Every Node.js project accumulates vulnerable dependencies. The npm registry holds over 2.5 million packages, and researchers found 454,000 malicious or vulnerable packages uploaded in 2025 alone.
Labs tracks ArcticRAT, an Android RAT that uses xAI’s Grok to mine stolen SMS for OTPs and balances, plus HVNC, fake lock ...