The npm Threat Landscape: Attack Surface and Mitigations (Updated May 1)

A Unit 42 RSS roundup covering multiple high-impact threats and research: evolving npm supply-chain attacks (including wormable malware, CI/CD persistence and multi-stage infections); active exploitation attempts against TP-Link command-injection CVE-2023-33538 with Mirai-like payloads; a widespread Axios supply-chain compromise; escalating cloud and Kubernetes threats including identity abuse; critical Amazon Bedrock/AgentCore issues (broad IAM “God Mode”, sandbox escape via DNS tunneling and credential exposure); high-risk GenAI browser extensions that intercept prompts and exfiltrate data;