2026-07-29
- threat intel
Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js
Two beta versions of npm packages in the @joyfill namespace were compromised to distribute a remote access trojan tied to the DEV#POPPER malware family. The affected packages execute encrypted malicious code upon import into Node.js applications. The compromise demonstrates ongoing supply chain risks in public package repositories.
Why it matters: Developers using @joyfill/layouts@0.1.2-2773.beta.0 or @joyfill/components@4.0.0-rc24-2773-beta.4 need to audit their projects immediately and remove these versions to prevent RAT installation in their build environments and production systems.
- threat intel
Android malware detection collapses when the context stage comes out
Researchers evaluated six Android malware detection systems, including machine learning and LLM-based models such as Drebin, MalScan, MaskDroid, and LAMD, and found they flagged more than half of benign apps from Google Play as malicious based on requested permissions. The findings reveal significant false positive rates across detectors widely used in security research, with LAMD performing particularly poorly.
Why it matters: Security teams and researchers relying on these automated Android malware detectors for analysis or threat hunting should expect substantial false positive rates and reassess confidence in flagged samples, as legitimate apps requesting normal permissions are frequently misclassified as threats.
- research
Measuring LLMs’ Ability to Perform Cryptanalysis
Anthropic and collaborators released CryptanalysisBench, a benchmark of 191 cryptanalytic tasks spanning historical and modern cryptographic primitives, to measure large language models' ability to discover mathematical attacks. Five frontier models successfully broke 65-86% of known vulnerable schemes and discovered novel attacks, including a key-recovery vulnerability in the SpoC AEAD cipher and an error in KINDI's security proof, neither previously known.
Why it matters: Security practitioners and cryptography teams need to monitor AI progress in cryptanalysis as a potential long-term threat to cryptographic systems currently used in production, particularly as models demonstrate capability to find previously unknown vulnerabilities in standardized algorithms.