22 Seconds to Compromise: How Automated SSH Actors Move From Login to Persistence Before You Can Blink [Guest Diary], (Thu, Aug 6th)

SANS Internet Storm Center diary feed containing recent security reports on automated SSH compromise and persistence, the keyv/cacheable npm supply-chain worm, botnet vulnerability scanning of diagnostic tools, Atomic macOS stealer activity, phishing targeting AI service providers, and forensic metadata encoding. The most significant item describes a potentially active npm supply-chain compromise in which revoking stolen tokens may trigger the payload. No specific CVE identifiers are provided.