RuntimeRebel — #Node JsCybersecurity articles tagged #Node Js on RuntimeRebel.https://runtimerebel.comNode.js Abuse: Attackers Deploy Malware via Trusted Runtimehttps://runtimerebel.com/blog/node-js-abuse-attackers-deploy-malware-via-trusted-runtimehttps://runtimerebel.com/blog/node-js-abuse-attackers-deploy-malware-via-trusted-runtimeThreat actors are leveraging Node.js as a signed, trusted tool to deploy various malicious payloads, evading detection in targeted attacks since February 2026.Thu, 03 Sep 2026 12:22:47 GMTNode JsMalware DeliveryClickFixLiving-off-the-LandEtherHidingCritical Type Confusion in isolated-vm Leads to Host RCEhttps://runtimerebel.com/blog/critical-type-confusion-in-isolated-vm-leads-to-host-rcehttps://runtimerebel.com/blog/critical-type-confusion-in-isolated-vm-leads-to-host-rceA critical type confusion vulnerability in the Node.js isolated-vm library allows remote code execution on the host system via V8 Isolates.Sun, 23 Aug 2026 08:20:33 GMTIsolated VmNode JsRCEType ConfusionV8Compromised Joyfill npm Packages Deliver DEV#POPPER RAThttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-rathttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-ratBeta versions of @joyfill/layouts and @joyfill/components npm packages compromised to deliver a DEV#POPPER RAT upon import. Node.js users at risk.Wed, 29 Jul 2026 06:32:18 GMTJoyfillNPMSupply Chain AttackRATDEV POPPERNode JsNorth Korean Actors Use SVG Steganography to Deliver OtterCookiehttps://runtimerebel.com/blog/north-korean-actors-use-svg-steganography-to-deliver-ottercookiehttps://runtimerebel.com/blog/north-korean-actors-use-svg-steganography-to-deliver-ottercookieNorth Korean threat actors are hiding OtterCookie malware in SVG flag images within fake coding tests to target developers and steal cryptocurrency.Fri, 17 Jul 2026 17:13:52 GMTLazarus GroupOtterCookieContagious InterviewSteganographyNode JsInfostealerJscrambler npm Package Backdoored with Infostealer Malwarehttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwarehttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwareA malicious version of the Jscrambler npm package, 5.0.0-beta-1, was backdoored with infostealer malware, affecting 1,500 downloads. Immediate action needed.Mon, 13 Jul 2026 20:59:06 GMTJscramblerNPMSupply Chain AttackInfostealerMalwareNode Jsnpm 12 Security: Default Script Execution Changes to Mitigate Supply Chain Attackshttps://runtimerebel.com/blog/npm-12-security-default-script-execution-changes-to-mitigate-supply-chain-attackshttps://runtimerebel.com/blog/npm-12-security-default-script-execution-changes-to-mitigate-supply-chain-attacksnpm 12 introduces a critical change: 'npm install' will no longer run dependency scripts by default, significantly reducing software supply chain risks.Sat, 13 Jun 2026 16:36:33 GMTNPMSupply Chain AttackNode JsDependency ScriptsSoftware SecurityPackage ManagerAnalysis of Cross-Platform NPM Stealer Using Discord Webhookshttps://runtimerebel.com/blog/analysis-of-cross-platform-npm-stealer-using-discord-webhookshttps://runtimerebel.com/blog/analysis-of-cross-platform-npm-stealer-using-discord-webhooksTechnical teardown of an obfuscated Node.js infostealer targeting Discord tokens, crypto wallets, and browser credentials via cross-platform scripts.Fri, 22 May 2026 09:17:57 GMTNPMNode JsInfostealerDiscord WebhookObfuscationvm2 Node.js Library RCE: Multiple Sandbox Escape Vulnerabilitieshttps://runtimerebel.com/blog/vm2-node-js-library-rce-multiple-sandbox-escape-vulnerabilitieshttps://runtimerebel.com/blog/vm2-node-js-library-rce-multiple-sandbox-escape-vulnerabilitiesDiscovery of a dozen critical vulnerabilities in the vm2 Node.js library allows for sandbox escape and RCE. Learn how to mitigate these security risks now.Thu, 07 May 2026 05:13:20 GMTVm2Node JsSandbox EscapeRCEJavascript SecurityCVE-2023-29017: Critical vm2 Sandbox Escape Leads to Host RCEhttps://runtimerebel.com/blog/cve-2023-29017-critical-vm2-sandbox-escape-leads-to-host-rcehttps://runtimerebel.com/blog/cve-2023-29017-critical-vm2-sandbox-escape-leads-to-host-rceTechnical analysis of CVE-2023-29017 in the vm2 Node.js library. Learn how attackers escape the sandbox for remote code execution and how to patch.Wed, 06 May 2026 20:36:13 GMTCVE-2023-29017Vm2Node JsSandbox EscapeRCEAxios npm Supply Chain Attack: Malicious Payloads and Mitigationhttps://runtimerebel.com/blog/axios-npm-supply-chain-attack-malicious-payloads-and-mitigationhttps://runtimerebel.com/blog/axios-npm-supply-chain-attack-malicious-payloads-and-mitigationAxios npm versions 1.14.1 and 0.30.4 compromised via a malicious dependency injecting remote access trojans. Learn how to detect and remediate this threat.Tue, 21 Apr 2026 08:44:16 GMTAxiosNPMNode JsPlain Crypto JsSupply Chain CompromiseCISANorth Korean Social Engineering Targets Node.js Maintainershttps://runtimerebel.com/blog/north-korean-social-engineering-targets-node-js-maintainershttps://runtimerebel.com/blog/north-korean-social-engineering-targets-node-js-maintainersNorth Korean threat actors use social engineering and malicious npm packages to target high-profile Node.js maintainers in a sophisticated supply chain campaign.Mon, 06 Apr 2026 12:24:38 GMTLazarus GroupNPMSocial EngineeringNode JsNorth KoreaNorth Korean Malicious npm Packages: Detecting Contagious Interviewhttps://runtimerebel.com/blog/north-korean-malicious-npm-packages-detecting-contagious-interviewhttps://runtimerebel.com/blog/north-korean-malicious-npm-packages-detecting-contagious-interviewNorth Korean actors published 26 malicious npm packages using Pastebin as a C2 dead drop resolver in a new Contagious Interview campaign iteration.Mon, 02 Mar 2026 12:18:05 GMTNPMLazarus GroupContagious InterviewSupply Chain AttackPastebinC2Node Js