New Npm 'Ghost Campaign' Uses Fake Install Logs to Hide Malware

Feed highlights a surge in active malware campaigns and rapidly exploited vulnerabilities across open-source ecosystems, cloud services and networking equipment. Notable incidents: a 'Ghost' npm campaign that spoofs install logs to steal sudo credentials and deploy RATs; Trivy Docker images (0.69.5/0.69.6) compromised with TeamPCP infostealer affecting CI/CD scans; CISA-ordered patching for Cisco vulnerability CVE-2026-20131 being used in ransomware attacks; a critical zero-click n8n flaw allowing full server compromise; a critical Langflow vulnerability exploited within 20 hours; Ubuntu local