Week of September 8, 2025: Phished npm maintainer poisons popular packages, and JLR confirms data theft

What mattered to security leaders in the week of September 8, 2025? A maintainer of widely used npm packages was tricked by a fake two-factor reset email, and attackers used his account to publish malicious versions of at least 18 libraries on Monday, September 8. Two days later Jaguar Land Rover said attackers behind its production-halting intrusion had also taken data, while Akira ransomware affiliates kept getting in through SonicWall firewalls.

A fake 2FA reset email leads to malicious versions of 18 npm packages

On September 8, starting around 13:15 UTC, malicious versions of at least 18 popular npm packages, including chalk and debug, were published after their maintainer, Josh Junon, entered his credentials and a one-time code on a phishing page posing as npm. The injected code ran in browsers and redirected cryptocurrency payments to attacker wallets. The packages were pulled within hours, but together they draw more than 2 billion weekly downloads. Dependency pinning and lockfile review are the controls that limit exposure to windows like this one. (Help Net Security)

Jaguar Land Rover says "some data" was taken in its cyberattack

On September 10 Jaguar Land Rover said its investigation had found that some data was affected in the cyberattack it disclosed on September 2, and that it was informing the relevant regulators. The carmaker, which BleepingComputer says employs about 39,000 people, had shut down systems and told staff not to come in while it worked with the UK National Cyber Security Centre to restart operations. It had not named an attacker. The case is a reminder that a production outage and a data breach can be the same incident, with separate reporting clocks. (BleepingComputer)

Akira affiliates chain an old SonicWall bug with two configuration gaps

Rapid7 said on Wednesday, September 10 that it had seen more intrusions through SonicWall appliances since early August, with Akira affiliates apparently combining CVE-2024-40766, patched more than a year earlier, with a permissive default LDAP user group setting and access to the Virtual Office Portal, where they enrolled their own MFA codes on compromised accounts. Rapid7's advice: rotate passwords on SonicWall local accounts, set the default LDAP user group to none and keep the portal reachable only from trusted networks. Firewall hardening after a firmware migration is the step many teams skipped. (Help Net Security)

Plex asks users to reset passwords after a database breach

Media streaming company Plex told users on Monday, September 8 that an unauthorized party had accessed a limited subset of customer data in one of its databases, including emails, usernames, hashed passwords and authentication data. It asked everyone to reset passwords, sign out of all devices and turn on two-factor authentication, and it pushed server owners to update Plex Media Server. Plex did not say which hashing algorithm it uses. Employees who reuse a Plex password at work are the enterprise angle here. (Help Net Security)

CISA sets out how it wants to steer the CVE Program

CISA reaffirmed its support for the Common Vulnerabilities and Exposures program, whose funding had been extended only to March 2026 after a last-minute decision. The agency pledged to keep CVE data free and openly accessible and said it plans to modernize the program and broaden representation from international governments, academia and industry. Nick Andersen, Executive Assistant Director for Cybersecurity, made the case on Thursday, September 11. Vulnerability management programs built on CVE identifiers have a direct stake in how this governance settles. (Help Net Security)

September Patch Tuesday brings 80-plus Microsoft fixes, none exploited

Microsoft's September 9 release patched more than 80 vulnerabilities, none of them under active exploitation, alongside critical fixes from Adobe and SAP. Among the flagged bugs were CVE-2025-54918, a remotely exploitable Windows NTLM privilege escalation flaw, and CVE-2025-54916, a stack-based buffer overflow in NTFS that Tenable singled out for quick patching. A month without exploited Microsoft zero-days gives teams room to clear older backlog. (Help Net Security)

Exploited DELMIA Apriso flaw added to the KEV catalog

On September 11 CISA added CVE-2025-5086, a deserialization of untrusted data vulnerability in Dassault Systèmes DELMIA Apriso, to its Known Exploited Vulnerabilities catalog on evidence of active exploitation. Teams running Dassault software should confirm with the vendor which fixed release applies to them. (CISA)