Written by Andrea Mazzarini, Senior Principal CSM at Veracode

Subscribe to these daily briefings on LinkedIn

Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!

Executive Summary Top threats:

• Mastra npm supply chain compromise (easy-day-js/Miasma variant) : Attacker hijacked contributor account, injected typosquatted dependency into 140+ @mastra/* packages (~June 17). Delivers cross-platform RAT/credential stealer (LLM keys, CI/CD secrets, wallets). High blast-radius worm in AI/JS ecosystem.Atomic Risk: 9/10. Immediate Veracode SCA + Package Firewall priority.
• cPanel/WHM CVE-2026-41940 (auth bypass, CVSS 9.8) : Actively exploited in wild (pre- and post-patch). CRLF injection leads to unauth root access on management plane. Impacts ~1.5M+ servers.Atomic Risk: 9/10. Patch + EASM critical.
• Langflow CVE-2026-33017 (unauth RCE) : Exploited for cryptomining. Public flow endpoint executes arbitrary Python via unsandboxed exec().Atomic Risk: 8/10. Affects AI workflows.
• Recent CISA KEV (e.g., Lantronix, UniFi OS, Cisco) and Chrome V8 out-of-bounds (CVE-2026-11645, in-wild). Ongoing ransomware (Akira, World Leaks/Tata).

No new 24h zero-days of catastrophic scale, but persistent supply-chain worm activity and KEV enforcement remain elevated. Veracode SCA/Package Firewall + Risk Manager map directly to top signals.

Comprehensive Threats Table

Detailed First-Principles Analysis (Top Items)

• Mastra/easy-day-js : Root cause = dormant contributor account takeover + mass-publish of trojanized versions with postinstall (or binding.gyp evasion) dropper. Mechanism: transitive dep pulls RAT on npm install. Blast radius: developer workstations, CI runners, downstream AI apps—propagates like worm via popular ecosystem. Veracode control: SCA + Package Firewall blocks malicious OSS at source.
• cPanel CVE-2026-41940 : Fundamental session handling flaw (CRLF in cookie/session file) bypasses auth/encryption checks. High propagation risk on exposed management interfaces. First-principles: never trust unauthenticated session writes. Veracode EASM for exposure discovery.
• Langflow CVE-2026-33017 : Unsandboxed exec() on user-controlled flow data. Classic code injection in AI tooling. Root cause: assuming public endpoints are safe. Blast: full RCE → persistence/mining. Container Security + SCA for runtime/OSS layers.

Broader Signals

X volume moderate on supply chain (Miasma references) and cPanel exploits. Ransomware steady (Akira, World Leaks on Tata/Apple-Tesla data). No major new APT zero-days in last 48h, but North Korean-linked (Sapphire Sleet) activity in npm. Ongoing Miasma/Shai-Hulud variants emphasize persistent OSS registry risks.

Veracode Tool Reference with

Links

SCA + Package Firewall (malicious packages, supply chain worms, OSS vulnerabilities): https://docs.veracode.com/r/Software_Composition_Analysis and https://docs.veracode.com/r/Veracode_Package_Firewall

Risk Manager (unified risk prioritization with CISA KEV context): https://docs.veracode.com/r/Veracode_Risk_Manager

Veracode Fix (AI remediation for SAST/SCA): https://docs.veracode.com/r/About_Veracode_Fix

SAST (custom code vulnerabilities): https://docs.veracode.com/r/c_static_overview

DAST (runtime web app and API testing): https://docs.veracode.com/r/DAST

EASM (external attack surface discovery): https://docs.veracode.com/r/Discover_your_attack_surface

Container Security: https://docs.veracode.com/r/Veracode_Container_Security

Policy Management (governance and enforcement): https://docs.veracode.com/r/c_appsec_policies

Veracode Recommendations

• Malicious Packages & Supply Chain Worms : Mastra/easy-day-js/Miasma. SCA + Package Firewall fits perfectly for dependency scanning/blocking. Action: Enable Package Firewall policies for npm/PyPI and enforce in CI/CD.
• New/KEV CVEs : cPanel, Chrome, Lantronix/UniFi. Risk Manager for KEV prioritization and unified view. Action: Import findings to Risk Manager and set auto-prioritization.
• Web/Runtime Exploits : Langflow RCE, cPanel. DAST for exposed apps/APIs. Action: Run targeted DAST on public endpoints.
• Containers : Langflow/Mastra in containerized AI. Container Security. Action: Scan images for vulnerable deps.
• Governance : Policy Management to enforce across findings. Action: Update policies for SCA/KEV enforcement.

Prioritized Action Plan (SMART)

• Bold: Today — Run full SCA scan + enable Package Firewall for npm; audit/block Mastra/easy-day-js and Miasma variants in all repos/CI.
• Inventory exposed cPanel/Langflow instances via EASM; patch immediately (CVE-2026-41940/33017).
• Load new KEV items (Lantronix/UniFi/etc.) into Risk Manager; enforce deadlines.
• Browser policy enforcement for Chrome/Edge updates.
• Review/rotate creds from any potential npm compromises; scan CI logs for anomalous egress.
• Tomorrow: Targeted DAST + Container scans; Policy Management updates. Measure: Zero unpatched KEV/supply-chain hits in 48h.

This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.