November 2025 Summaries

Npm worms, a resurgence of an old cybersecurity threat, pose significant risks to the software supply chain by exploiting the Node Package Manager ecosystem, which is heavily relied upon for JavaScript and Node.js development. These self-replicating pieces of malware hide within legitimate-looking packages, executing malicious code during installation and spreading through automated mechanisms, thereby compromising developers' systems and Continuous Integration environments. The Shai-Hulud worm exemplifies the dangers of npm worms, demonstrating rapid propagation through credential theft and package infection, impacting thousands of GitHub repositories and numerous organizations. Despite security measures like two-factor authentication, the inherent trust in shared code and the scale of npm's interconnected dependencies make these worms particularly dangerous. Effective protection involves good development hygiene and understanding credential and dependency management to mitigate the risk of such high-impact attacks.

The Shai-Hulud software supply chain attack has intensified, impacting the npm ecosystem by exploiting new execution techniques that lead to credential theft, supply-chain propagation, and potential data loss. Targeting npm packages from organizations like Zapier, ENS Domains, Postman, and PostHog, the attack employs the "Bun" runtime for stealthier execution compared to the more monitored Node.js. The attack is triggered by a malicious pre-install script in "package.json" files, spreading through developer environments and CI/CD systems, particularly affecting GitHub Actions by stealing repository secrets. Although 99% of affected package versions were removed from npm, over 26,000 repositories have been compromised, leveraging GitHub tokens to automatically infect additional repositories. The malware's capabilities include credential harvesting, self-replication, and remote code execution, with destructive behaviors such as data erasure on both Windows and Linux systems. The attack underscores the need for vigilant monitoring, prompt credential rotation, and enhanced security practices to mitigate supply chain risks.

The OWASP Top 10, a crucial guide within the Application Security (AppSec) community, has been significantly updated since its last revision in 2021, with key changes unveiled at the OWASP Global AppSec Conference in Washington, D.C. The list maintains Broken Access Control as the leading risk, highlighting its prevalence in web applications, APIs, and digital systems, with 100% of tested applications exhibiting some flaws in this area. Advancements in AI-driven Static Application Security Testing (SAST) are noted for their potential in enhancing detection of complex vulnerabilities. Meanwhile, Cryptographic Failures, Injection, and Insecure Design have moved down in ranking, with improvements credited to threat modeling and Secure-by-Design principles. Security Misconfiguration and Software Supply Chain Failures have risen to the second and third positions, respectively, underscoring challenges in ensuring secure configurations and managing the complexities of modern software supply chains. The report emphasizes ongoing security challenges, including those posed by AI and digital transformations, and advocates for comprehensive prevention strategies while acknowledging the dynamic nature of cybersecurity threats.

At the OWASP Global AppSec event in Washington, D.C., Endor Labs highlighted the remarkable journey of Bryce, a high school junior from San Antonio, who created Space Badge, an innovative open, co-op multiplayer electronic game badge. This creation not only captivated attendees at the event but also symbolized the spirit of innovation and community that Endor Labs values. Bryce's journey was supported by Endor Labs, which flew him and his father to the conference and awarded him a $5,000 scholarship to support his college education, acknowledging his creativity and contributions to the security community. The Space Badge initiative fostered engagement among attendees and exemplified Endor Labs' commitment to empowering the next generation of builders and innovators. Bryce's story, supported by mentors and his father's guidance, underscores the importance of encouraging young talent in the cybersecurity field, with plans already in motion for the next iteration of his project.

Static Application Security Testing (SAST) and Dynamic Application Security Testing (DAST) are essential for securing applications, with SAST addressing vulnerabilities before code deployment and DAST identifying issues in running applications. However, when these tools operate separately, they can overwhelm developers and AppSec teams with duplicate alerts lacking context, complicating vulnerability prioritization. The integration of Endor Labs' AI-Native SAST with StackHawk DAST resolves this by correlating their findings, providing developers with a unified alert system that offers comprehensive insight into vulnerabilities from code to runtime. This integration enhances efficiency by correlating static and dynamic analyses, prioritizing vulnerabilities based on exploitability, and providing actionable remediation guidance, thereby streamlining the security workflow and reducing noise. As development speeds up with AI-generated code, the need for precise, automated correlation becomes crucial, and the Endor Labs and StackHawk collaboration addresses this by helping teams focus on significant vulnerabilities without manual intervention.

