Product
high
advisory
Google Security Updates — July 2026
5 CVEs 41 IOCsRoundup of Google security advisories published in July 2026.
golang.org/x/crypto/ssh +74
roundup
5c
41i
updated
high
advisory
Compromised node-ipc npm Package Steals Credentials
2 rules 3 TTPs 2 IOCsHackers injected credential-stealing malware into newly published versions of the node-ipc npm package in a supply chain attack, collecting cloud credentials, SSH keys, CI/CD secrets, and other sensitive data, exfiltrating it through DNS TXT queries.
node-ipc +10
supply-chain-attack
npm
infostealer
credential-theft
2r
3t
2i
critical
advisory
Compromised intercom-client npm Package Exfiltrates Credentials
2 rules 2 TTPsA compromised version (7.0.4) of the intercom-client npm package was published using a compromised developer account, containing obfuscated JavaScript that executed during installation to harvest and exfiltrate credentials from the environment, as part of the 'Mini Shai-Hulud' supply chain campaign.
intercom-client +5
supply-chain
credential-theft
npm
2r
2t