NPM Supply Chain Compromise, cPanel Root RCE, AWS Pathfinding Labs

Today's Highlights

A major npm supply chain attack compromised over 300 packages, while a critical cPanel CVE-2026-29205 allows pre-auth root file reads. Simultaneously, new AWS Pathfinding Labs offer hands-on training for cloud vulnerability exploitation and defense.

314 npm packages just got compromised, 271 @antv, echarts-for-react, size-sensor, timeago.js (r/cybersecurity)

Source: https://reddit.com/r/cybersecurity/comments/1thcbcf/314_npm_packages_just_got_compromised_271_antv/

This item details a significant and widespread supply chain attack that recently hit the npm ecosystem, impacting 314 distinct packages. The attack originated from the compromise of a maintainer's account associated with the atool project, which was then used to push malicious versions across a vast array of popular packages. Affected libraries include @antv, echarts-for-react, size-sensor, and timeago.js, all widely used in web development projects. The malicious code injected into these packages is designed to exfiltrate sensitive developer credentials and environment variables, specifically targeting AWS keys, GitHub tokens, and other critical secrets from compromised build environments or individual developer machines. This incident underscores the profound and persistent risk posed by account compromises within package repositories, highlighting the urgent need for enhanced security measures.

Developers are strongly advised to meticulously review their project dependencies, particularly if they utilize any of the listed affected packages, to ensure no compromised versions are present in their dependency trees. This attack serves as a stark reminder of the critical importance of implementing robust supply chain security practices. These include mandatory multi-factor authentication for all package maintainers, rigorous automated scanning of dependencies for known malicious code or suspicious behavior, and strict access controls on development and deployment environments. Organizations should also consider adopting policies for regular credential rotation and adhering to the principle of least privilege, minimizing the scope of permissions granted to automated build systems and development tools. Proactive vigilance and layered defense are paramount in mitigating such sophisticated supply chain threats.

Comment: This is a classic supply chain attack scenario. Always verify package integrity and implement strong MFA on package manager accounts. Use tools to scan your node_modules for known malicious versions.

New Age of Collisions: Reading Arbitrary Files Pre-Auth as root in cPanel (CVE-2026-29205) (r/netsec)

Source: https://reddit.com/r/netsec/comments/1th9bpu/new_age_of_collisions_reading_arbitrary_files/

A critical vulnerability, CVE-2026-29205, has been disclosed in cPanel, allowing for pre-authenticated arbitrary file reading with root privileges. Dubbed "New Age of Collisions," this flaw could enable attackers to read sensitive configuration files, authentication tokens, or even private keys from affected cPanel installations without needing any prior authentication. The impact is severe, as access to such files could lead to full system compromise, data exfiltration, or further lateral movement within a network. This vulnerability poses a significant risk to the vast number of web hosting providers and individual users who rely on cPanel for server management.

The technical write-up details how specific file collision techniques can be leveraged to exploit a weakness in cPanel's handling of certain requests, bypassing authentication mechanisms and achieving high-privilege file access. Users running cPanel are strongly advised to apply patches immediately as they become available and to monitor their systems for any signs of compromise. Furthermore, hardening measures such as restricting network access to cPanel interfaces and implementing intrusion detection systems are crucial to mitigate the risks associated with such critical vulnerabilities.

Comment: A pre-auth root file read in cPanel is as bad as it sounds. Patch immediately, and audit your cPanel deployments for suspicious activity.

Pathfinding Labs: Deploy, test, and learn from 100+ intentionally vulnerable AWS environments (r/netsec)

Source: https://reddit.com/r/netsec/comments/1thjpl5/pathfinding_labs_deploy_test_and_learn_from_100/

Pathfinding Labs offers a unique and highly practical resource for cybersecurity professionals and developers seeking to deepen their understanding of AWS cloud security. This platform allows users to deploy, test, and learn from over 100 intentionally vulnerable AWS environments. Each lab is designed to simulate real-world misconfigurations and common vulnerabilities, covering areas like IAM privilege escalation, S3 bucket misconfigurations, vulnerable Lambda functions, and insecure network configurations. It's an invaluable tool for hands-on practice, allowing users to safely experiment with attack techniques and understand their impact in a controlled environment.

The labs are structured to support a comprehensive learning experience, from identifying initial access vectors to achieving full compromise and exploring remediation strategies. This directly addresses the need for practical hardening guides and defensive techniques in cloud environments. By providing a sandbox for exploitation and defense, Pathfinding Labs empowers users to build practical skills in identifying, exploiting, and securing common AWS vulnerabilities, making it an essential resource for anyone involved in cloud security.

Comment: This is a fantastic resource for anyone wanting to get hands-on with AWS security. Spin up a lab, break it, fix it – the best way to learn practical cloud hardening.