Cyber Security News

Hacking Editorial Brief — August 6, 2026

Supply Chain Worm Compromises Hundreds of npm Packages

A threat actor successfully compromised hundreds of npm packages, including the widely-used 'keyv' library with over 150 million weekly downloads, deploying a self-propagating backdoor worm across the JavaScript ecosystem. According to Datadog Security Labs analysis, the attack represents a significant supply chain compromise affecting numerous downstream dependencies. The worm's self-spreading mechanism allows it to automatically infect additional packages, amplifying the campaign's reach beyond the initial compromise vector. The incident underscores persistent vulnerabilities in package repository security and dependency chain integrity, with the scale of affected installations potentially reaching millions of applications relying on compromised packages.

Iranian Threat Actors Target U.S. Water Infrastructure

Multiple U.S. municipal water systems came under cyberattack over the past week in a coordinated campaign officials attribute to Iranian threat actors. The FBI and Environmental Protection Agency issued joint warnings to critical infrastructure operators following confirmed intrusions affecting facilities in New Jersey and other states. The attacks targeted operational technology systems used to manage water treatment and distribution, raising concerns about potential disruption to public utilities. The campaign follows established patterns of Iranian-linked threat activity against U.S. critical infrastructure, though authorities have not disclosed specific technical details of the intrusion methods or whether any systems experienced operational impacts. Separately, Canadian authorities disclosed that a Kitchener resident pleaded guilty to charges related to a 2021 breach of a U.S. cloud services provider that compromised data on over 165 million customers, facing up to 30 years in federal prison for participation in the international hacking conspiracy.

Sources: Datadog Security Labs · 6ABC · Philadelphia Inquirer · CityNews Kitchener