#javascript
-
953 Online Stores Hit by JavaScript That Hides From Scanners
Since July 2025 an unknown group has planted a malicious loader in Magento stores — code that tells real shoppers apart from security scanners and only serves its payload to live visitors.
-
Pele: Mermaid Diagrams as Themeable SVG
Pele is a lightweight open-source library that turns Mermaid text into SVG and lets you recolor diagrams through CSS variables — with no re-rendering.
-
OpenCode 2.0: an agent that drives its own interface
A major overhaul of the open-source AI coding assistant is out. A background service, a rewritten API, Code Mode and background tasks turn OpenCode into a system the agent can operate on its own.
-
The biggest redesign in decades: example.com now speaks six languages
On 28 September 2026 the reserved domain example.com gained multi-language support for the first time. DebugBear breaks down the update and traces the page's twenty-plus-year history.
-
A userscript that renames the “vibecoding” tag to “llms” on Lobsters
A tiny userscript on Greasy Fork rewrites the vibecoding tag on the Lobsters aggregator into the more neutral llms.
-
JSCeal: Crypto Malware Hijacks Google Sessions and Spoofs Exchange Traffic
Researchers at Check Point have dissected JSCeal — a compiled JavaScript malware that steals browser cookies, bypasses Google authentication, and tampers with crypto-exchange traffic.
-
Htmx 4.0.0: Explicit Attribute Inheritance, Morph Swaps and the Move to fetch()
The htmx team has shipped the fourth major version of the popular library. On the surface it looks almost identical to htmx 2, but under the hood it has been reworked — from events and attribute inheritance to the networking layer.
-
Spectre Returns: An Attack on Cloudflare Workers Siphons Off JWTs at 12 Bits per Second
Researchers have demonstrated a remote Spectre attack against Cloudflare Workers, extracting a JSON Web Token from a neighboring Worker in production — 360 times faster than the 2021 demonstration.
-
From Schema Name to RCE: Dissecting CVE-2026-33696 in n8n
Researcher Simon Köck describes how the innocuous “Custom Fields” option in the GSuiteAdmin node of the n8n automation platform turns into remote code execution through prototype pollution.
-
Weak Random Number Generator in CryptoJS Led to $5.7M in Crypto Wallet Thefts
The firm Coinspect has determined that the source of a string of crypto wallet thefts was the CryptoJS.lib.WordArray.random() function, which produced predictable seed phrases. Five applications were affected, and measured losses topped $5.7 million.
-
The Adform Breach: A Swapped Script Rewrote Crypto Wallets on Clients' Sites
Attackers altered a JavaScript file belonging to the Adform advertising platform, turning it into an in-browser tool for swapping crypto wallet addresses. The incident affected sites that used the shared tracking script.
-
Malware Built Right in the Browser: How the SourTrade Campaign Works
Researchers at Confiant have described a large-scale advertising campaign in which malicious JavaScript makes the victim's browser “assemble” the malware from separate components on its own, right in memory.
-
148 npm Packages Turned Students' Browsers into a DDoS Botnet
JFrog researchers uncovered a campaign of 148 npm packages disguised as student web proxies that, for about two weeks in May, turned visitors' browsers into nodes of a DDoS botnet.
-
Chromium 148: Math.tanh Becomes a New Tool for OS Fingerprinting
Starting with Chromium 148, the results of the browser's Math.tanh computation differ depending on the operating system, allowing websites to determine a user's OS even without explicit headers or APIs.
-
Ant, a New JavaScript Runtime, Debuts on Hacker News
Developers have posted Ant on Hacker News — a JavaScript runtime along with an accompanying ecosystem of tools. The submission has already drawn notable attention from the community.
-
Compromised jscrambler npm package installed a Rust infostealer
Version 8.14.0 of the popular npm package jscrambler turned out to be compromised: when installed, it launched a malicious binary that stole data. The incident was spotted just six minutes after publication.
-
The World Map in 500 Bytes: ASCII Art Powered by Deflate Compression
Using the AI tool Codex, developer Iwo Kadziela built a compact ASCII renderer of the world map weighing in at just 445 bytes. The secret lies in deflate compression and a clever use of fetch().