The npm Threat Landscape: Attack Surface and Mitigations (Updated May 20)
2026-05-20T20:51:36Z•3fd709d6900a442390b3dcf8c1c41b2fd02f2f60746c969547b2cd250954717f
AD CSAI-offenseAirSnitchCVE-2023-33538CVE-2026-0300CVE-2026-31431GremlinLinuxPAN-OSTGR-STA-1030TP-LinkTrojanWi-Fi-attacksautonomous-attacksbrowser-extensionscertificate-abusedata-exfiltrationlocal-privilege-escalationmalwarenpmstealersupply-chaintampered-softwarethreat-actor-activitywormable
What happened
Palo Alto Unit 42 RSS feed (May 2026) summarizing multiple high-risk research and threat briefs. Notable coverage includes npm supply-chain threats and wormable malware, trojanized apps and TamperedChef cluster tracking, evolution of the Gremlin stealer, AD CS/ certificate misuse for escalation, a PAN-OS captive-portal unauthenticated RCE (CVE-2026-0300), the critical Linux local privilege escalation “Copy Fail” (CVE-2026-31431), malicious AI browser extensions, AirSnitch Wi‑Fi bypasses, active threat actor TGR-STA-1030 activity, autonomous AI cloud attack research, Iranian-related cyber risk,
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- 3fd709d6900a442390b3dcf8c1c41b2fd02f2f60746c969547b2cd250954717f
- Enrichment time
- 2026-05-20T20:51:36Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.