7 Aug 2026
Week in review
Greetings,
A major new software supply chain attack has highlighted the growing risks facing organisations that rely on open source code. Researchers have uncovered a self-propagating malware campaign, dubbed ChainDrop, which has compromised more than 1,300 packages in the Node Package Manager (npm) ecosystem, affecting packages that collectively receive around two billion downloads each month.
The attack reportedly began when a threat actor gained access to the GitHub account of the maintainer behind several widely used caching libraries, including Keyv and Cacheable. From there, the malware spread through interconnected projects, ultimately impacting packages associated with a range of technology vendors and organisations.
What makes ChainDrop particularly concerning is its ability to spread automatically. Malicious code was inserted into legitimate software packages and published through trusted GitHub Actions workflows, allowing the compromised releases to appear authentic. Once an affected package was installed, a hidden pre-installation script executed automatically, downloading additional components and launching an information-stealing payload.
According to security researchers, the malware is designed to collect a wide range of sensitive information, including GitHub and npm access tokens, cloud credentials, Kubernetes secrets, database credentials, and keys for services such as AWS, Azure and Google Cloud. The stolen data is then encrypted and exfiltrated, while the malware searches for new opportunities to compromise additional repositories and packages.
Security experts warn that any developer workstation or CI/CD environment that installed an affected package should be considered compromised. Recommended response measures include rebuilding impacted systems, rotating exposed credentials, reviewing repositories for unauthorised changes, and strengthening dependency management controls. As investigations continue, the number of affected packages may grow, reinforcing the importance of ongoing vigilance across the software supply chain.
Attackers Exploit N-able Patch Bypass Flaw on RMM Servers
Date: 2026-08-04
Author: Dark Reading
N-able recently disclosed that a threat actor targeted its N-central product through a patch bypass vulnerability and used the flaw to gain access to customer environments.
The company, which sells security and IT management tools to managed service providers (MSPs) and internal IT teams, disclosed active exploitation over the weekend.
Rails patches critical Active Storage flaw with RCE potential
Date: 2026-08-01
Author: Bleeping Computer
[See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0171.2]
A critical vulnerability in the Active Storage framework can allow an unauthenticated attacker to read arbitrary files from a Rails application, and potentially escalate to remote code execution (RCE).
Rails is a popular open-source web application framework written in Ruby for building websites and web apps. It uses the built-in Rails component Active Storage for handling file uploads and attachments.
Rails maintainers published an advisory about the CVE-2026-66066 flaw, which received a critical severity rating.
Massive ChainDrop npm supply-chain attack infects hundreds of packages
Date: 2026-08-04
Author: Bleeping Computer
[See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ASB-2026.0172]
Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry.
Infected packages include very popular ones such as Keyv and Cacheable, flat-cache and file-entry-cache, all caching utilities from the same maintainer.
The supply-chain attack started after the threat actor compromised the GitHub account of Keyv’s maintainer, and quickly spread to packages associated with major organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.
Adobe Campaign Classic CVSS 10.0 Flaw Could Run Code Without User Interaction
Date: 2026-08-01
Author: The Hacker News
[See AUSCERT bulletin https://portal.auscert.org.au/bulletins/ESB-2026.8857]
Adobe has released security updates to address a maximum-severity security flaw in Campaign Classic (ACC), its enterprise-focused marketing automation platform, that could result in arbitrary code execution.
The vulnerability, tracked as CVE-2026-48449, carries a severity score of 10.0 on the CVSS scoring system.
It has been described as a case of incorrect authorization that could result in arbitrary code execution in the context of the current user without requiring any user interaction.
The update also resolves another high-severity flaw (CVE-2026-48448, CVSS score: 8.6) stemming from SQL injection that could pave the way for arbitrary file reads.
New Attack Methods Enable Malware to Hijack Passkey-Protected Accounts
Date: 2026-08-05
Author: Security Week
The new attack methods, named ‘Pass-ta-key’ by Palo Alto Networks, focus on Google-synced passkeys. The security firm’s researchers showed how a threat actor could use the techniques to take over accounts without needing privilege escalation or user interaction.
In a Pass-ta-key attack, malware already present on a Windows machine running Chrome can examine the browser’s local synchronization database to identify which online accounts the user has protected with passkeys, along with associated usernames and encrypted credential material.
ASB-2026.0171.2 – UPDATE Ruby on Rails (Active Storage): CVSS (Max): 9.5
Ruby on Rails has released security updates to address a critical vulnerability in Active Storage that could allow an attacker to perform arbitrary file reads and potentially achieve remote code execution under vulnerable image processing configurations.
ASB-2026.0172 – npm packages: CVSS (Max): None
A large-scale npm supply chain attack, dubbed ChainDrop,
compromised hundreds of widely used npm packages.
ESB-2026.9044 – Adobe Campaign Classic: CVSS (Max): 10.0
This update addresses critical vulnerabilities that could result in arbitrary code execution and arbitrary file system read.
ESB-2026.9115 – Cisco Catalyst SD-WAN: CVSS (Max): 9.9
Cisco has released software updates that address these vulnerabilities.
Stay safe, stay patched and have a good weekend!
The AUSCERT team
