⚡ Weekly Recap: Hot CVEs, npm Worm Returns, Firefox RCE, M365 Email Raid & More

Summary: The npm registry was hit a second time by a self-replicating worm dubbed "Sha1-Hulud: The Second Coming," affecting over 800 packages and 27,000 GitHub repositories and stealing API keys, cloud credentials, and npm and GitHub authentication data. GitGuardian found 294,842 secret occurrences corresponding to 33,185 unique secrets, of which 3,760 were valid as of November 27, 2025, and Trigger.dev said an engineer installing a compromised package led to credential theft and unauthorized access to its GitHub organization.
Why it matters: Thousands of the exposed secrets were still valid days after the incident, and the worm backdoored every npm package its victims maintained, so the blast radius extends to anyone who installs from those maintainers next.

Read the original at The Hacker News ↗