January 2026 Summaries

In 2025, the npm ecosystem faced a significant increase in security threats, particularly Account Takeovers (ATOs), where attackers gain access to legitimate open-source projects to distribute malware. ATOs are attractive to threat actors because they exploit trusted projects and evade conventional security measures, leading to a 15.3x rise in malicious npm packages compared to 2024. Five major ATO campaigns in 2025 highlighted vulnerabilities in the npm ecosystem, including phishing attacks on maintainers and exploiting GitHub vulnerabilities. These campaigns affected key JavaScript packages like eslint-config-prettier, is, and chalk, leading to the compromise of developer machines and CI/CD pipelines through tactics such as Remote Code Execution and JavaScript malware loaders. Despite improvements by GitHub, such as Trusted Publishing and session-based authorization, challenges remain, particularly for maintainers using unsupported CI/CD platforms. The attacks underscore the ongoing need for enhanced security measures and awareness in the open-source community.

A critical sandbox escape vulnerability identified as CVE-2026-22709 has been disclosed in vm2, a widely-used Node.js library designed to safely execute untrusted code in sandboxed environments. With a CVSS v3.1 score of 9.8, this vulnerability allows attackers to bypass Promise callback sanitization and execute arbitrary code beyond the intended sandbox boundary, highlighting the fragility of vm2, which has experienced over 20 known breakouts in previous versions. The vulnerability, published in January 2026, was found in version 3.10.0 and involves a flaw in `globalPromise.prototype.then` and `globalPromise.prototype.catch` where `Function.prototype.call` can be intercepted, allowing access to unsanitized error objects. This was patched in version 3.10.2 by substituting `Function.prototype.call()` with `Reflect.apply()`, which prevents interception. Despite the patch, the advisory emphasizes that vm2's security model is inherently fragile and recommends considering alternative approaches for executing untrusted JavaScript code, urging users to update immediately to mitigate potential exploits while also implementing additional security measures beyond relying solely on vm2's sandbox.

The Model Context Protocol (MCP) was launched by Anthropic in November 2024 to standardize how AI assistants connect to external tools and data sources, quickly gaining popularity as the "USB-C for AI applications." However, its rapid adoption throughout 2025 and 2026 exposed numerous critical vulnerabilities, as security considerations were overlooked in its trust assumptions, implementation, and third-party servers. Common vulnerabilities such as command injection, path traversal, and missing authentication were prevalent, often exacerbated by newer tactics like prompt injection, which expanded the potential attack surface. Several specific vulnerabilities were identified in various MCP implementations, including the Anthropic mcp-server-git and Framelink Figma MCP server, highlighting the risks of processing potentially attacker-controlled content. These vulnerabilities emphasize the need for robust security measures, such as validating and sanitizing input and treating outputs from LLMs and MCP servers as untrusted. The text suggests that AppSec teams should adapt their threat models to treat LLMs as untrusted intermediaries, emphasizing the importance of applying secure coding practices and monitoring MCP activity to mitigate risks. The MCP's first year underscores the necessity of integrating application security into AI infrastructure, as classical vulnerabilities persist alongside novel attack vectors, posing significant challenges for secure AI deployments.

Between mid-December and late January, a significant abuse of the npm registry occurred when four accounts published over 100 packages masquerading as benign but embedding large volumes of encrypted data disguised as WOFF2 font files, leading to approximately 34 TiB of uploaded data and an estimated 4.3 PiB of downloads. While the packages contained no malicious code, analysis revealed they were not real fonts but data chunks, with some versions showing HLS playlists pointing to encrypted media segments, suggesting misuse for content distribution. The accounts have since been removed, yet this incident highlights a systemic issue within open-source infrastructure like npm, which operates on limited resources and relies heavily on responsible use and community support. It underscores concerns that unchecked abuse, rather than malware, poses a significant threat to the sustainability and reliability of open-source ecosystems, as these platforms are often run by non-profits or small teams with limited funding and rely on the responsible use of shared resources by the community.

AI is transforming software development by accelerating the generation of code, but this rapid pace can introduce subtle vulnerabilities that traditional security tools may miss. Historical incidents, like Apple's TLS stack error and Facebook's access token flaw, illustrate how small changes in trusted systems can lead to significant security breaches. These incidents often involve design and configuration issues rather than known vulnerabilities, which conventional static analysis tools struggle to detect. Endor Labs' AI Security Code Review aims to address this gap by using a multi-agent AI system to analyze pull requests comprehensively, identifying risky changes that might go unnoticed by traditional methods. By focusing on alterations in authorization logic, secret handling, and security configurations, this tool provides actionable insights to prevent breaches before they occur, adapting to the evolving landscape where AI assists in software development.

