The npm Threat Landscape: Attack Surface and Mitigations (Updated May 1)
2026-05-02T08:51:43Z•97c7c3e0e56ff1f198b8bbcadafbf20ece264c2681b75a6258753c7a2677bf27
AI browser extensionsAgentCoreAirSnitchAmazon BedrockAxios supply chain attackCI/CD persistenceCVE-2023-33538DNS tunnelingIAM privilege escalationKubernetes threatsMiraiTGR-STA-1030TP‑LinkWi‑Fi attacksautonomous offensive AIcredential exfiltrationdata exfiltrationfrontier AImulti-agent AImulti-stage attacksnpm supply chainprompt injectionsandbox escapesoftware supply chainwormable malware
What happened
Palo Alto Unit 42 published a set of research and threat briefs covering an elevated and diversified threat landscape: increasing npm and wider software supply‑chain attacks (including wormable malware and CI/CD persistence), attempted exploitation of CVE-2023-33538 (TP‑Link command injection with Mirai‑style payloads), active regional actor activity (TGR‑STA‑1030) and Iranian‑related phishing/hacktivist/cybercrime activity, new wireless attack techniques (AirSnitch bypassing WPA2/3 and client isolation), and ongoing Kubernetes/cloud identity exploitation. They also detail emergent AI risks: (
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- paloalto_unit42
- Record identifier
- 97c7c3e0e56ff1f198b8bbcadafbf20ece264c2681b75a6258753c7a2677bf27
- Enrichment time
- 2026-05-02T08:51:43Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.