Endor Labs' whitepaper on AI SAST (Static Application Security Testing) presents a multi-modal approach that combines agentic reasoning, program analysis, and advanced rules to significantly reduce false positives in code security while identifying complex logic flaws. Published in November 2025 and updated in April 2026, the report emphasizes a 95% reduction in false positives, enhancing both security and developer productivity. The document also highlights related advancements, such as using multi-step prompt techniques to improve AI-generated code security, integrating malware detection with Cursor hooks to prevent supply chain attacks, and addressing critical remote code execution vulnerabilities in JavaScript environments like Node.js.

Endor Labs has introduced an AI-powered Static Application Security Testing (SAST) tool designed to detect complex business logic and architectural flaws while significantly reducing false positives by up to 95%. Unlike conventional SAST tools, which often suffer from high false positive rates and miss nuanced vulnerabilities, this AI SAST orchestrates multiple specialized agents that analyze code through syntax parsing, dataflow tracing, and multi-pass reasoning to understand the code's intent and context. This multi-modal approach mimics the manual processes of security teams, effectively identifying sophisticated vulnerabilities such as insecure direct object references (IDORs) that traditional tools often miss. Early testing with enterprise customers has demonstrated its efficacy in accurately classifying findings and suggesting context-aware fixes, thereby streamlining the security review process and reducing security debt. The tool, available in private preview, integrates seamlessly into existing CI/CD pipelines and security workflows, promising to enhance engineering velocity by automating the triage and classification of security findings.

Organizations are facing increasing challenges in managing vulnerabilities within complex cloud environments and software supply chains, with Gartner predicting a significant rise in attacks by 2025. Upwind and Endor Labs have partnered to address these challenges by providing a comprehensive security solution that integrates runtime-powered cloud security with advanced application security and code intelligence. This collaboration offers continuous visibility into cloud workloads and the software supply chain, allowing for effective vulnerability detection, risk contextualization, and rapid response. The unified platform enhances security by providing complete visibility across code and cloud, prioritizing actionable remediation, and strengthening the security posture throughout the software development lifecycle. Endor Labs focuses on application security with intelligent code reviews and risk-based prioritization, while Upwind offers real-time visibility into cloud environments, prioritizing fixes based on actual usage and detecting threats as they occur. This partnership aims to reduce risk, streamline workflows, and bolster cloud security for organizations worldwide.

Security researcher Paul McCarty uncovered a large-scale spam campaign in the npm ecosystem, dubbed the IndonesianFoods worm, involving over 43,000 spam packages with dormant payloads, published over two years. The worm's distinctive naming scheme, using Indonesian names and food terms, points to its origin. Despite no immediate malicious code, the campaign's complexity lies in its ability to remain undetected by current security measures, as the packages appear legitimate and only become active when specific scripts are manually executed. The attack exploits the TEA protocol to monetize through TEA token rewards by artificially inflating impact scores via circular dependencies, highlighting significant gaps in npm's security framework. The campaign's success over a prolonged period, facilitated by at least eleven coordinated accounts, underscores vulnerabilities in the npm ecosystem, emphasizing the need for improved detection systems and proactive measures to maintain trust and prevent similar future attacks.

