Loading story…
Semgrep added three JavaScript-focused rulesets to its registry—p/javascript, p/nodejs, and p/expressjs—to separate browser-side JavaScript checks from Node.js API misuse and Express framework misconfigurations. The expanded coverage includes detections for prototype pollution, bracket object injection, non-literal regular expressions, hardcoded secrets, shell command execution with shell=true, weak cryptography, TLS misconfigurations, insecure cookie settings, CORS issues, response injection, and XSS patterns. The JavaScript coverage aligns with long-standing research into prototype pollution attacks in Node.js, a class of flaws that can let attackers tamper with object inheritance and trigger unsafe application behavior.
The release comes alongside broader discussion of JavaScript static analysis tradeoffs as GitLab shifted most of its SAST analyzers from ESLint and Bandit to Semgrep. Semgrep said its approach offers easier custom rule authoring, multilingual support, and stronger CI/CD integration, while comparisons noted that ESLint can be faster and produce fewer false positives in some JavaScript cases. Semgrep also published guidance for building higher-quality custom rules, recommending iterative testing against real repositories, use of constructs such as pattern-not and pattern-either, and continuous tuning to reduce false positives and false negatives before enforcing scans in pull requests.
See real exploitation activity before you spend the cycle.
5 events from the most recent confirmed update back to the earliest known activity.
Semgrep announced three JavaScript-focused registry rulesets: an expanded p/javascript ruleset and new p/nodejs and p/expressjs rulesets. The update separated previously mixed coverage into clearer scopes for browser JavaScript, Node.js risks, and Express misconfigurations.
The authors reported submitting a merge request to GitLab's Semgrep analyzer to reduce false positives in the non-literal regular expression detection rule.
The Semgrep comparison article states that GitLab transitioned most of its SAST analyzers from ESLint and Bandit to Semgrep, marking a tooling change in GitLab's security scanning approach.
Semgrep published a methodology guide for creating and refining custom Semgrep rules, covering iterative testing, false-positive reduction, and validation across repositories.
A research paper documenting JavaScript prototype pollution attacks in Node.js was published, providing technical details on the vulnerability class referenced by later detection content.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
semgrep.dev
Open sourcesemgrep.dev
Open sourcesemgrep.dev
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
OWASP continues to classify **injection flaws** as a major application security risk, covering weaknesses such as SQL injection, command injection, and cross-site scripting that arise when untrusted input reaches interpreters without proper validation or sanitization. The guidance emphasizes separating code from data, validating input, and using safe APIs to prevent attackers from altering queries, commands, or application logic. Semgrep said its **taint mode** reached beta in `v0.70.0`, adding lightweight intra-procedural taint analysis to track sources, sanitizers, and sinks more effectively than pattern-only rules for finding injection bugs. The company highlighted use cases including Angular XSS and sandbox code injection, while also pointing developers to common SQL injection pitfalls in Django applications, where the ORM is generally safer by default but raw SQL, custom ORM expressions, and `QuerySet.extra()` can still expose applications if user input is interpolated instead of passed through parameterized queries.
Jul 24, 2026
Semgrep has enabled organization-wide enforcement requiring GitHub Actions to be pinned to full 40-character commit SHAs, expanding a supply-chain hardening effort prompted by the compromise of the `tj-actions/changed-files` action. The rollout covered about 350 repositories and addressed more than simple tag replacement, including workflows that referenced branches and transitive dependencies introduced through composite actions and reusable workflows. GitHub’s control is designed to prevent mutable references from silently changing, and the effort aligned with broader guidance around immutable releases and action integrity. The deployment used automation to find and remediate directly unpinned actions, while Renovate was used to keep pinned SHAs updated over time. Semgrep also worked through edge cases involving internal actions, reusable workflows, archived repositories, and abandoned third-party dependencies before moving from staged repository-level enforcement to an organization-wide policy. The result was a broad lock-down of GitHub Actions references intended to reduce the risk of future CI/CD supply-chain compromise.
Aug 12, 2026
Package ecosystem maintainers and security vendors highlighted new guardrails and failure modes in automated dependency workflows. npm CLI 11.x introduced **`minimumReleaseAge`**, a release “cooldown” control that blocks installation of newly published versions until they reach a configured age, aiming to reduce exposure to malicious packages that rely on rapid adoption before detection or takedown. npm also added bulk configuration for **OIDC trusted publishing**, aligning with broader efforts to harden CI-based publishing; similar release-age gating has already been implemented in other Node.js package managers (pnpm, Yarn, and Bun), though npm’s initial implementation lacks an exclusion mechanism for cases like urgent internal hotfixes. Separately, StepSecurity reported detecting a “release storm” affecting multiple Microsoft **`@types/*`** packages on npm, where dozens of semver releases were published within 24 hours with no code changes beyond repeated deprecation-version bumps—attributed to an automation loop tied to a scheduled GitHub Actions workflow in *microsoft/DefinitelyTyped-tools* (`publish-packages.yml`). In the Go ecosystem, a maintainer of widely used cryptography code criticized GitHub **Dependabot** for generating large volumes of low-signal alerts and PRs after a minor security fix, arguing the tool often flags repositories based on dependency presence rather than reachability/actual impact, creating alert fatigue and potentially reducing security; he recommended reachability-aware tooling such as *govulncheck* for Go vulnerability triage.
Jun 29, 2026