36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent Implants

Multiple high-impact incidents and active exploit campaigns were reported across open-source supply chains, enterprise appliances, browsers, and mobile platforms. Researchers found 36 malicious npm packages disguised as Strapi plugins that exploit Redis/PostgreSQL, deploy reverse shells, harvest credentials, and install persistent implants. Google and others attributed an Axios npm supply-chain compromise to North Korean group UNC1069 via targeted social engineering. Fortinet released out-of-band patches for an actively exploited pre-auth API access bypass (CVE-2026-35616). Cisco patched a 9.8