#JavaScript
All CosmicBytez Labs articles tagged #JavaScript, across news, security advisories, how-to guides, and projects.
- Security
CVE-2026-108551: Code Injection in openapi-typescript-codegen Risks Supply Chain Compromise
A flaw in openapi-typescript-codegen lets malicious OpenAPI documents inject JavaScript into generated API clients, risking RCE.
- Security
CVE-2026-85061: MapLibre GL JS DOM Sanitizer Bypass Enables Stored XSS
A live-collection iteration bug in MapLibre GL JS's DOM.sanitize() lets attacker-supplied attribution strings smuggle an event handler past sanitization.
- News
Isolated-vm Flaw Lets Sandboxed JavaScript Escape to Host for Potential RCE
A critical unpatched flaw in isolated-vm allows sandboxed JavaScript code to escape its isolated environment and achieve host-level remote code execution.
- Security
Critical Deserialization Flaw in Seroval JS Library (CVE-2026-59940)
Seroval < 1.5.3 allows attacker-controlled JSON Promise nodes to bypass reference validation in fromJSON(), enabling object forgery. CVSS 9.8.
- News
CryptoJS Weak RNG Behind $5.7 Million in Drains Affects Five Crypto Wallet Apps
Security firm Coinspect has identified CryptoJS.lib.WordArray.random() — a 12-year-old weak random number generator — as the root cause behind the Ill...
- News
Massive ChainDrop npm Supply Chain Attack Infects Hundreds of Packages
The ChainDrop worm — a larger descendant of the earlier Shai-Hulud attack — has compromised over 1,300 npm packages with a combined 2 billion monthly...
- News
Online Ad Firm Adform's Script Compromised to Steal Cryptocurrency
Online advertising firm Adform suffered a supply-chain attack — a third party compromised Adform's JavaScript ad delivery script to inject...
- News
Hackers Poison Adform Script to Swap Crypto Wallet Addresses Across Customer Sites
Attackers compromised a JavaScript file served by ad tech company Adform, turning it into a browser-side tool that silently rewrites cryptocurrency wallet...
- News
SourTrade: Malicious Sites Use JavaScript to Assemble Malware Directly in Browser Memory
The SourTrade malvertising campaign impersonates Solana, Luno, and TradingView to deliver malware assembled entirely inside browser memory using...
- Security
CVE-2026-12866: expr-eval npm Package Enables Arbitrary Code Execution via toJSFunction()
All versions of the expr-eval JavaScript package are vulnerable to remote code execution through the toJSFunction() API. Crafted expressions escape the...
- Security
CVE-2026-44488: Axios Fetch Adapter Ignores Configured Request and Response Size Limits
Axios versions 1.7.0 through 1.15.x fail to enforce maxContentLength and maxBodyLength when using the fetch adapter, allowing unbounded request and...
- News
Suspicious Polyfill Login Prompts Pop Up on Toshiba, Muji Websites
Tech giant Toshiba and mega-retailer Muji have warned visitors that suspicious sign-in screens appearing on their websites could be harvesting credentials — a…
- News
New npm Supply Chain Attack Self-Spreads to Steal Developer
A newly discovered supply chain attack targeting the npm ecosystem steals developer authentication tokens and uses compromised accounts to publish...
- News
Critical Flaw in protobuf.js Library Enables JavaScript
A critical remote code execution vulnerability in protobuf.js, the widely used JavaScript implementation of Google's Protocol Buffers, has been disclosed...
- News
AppsFlyer Web SDK Supply Chain Attack Spread
Attackers hijacked AppsFlyer's CDN domain via a registrar incident, serving a sophisticated 170 KB crypto-stealing JavaScript payload to every site...
- HOWTO
Building PWAs with IndexedDB for Offline Data
Implement offline data persistence in Progressive Web Apps using IndexedDB. Covers database abstraction, CRUD operations, migration strategies, and sync...
- News
Supply Chain Attack Discovered in Popular NPM Packages
Security researchers have discovered malicious code injected into several popular NPM packages with millions of weekly downloads. Developers urged to...