Vulnerabilities
1,500 npm packages spared takeover as GitHub expires unvalidated publishing configs in 48 hours
A validation gap in npm’s automated publishing feature allowed attackers to hijack packages by reclaiming old GitHub repository names.
npm
Everything Patch Herald has reported about npm: 3 stories, newest first. Part of our Vulnerabilities coverage.
Vulnerabilities
CVE-2026-106446: Update Handlebars to 4.7.10 to Block Critical RCE via Template Data Injection
A critical remote code execution vulnerability in Handlebars allows attackers to inject malicious JavaScript via manipulated template data, requiring an immediate update to version 4.7.10.
Vulnerabilities
9.3 CVSS: CVE-2026-107699 RCE in ppt2png 0.0.6 Node.js apps via shell metacharacter injection in path args
A critical flaw in the ppt2png tool lets attackers run system commands by manipulating file path inputs, posing a severe risk to Node.js applications.