chain AttackCredential HarvestingCI CD SecurityJavaScripthttps://runtimerebel.com/blog/supply-chain-attack-npmhttps://runtimerebel.com/blog/supply-chain-attack-npmA typosquatted npm package mimicking a popular React utility has been downloaded over 47,000 times before removal.Thu, 25 Jan 2024 00:00:00 GMTNPMSupply ChainTyposquattingJavaScriptBackdoor