The 5-Minute Cyber Brief
Good morning. Here are the cybersecurity developments most likely to matter to your day.
Lead Story
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
On August 4 an attacker pushed malicious commits to the repositories behind the keyv, cacheable and ecto npm packages, and Datadog says the self-propagating payload (“ChainDrop”) has reached hundreds of packages. It steals CI and cloud secrets and plants .vscode/tasks.json and .claude/settings.json hooks.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: Packages with very large download counts were hit, and the editor hooks can reinfect a laptop after cleanup.
Recommended action: Check lockfiles for the listed versions, remove unexpected hook files, and rotate npm, GitHub and cloud tokens on affected machines.
Read more on CyberExperts: Read more on CyberExperts
Original source: The Hacker News
Also Worth Your Attention
TP-Link patches Omada ZTP flaws allowing hackers to breach networks
TP-Link patched 15 flaws that Forescout found in Omada zero-touch provisioning, including hard-coded keys and certificates and weak credential protection during adoption. Chained with CVE-2025-7850 and CVE-2025-7851, they allow network intrusion and code execution.
Why it matters: Controllers, gateways, switches, access points, OLTs, cloud services and apps are all affected, so this is a fleet-wide update.
Recommended action: Update every Omada component and app, rotate site and TP-Link ID credentials, and enable MFA.
Read more on CyberExperts: Read more on CyberExperts
CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
CISA reports a significant rise in attacks on internet-exposed PLCs at water utilities, where actors changed passwords and IP addresses to lock operators out, causing boil-water notices. The FBI and EPA say utilities in at least seven states reported incidents since July 27, involving Rockwell MicroLogix 1100 and 1400 PLCs.
Why it matters: Undocumented cellular modems installed by vendors or integrators are part of the exposure.
Recommended action: Take PLCs off the internet, change default passwords, allowlist engineering hosts and keep a known-clean PLC backup.
Read more on CyberExperts: Read more on CyberExperts
128 Seconds to disruption: Microsoft Defender stops ransomware at QNET
Microsoft says Defender’s attack disruption now isolates compromised devices automatically. At QNET it cut off an mshta-based attack 128 seconds after detection, before the second stage arrived.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Why it matters: Automatic isolation trades a brief user outage for stopping spread.
Recommended action: Check whether attack disruption is enabled in your tenant and agree how isolated users get help.
Read more on CyberExperts: Read more on CyberExperts
DOUBLECUP Uses ClickFix and Cached PNGs to Deliver CountLoader and DeviceManager RAT
SOCRadar describes DOUBLECUP, a Russian loader service that uses ClickFix lures on fake CRM login pages (NetSuite, Odoo, HubSpot, Salesforce) to hide payloads in PNG images in the browser cache. It delivers CountLoader for Windows and macOS and a new RAT, DeviceManager, which finds its C2 through blockchain smart contracts.
Why it matters: The final payload is decrypted with the victim’s public IP address as the key, tying it to the victim’s machine.
Recommended action: Alert on browsers or the Run dialog spawning findstr, certutil or PowerShell against cache folders.
Read more on CyberExperts: Read more on CyberExperts
Go Deeper
Editorial Promise
CyberExperts should help you get the signal fast, understand what actually matters, and know where to go deeper before the day gets noisy.
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Monday’s brief: GlobalProtect logins without passwords, then SonicWall, AhsayCBS and NetScaler
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
