Researchers at JFrog found 148 npm packages that abused the registry not to attack developers but as free hosting for a booby-trapped web proxy aimed at students trying to bypass school filters. Anyone who opened one of the proxy sites had their browser quietly conscripted into a distributed denial-of-service botnet, flooding target servers with HTTP and WebSocket traffic, alongside injected ads and tracking. Crucially, the packages contained no install-time scripts and were never meant to be added to a project, so dependency scanners and install sandboxes, which watch what runs on install, would not catch them. The operators can re-arm the dormant attack code with a single commit.
Researchers found a flaw in Opera GX, the gaming-focused version of the Opera browser, that let a malicious website silently install a browser add-on, known as a mod, and use it to pull specific data from the pages the victim later visited. In a proof of concept, they reconstructed a signed-in user's full Gmail address from a single visit, with no clicks required. The issue stemmed from how the browser handled automatic mod installation, giving a hostile page more power than it should have. Opera has patched the flaw and says it found no evidence of exploitation before the fix, but users should update.
Google has accidentally published the technical details of an unfixed Chromium vulnerability that lets a malicious webpage run JavaScript on a visitor's device even after the browser is closed. The issue, originally reported by researcher Lyra Rebane in December 2022, abuses a Service Worker download task that never terminates. It was marked 'fixed' on February 12 and the bug tracker went public on May 20 after the 14-week visibility timer expired, but Rebane re-tested the latest Chrome Dev 150 and Edge 148 and confirmed the bug still works. Microsoft Edge no longer shows a download prompt, making the persistence completely silent. All Chromium-based browsers are affected.
TrustStrike Labs