Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

On August 28, 2026, ten malicious versions of @7nohe/openapi-react-query-codegen were published to npm between 20:00 and 20:21 UTC. The package generates React Query hooks from an OpenAPI schema and draws roughly 150,000 weekly downloads. The latest tag pointed at the malicious 3.0.4 for the duration of the window. Eight of the ten releases carry a multi-stage loader that reaches for cloud, registry, and developer credentials. The attacker needed no stolen npm token and no hijacked maintainer account.

A prompt injection test suite can only report on the payloads it contains. That sentence is the whole problem with the number most teams have. Somewhere in a ticket there is a scan result: a scanner threw several hundred probes at the endpoint and a percentage got through. The percentage is real.

Prompt injection has a CWE, and the two incidents everyone cites were not filed under it. That is not a clerical detail. A CWE ID is a claim about root cause, and every entry carries a mitigation table that follows from the root cause it names. When a record says CWE-1427, it is saying the product failed to neutralise input before building a prompt, and it is implying that neutralising the input is the fix.

Five worthy reads is a regular column on five noteworthy items we’ve discovered while researching trending and timeless topics. This week, we explore the convergence of software asset management (SAM), SaaS, and FinOps.

For most of the history of the FedRAMP program, it has been more or less isolated. Despite sharing much of the same cybersecurity DNA with other frameworks, like CMMC and ISO 27001, no formal reciprocity ever came into being.

We log into dozens of apps every day. Each one asks for a password, and some eventually force a password reset. Passwords create friction for users and risk for businesses because attackers can steal, reuse, or phish them. Passwordless authentication replaces this weak point with stronger ways to verify identity. A passkey, biometric scan, security key, or badge tap gives users another way to prove who they are.

Access is just one part of security. What a privileged account does after logging in is equally important. Credentials can be compromised. Once inside, attackers move laterally, escalate privileges, and exfiltrate sensitive data without raising an alarm. Traditional network defenses like firewalls and VPNs are no longer reliable. VPNs grant broad network-level access, giving users a direct pipe into your core infrastructure.

Netwrix formed a dedicated in-house Security Research team on July 15, 2025, led by Huy Kha, Director of Security Research. The team includes Senior Staff Security Researcher Darryl Baker, a recognized authority on Active Directory and identity security. They research identity, data security, AI, and cloud threats, with the goal of translating security research into practical improvements across Netwrix's product portfolio.

Brand Impersonation protection software should do more than find and remove impersonating assets. Buyers should also examine what a platform helps their organization understand and do about the customer and business risk created while the campaign remains active. The Anti-Phishing Working Group recorded 971,181 phishing attacks in Q1 2026, up 13.8% from the previous quarter. Across monitored social platforms, impersonation accounted for 43.8% of threats. Takedown is necessary.

Most security leaders believe their API attack surface is covered. A Web Application Firewall (WAF) sits in front of the application. An API gateway manages authentication, rate limiting, and schema validation. Some teams add a bot management layer on top. This looks like defense in depth. In practice, it repeats the same layer, the perimeter, multiple times. Most API breaches do not start with a WAF bypass.