Astronomer, a leading unified orchestration platform powered by Apache Airflow, confronted significant challenges with its software composition analysis (SCA) tool, which produced high volumes of alerts without effectively prioritizing vulnerabilities, leading to eroded trust and resource-intensive customer assurance processes. To address these issues, Astronomer adopted Endor Labs, which provided a more precise vulnerability management system through evidence-based prioritization and seamless integration into existing workflows, including GitHub. Endor Labs' ability to conduct reachability analysis and offer technical coverage for Go and Python enabled Astronomer to focus on real vulnerabilities, rebuild trust between security and engineering teams, reduce the risk of breaking changes, and support their global expansion by efficiently meeting various international regulations. This transition allowed Astronomer to maintain high production velocity while satisfying complex compliance requirements, particularly in the European market.

Node.js released a security patch to address eight vulnerabilities across its active release lines, including four denial of service (DoS) vulnerabilities, three bypasses of the permission system, and one memory exposure issue. The DoS vulnerabilities primarily affect applications with specific configurations, such as those using the `vm` module or certain TLS settings, and have limited real-world exploitability for web applications. The permission system vulnerabilities involve symlink bypasses and are relevant to environments where code execution capabilities need to be restricted, such as AI or desktop applications. The memory exposure vulnerability arises from a race condition in the `vm` module's buffer allocation, potentially exposing sensitive data when processing untrusted code. Node.js's permission system, introduced in 2023, requires explicit enabling and is not widely used in production, while older Node.js versions might not be affected due to the absence of these features. The patch includes improvements to error handling in HTTP/2 connections and adjustments to the permission system to prevent symlink bypasses. Users are advised to update to the latest Node.js version to mitigate risks, although the potential for large-scale exploitation is deemed low.

CVE-2025-12543 is a critical vulnerability in the Undertow HTTP server core that permits attackers to send malicious or unexpected Host headers, which are improperly accepted as valid, posing risks such as cache poisoning, unsafe redirects, and cross-tenant mix-ups. This issue affects enterprise Java environments using Undertow directly or indirectly, including platforms like WildFly and JBoss EAP. Organizations are advised to upgrade immediately as patches become available and enforce strict Host header validation at both the application and edge layers. The vulnerability stems from Undertow's failure to strictly validate Host header values, allowing attacker-controlled headers to be trusted by various application components. Potential impacts include the leaking of sensitive information, unauthorized access in multi-tenant environments, and exposure of internal functionalities. To mitigate the risk, Undertow has introduced a HostHeaderHandler to ensure early validation, rejecting invalid or ambiguous Host headers with a 400 Bad Request error. Additional measures include strict application-level validation, reverse proxy rules, and logging rejected headers to detect exploitation attempts, emphasizing the importance of addressing this vulnerability across enterprise systems due to its potential to cause systemic security failures.

In a recent supply chain attack, threat actors infiltrated n8n's community node ecosystem by introducing a malicious npm package disguised as a Google Ads integration, which exfiltrated OAuth credentials during workflow execution to an attacker-controlled server. This attack highlights the vulnerabilities in n8n's trust model, where community nodes, installed as npm packages, run with the same level of access as the core platform, allowing attackers to exploit workflow automation platforms that centralize sensitive credentials. Despite security measures taken by platforms like GitHub in response to similar threats, the attack underscores the continued risk posed by unreviewed third-party integrations, which can expose organizations to credential theft and broader security breaches. The attack strategy mirrors tactics seen in previous campaigns, such as the Shai-Hulud campaign, and emphasizes the need for organizations to scrutinize community nodes, audit package metadata, and monitor network traffic to mitigate these risks, while also balancing the convenience of automation with its potential security implications.

A critical vulnerability in jsPDF, a popular npm package for generating PDF documents in JavaScript applications, has been identified, allowing attackers to exploit local file inclusion and path traversal by embedding arbitrary files within generated PDFs. This vulnerability, tracked as CVE-2025-68428, affects only the Node.js builds of jsPDF, not browser builds, and can lead to unauthorized disclosure of sensitive data when the affected methods (loadFile, addImage, html, addFont) are passed user-controlled inputs. The issue, discovered by security researcher Kwangwoon Kim and reported through GitHub's security advisory, has been addressed in jsPDF version 4.0.0, which requires Node.js to operate in permission mode to prevent unauthorized file access. However, upgrading poses challenges, as many environments use older Node.js versions lacking stable permission mode support, and enabling this mode may disrupt existing functionalities unless filesystem access patterns are thoroughly mapped. Organizations using jsPDF in server-side environments should prioritize remediation by upgrading to version 4.0.0 and carefully configuring permission settings to mitigate the risk of exploitation.