Product & Security Tips — SamHouston (Veracode) asked a question.
Written by Andrea Mazzarini, Senior Principal CSM at Veracode
Subscribe to these daily briefings on LinkedIn: https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/
Join the VERACODE Community Group - Product & Security Tips - for the latest Veracode Daily Threat Intel Brief - Stay current, stay secure!
https://community.veracode.com/s/group/0F9Uf0000001c01KAA/product-security-tips
Executive Summary
The dominant high-blast-radius threat remains the active self-propagating npm supply-chain worm campaign (Shai-Hulud / Mini Shai-Hulud / ChainDrop lineage and related Miasma/Phantom Gyp variants). In the last 7 days a single compromised maintainer account triggered rapid infection of hundreds to over 1,200 packages (including high-download caching libraries) totaling billions of monthly installs; the worm executes at install time, steals developer/CI/cloud credentials, and self-propagates while carrying valid provenance. Atomic Risk 10. First-principles impact: any organization pulling npm packages in the last week faces potential credential compromise and further package poisoning; Veracode Package Firewall + SCA + SSCI provides the direct control point to block malicious packages and surface proprietary threat intelligence.
Multiple critical unauthenticated RCE and authentication-bypass CVEs were added to the KEV catalog in the last 7 days (Progress LoadMaster, JetBrains TeamCity, IBM Langflow, N-able N-central). Atomic Risk 9. These enable immediate remote takeover of internet-facing or management systems and map directly to Risk Manager prioritization plus EASM discovery.
Ransomware activity remains elevated with splintering groups, active exploitation of VPN/appliance flaws, and social-engineering vectors leading to encryption; dark-web secondary OSINT shows continued leak-site postings and stealer-log circulation. Atomic Risk 8. Strong Veracode applicability across SCA, Risk Manager, EASM, and Policy Management for rapid prioritization and governance.
Comprehensive Threats Table
Detailed First-Principles Analysis (Top Items)
npm Supply-Chain Worm (Shai-Hulud Lineage)
Root cause: Compromised legitimate maintainer GitHub/npm credentials allow automated republication of packages containing install-time execution (preinstall scripts or binding.gyp / node-gyp abuse). Mechanism: Payload harvests broad credential classes (npm, GitHub, cloud, Kubernetes, SSH, CI secrets), then uses stolen tokens to infect additional packages under the same or related maintainers, achieving worm-like spread within hours. Valid SLSA provenance is generated because the build runs through legitimate workflows.
Blast radius: Packages present in a large percentage of cloud and enterprise environments; any npm install of an affected version executes the stealer before application code runs. Propagation risk is extreme because downstream transitive dependencies amplify reach.
Veracode Control Point: Package Firewall blocks known-malicious and high-risk packages at the point of ingestion; SCA continuously scans dependency trees and flags the specific versions; SSCI supplies proprietary threat-feed context that elevates these packages above generic CVE scoring for immediate policy enforcement.
Recent KEV Unauthenticated RCEs (LoadMaster, TeamCity, Langflow)
Root cause: Insufficient input sanitization or deserialization of untrusted data on management/agent endpoints with no authentication required. Mechanism: Network-reachable crafted requests yield full code execution or admin takeover. Blast radius: Internet-exposed instances (common for these products) become immediate footholds for ransomware or data theft.
Veracode Control Point: Risk Manager ingests KEV status and applies elevated priority scoring with due-date context; EASM discovers external exposure of the affected products so remediation can be forced on the highest-risk assets first.
Ransomware & Dark-Web Signals
Root cause: Combination of appliance zero-days / incomplete patches plus social engineering (Teams vishing) and ready-made RaaS tooling. Mechanism: Initial access → credential dumping → rapid encryption or data exfiltration to leak sites. Dark-web secondary reporting confirms elevated leak-site postings and stealer-log circulation, increasing the value of any compromised credentials.
Veracode Control Point: Risk Manager unifies KEV and dark-web-informed urgency into a single prioritized queue; Policy Management enforces consistent blocking and remediation SLAs across SCA, SAST, and container findings.
Daily Threat Intel Brief | LinkedIn
Daily curated threats with CVSS context and actionable AppSec recommendations for security leaders.
https://www.linkedin.com/newsletters/daily-threat-intel-brief-7466482445257723904/
.png){kind=logo}
Broader Signals
Volume of new KEV entries in the last 7–14 days remains elevated. Supply-chain worm activity continues the 2026 pattern of automated, provenance-preserving package poisoning. Ransomware shows continued fragmentation with multiple new or rebranded groups posting victims. Zero-day signals are concentrated in enterprise management and CI/CD tooling rather than pure browser/OS zero-days in the immediate 48-hour window. Dark-web OSINT secondary reporting indicates sustained credential-dump and ransomware-leak activity without evidence of a single dominant new zero-day sale.
Veracode Tool Reference with Links
Veracode Recommendations
Malicious Packages & Supply Chain Worms
Threat: Active Shai-Hulud / Miasma npm worm.
Why the tool fits: Package Firewall + SCA + SSCI is purpose-built to detect and block malicious packages, including those with valid provenance and install-time execution.
Customer action: Enable Package Firewall blocking for the affected package families and enable SSCI threat-feed enrichment; run an immediate SCA scan of all npm lockfiles updated since 2026-08-03.
Tool: Package Firewall + SCA + SSCI
New/KEV CVEs
Threats: CVE-2026-8037, CVE-2026-63077, CVE-2026-9198, N-able pair, Tomcat.
Why the tool fits: Risk Manager elevates KEV items with due-date and exploit-status context for unified prioritization.
Customer action: Import or refresh KEV catalog in Risk Manager and force top-priority remediation tickets for any assets matching these products.
Tool: Risk Manager (KEV)
Web/Runtime Exploits & External Attack Surface
Threats: Langflow, TeamCity, LoadMaster, FortiClient EMS, Tomcat.
Why the tool fits: EASM discovers internet-facing instances; DAST validates runtime exposure.
Customer action: Run EASM discovery focused on the product signatures and schedule DAST against any confirmed exposed management interfaces.
Tool: EASM + DAST + Risk Manager
Custom Code & Containers
Threat: Potential downstream impact from poisoned dependencies or container images containing affected packages.
Why the tool fits: SAST + Fix for any custom code interacting with the compromised libraries; Container Security for image scanning.
Customer action: Trigger SCA + Container Security scans on build pipelines and apply Veracode Fix suggestions where custom code is implicated.
Tool: SAST + Fix + Container Security
Governance & Dark-Web-Informed Prioritization
Threat: Elevated ransomware and credential-theft activity.
Why the tool fits: Policy Management enforces consistent blocking and SLA rules; Risk Manager incorporates urgency signals.
Customer action: Update Policy Management rules to auto-fail builds containing known-malicious packages and to require Risk Manager KEV review within 24 hours.
Tool: Policy Management + Risk Manager
Prioritized Action Plan (SMART, Executable Today)
This report is provided for informational purposes only and is not intended as legal, technical, or professional advice. While we strive for accuracy, Veracode does not warrant the completeness or accuracy of the information. Recipients should not rely solely on this report and must conduct their own thorough investigation and verification. Please work with your internal teams and relevant stakeholders to properly assess, implement, and remediate any identified threats or vulnerabilities. The information has been compiled from multiple sources, and Veracode assumes no liability for any errors, omissions, or actions taken based on this content.