Happy-dom, a widely-used headless browser in Node.js, was found vulnerable to remote code execution due to a critical flaw, CVE-2025-61927, allowing malicious JavaScript to escape its sandbox. The package relied on Node.js's vm module, which is not intended for secure execution of untrusted code, enabling attackers to execute arbitrary commands by exploiting weak isolation. Initial mitigation strategies, like avoiding untrusted JavaScript or disabling dynamic code execution primitives, were deemed insufficient as prototype pollution attacks could still occur. This led to a follow-up advisory, CVE-2025-62410, recommending additional security measures such as using the Node.js flag "--frozen-intrinsics" to prevent alteration of built-in objects. Despite these improvements, the risk of pollution remains, prompting suggestions for using more secure sandboxes like isolated-vm or Secure EcmaScript when handling untrusted JavaScript, highlighting the inherent challenges in effectively isolating such code.

Endor Labs has announced its support for the newly launched OWASP Secure Pipeline Verification Standard (SPVS), a framework designed to enhance and standardize the security of software delivery pipelines. SPVS addresses a significant gap in existing security frameworks by offering a detailed, stage-by-stage checklist that provides auditable controls across the five stages of the software development lifecycle: plan, develop, integrate, release, and operate. This framework complements existing standards by translating their broader intents into specific, testable requirements for pipeline security, focusing on issues like artifact integrity, runner hardening, and release gating. The rising threat of supply chain attacks underscores the necessity of pipeline security, not just application security, and SPVS provides a structured approach to ensure comprehensive protection. Endor Labs supports this initiative by offering tools that automate security controls and provide compliance validation across the software delivery process, helping organizations to align with SPVS and improve their security posture.

Static Application Security Testing (SAST) tools are often criticized for high false-positive rates, but a critical issue is their tendency to miss significant vulnerabilities, known as false negatives, which are only discovered after an exploit occurs. Research indicates that SAST tools can miss 47% to 80% of vulnerabilities under controlled conditions, and even combining multiple tools only modestly reduces this rate while increasing false positives. These tools struggle with complex vulnerabilities that require understanding business logic and interactions across components, often missing issues like authentication flaws and inter-procedural vulnerabilities. This challenge is exacerbated by the overwhelming number of false positives, which can desensitize developers and lead them to overlook real issues. Despite efforts to supplement SAST with manual code reviews and security audits, these methods also have limitations. Vendors have historically optimized SAST tools to reduce noise, sometimes at the expense of detection accuracy, but recent perspectives emphasize minimizing false negatives even if it increases false positives. This shift acknowledges the greater risk posed by undetected vulnerabilities, particularly in high-stakes industries, highlighting the need for tools that can effectively analyze business logic and complex code paths to identify critical security flaws.

OWASP has released its updated 2025 Top 10 list for Web Applications at Global AppSec in Washington, DC, highlighting key changes in application security risks. A significant addition is the inclusion of "Software Supply Chain Failures" at the third spot, reflecting an industry-wide recognition of its growing threat. This category underscores the importance of securing the entire software development and deployment process, addressing vulnerabilities in software build systems, third-party dependencies, and surrounding infrastructure. High-profile incidents, such as the SolarWinds hack and the Log4J vulnerability, illustrate the devastating impact of supply chain failures. The update calls for a comprehensive security strategy, emphasizing dependency monitoring, pipeline hardening, strict access control, and developer protection. The OWASP community is encouraged to participate in ongoing efforts to refine the list and contribute to translations and discussions.

A critical SQL injection vulnerability, identified as CVE-2025-64459, has been discovered in Django, a popular Python web framework used in numerous web applications. This vulnerability allows attackers to manipulate database query logic by injecting internal query parameters when applications pass user-controlled input directly into Django's QuerySet methods. This flaw can lead to unauthorized data access, authentication bypass, and privilege escalation, posing a significant threat due to its high impact and low attack complexity, with a CVSS score of 9.1. Affected versions include Django 6.0, 5.2, 5.1, and 4.2, as well as potentially older versions, necessitating an immediate upgrade to patched versions 5.2.8, 5.1.14, or 4.2.26. To mitigate the risk, Django has implemented a two-layer validation system, while developers are urged to review and update their codebases, avoid passing user-controlled data directly into QuerySet methods, and adopt secure coding practices.