Npx is a tool tracked across 8 threat clusters and 8 intelligence report mentions on ThreatCluster. First observed March 17, 2026; most recent activity July 8, 2026.
Flowise has disclosed a critical remote code execution vulnerability, tracked as CVE-2026-56274, affecting versions prior to 3.1.2 of its Custom MCP Server feature. The flaw allows attackers to exploit multiple OS…
Obsidian Security identified a critical one-click remote code execution (RCE) vulnerability in Flowise (CVE-2026-40933), affecting self-hosted deployments. The flaw allows attackers to execute arbitrary server-side code…
A coordinated malware campaign has been uncovered involving at least 15 malicious plugins on the JetBrains Marketplace, designed to steal AI API keys from developers. These plugins, masquerading as AI coding assistants,…
A report by OX Security has identified a critical vulnerability in the Model Context Protocol (MCP) developed by Anthropic, potentially exposing over 200,000 AI servers to remote code execution. The flaw lies in the…
On May 19, 2026, GitHub announced an investigation into unauthorized access to internal repositories after a malicious Visual Studio Code extension was executed on an employee's device. The attack, attributed to the…
In 2026, the Model Context Protocol (MCP) has been identified as a significant security risk due to its unverified package management and decentralized registry ecosystem. This vulnerability allows attackers to exploit…
GitHub has released actions/checkout v7 to mitigate vulnerabilities associated with the pull_request_target workflow trigger, which has been exploited in 'pwn request' attacks. This update, announced on June 18, 2026,…
Proofpoint Threat Research has identified a vulnerability named CursorJack that exploits deeplinks in the Cursor Integrated Development Environment (IDE). This method allows attackers to potentially execute arbitrary…