Malicious npm Package Turns Hugging Face Into Malware CDN and Exfiltration Backend
A rogue npm package named js-logger-pack has been caught quietly turning Hugging Face, a widely trusted AI model hosting platform,
CYBERSECURITY INTELLIGENCE
News that matters, without the noise.
Search current cybersecurity reporting locally in this app. Search terms are not sent to AdvisoryLoom. The Professional plan adds Watchlists, structured My Intelligence, and AI briefings.
Private search: the term stays in this browser and is matched against a generic content feed.LATEST COVERAGE
Latest cybersecurity news
Bitwarden CLI npm package compromised to steal developer credentials
The Bitwarden CLI was briefly compromised after attackers uploaded a malicious @bitwarden/cli package to npm containing a credential-stealing
AI-Assisted Lazarus Campaign Targets Developers With Backdoored Coding Challenges
A North Korean state-sponsored threat group is running an active campaign that tricks software developers into installing malware
Trigona ransomware attacks use custom exfiltration tool to steal data
Recently observed Trigona ransomware attacks are using a custom, command-line tool to steal data from compromised environments faster
3 sources
AL25-012 – Vulnerabilities impacting Cisco ASA and FTD devices – CVE-2025-20333, CVE-2025-20362 and CVE-2025-20363 – Update 1
<article data-history-node-id="6833" about="/en/alerts-advisories/al25-012-vulnerabilities-impacting-cisco-asa-ftd-devices-cve-2025-20333-cve-2025-20362-cve-2025-20363" class="cccs-threats full clearfix"> <div class="content"> <div class="layout layout–onecol"> <div class="layout__region layout__region–content"> <div data-block-plugin-id="extra_field_block:node:cccs_threats:links" class="block block-layout-builder
Connected reporting, one intelligence threadcyber.gc.ca · cybersecuritynews.com · sec.cloudapps.cisco.com
2 sources
UNC6692 Impersonates IT Helpdesk via Microsoft Teams to Deploy SNOW Malware
A previously undocumented threat activity cluster known as UNC6692 has been observed leveraging social engineering tactics via Microsoft
Connected reporting, one intelligence threadthehackernews.com · bleepingcomputer.com
USN-8206-1: OpenMPT vulnerability
Antonio Morales Maldonado discovered that OpenMPT did not properly limit the length of strings in certain cases, leading
RHSA-2026:10169: Important: rhc-worker-playbook security update
An update for rhc-worker-playbook is now available for Red Hat Enterprise Linux 10. Red Hat Product Security has