javascript news
3 stories
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
A significant security vulnerability has been identified in the isolated-vm Node.js library, which could allow sandboxed JavaScript code to escape its intended isolation and potentially achieve arbitrary code execution on the host system. The flaw specifically impacts the ExternalCopy component of the library.
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Advertising technology firm Adform has reported a supply chain attack involving the compromise of a JavaScript file, leading to the alteration of cryptocurrency wallet addresses displayed on client websites. The malicious code was designed to replace legitimate wallet addresses with attacker-controlled ones, primarily targeting user interactions such as copying an address or submitting forms.…
Phishing Campaign Deploys JavaScript-Driven PureLogs Variant to Steal Sensitive Data
A recent phishing campaign is distributing a variant of the PureLogs malware, designed to steal sensitive data from compromised Windows systems. The campaign employs a multi-stage attack chain involving obfuscated JavaScript, PowerShell, and process hollowing techniques.