JavaScript Archives

Winsage

August 7, 2026

Microsoft Flags BNB Chain Malware Campaign Targeting Windows Users

Microsoft has identified a sophisticated malware campaign that uses the infrastructure of BNB Chain to spread harmful code through compromised websites. The attackers deceive visitors into executing malicious commands disguised as standard security checks, exploiting vulnerabilities in conventional website security measures. This campaign affects both businesses and individual users, utilizing ClickFix lures and EtherHiding techniques. An injected Base64-encoded JavaScript communicates with a BNB Smart Chain RPC gateway to facilitate these malicious operations.

AppWizard

July 31, 2026

Cheap Android TV Boxes Pose as Phones and Turn Owners’ Broadband Into Proxies

Bitsight's investigation revealed that inexpensive Android TV boxes are being shipped with applications that can change their hardware identity, allowing them to impersonate popular smartphone brands like Samsung and Huawei. This operation, named Fuyao, is linked to Zhejiang Fengwo IoT Technology Co., Ltd., a Chinese company established in 2019. The H96MAXV11 model was frequently reported among the affected devices. In one day, the operation received 65,957 reports from about 38,000 unique MAC addresses, with many devices misidentified as phones due to spoofed identifiers. Fengwo has also promoted over 120,000 "AI digital humans," though details on this marketing term are vague. The command-and-control server for Fuyao sends phone profiles to devices, masking their actual hardware specifications. The operation uses machine vision technology and a YOLOv8s object-detection model to identify advertisements. Bitsight documented 40 fraud tasks, 21 unique campaigns, and 166 modules across four devices. The operation's payout structure involves 144 operator-owned domains, with an estimated gross return of .25 per device daily, potentially leading to annual revenues in the millions. Attribution to Fengwo is supported by shared TLS certificate data and public patent records, although the patents do not directly address advertising. There is uncertainty about how the fraudulent apps were installed and at what point in the supply chain they were introduced. Device owners are advised to verify Play Protect certification and disconnect suspicious devices.

Tech Optimizer

July 29, 2026

After rewriting SQLite in Rust, Turso turns its sights on Postgres

Cloud database provider Turso is developing a Postgres-compatible implementation based on its SQLite-compatible database, which was created from scratch in Rust. CEO Glauber Costa believes Postgres can benefit from modernization for cloud-native applications. Turso's SQLite reimplementation, now called Turso, uses a virtual machine architecture that may eventually support other database frontends, including MySQL and Redis. The company initially forked SQLite into libSQL but later pivoted to a cloud service named Turso. They focused on a virtual machine architecture for their rewrite, which translates SQL queries into a custom bytecode language. Turso has developed a Postgres-compatible prototype named pgmicro, which aims to run existing applications with minimal modifications. The company is also working on a database-as-a-cloud service that will allow customers to use various database types on the Turso platform.

Winsage

July 27, 2026

Microsoft lays out a buffet of Windows goodies for JavaScript Developers

Microsoft has introduced "dynamic projections" that allow developers using JavaScript and TypeScript to access Windows internals more easily. The Windows Runtime API (WinRT) projection for Node.js is currently in public preview, simplifying access to Windows features without introducing new capabilities. A new single Node runtime package, dynwinrt, enables developers to generate JavaScript wrappers and TypeScript declarations for Windows features, while the winappCli package offers a command-line interface for setup and sample code. This setup utilizes Windows Metadata (winmd) to dynamically list available Windows APIs, automatically updating wrappers or declarations when API metadata changes. Developers can access various Windows functionalities, excluding UI elements, and utilize local AI capabilities for tasks such as text generation and image manipulation. Microsoft’s developments aim to align with industry trends rather than enforce a proprietary ecosystem.

Tech Optimizer

July 18, 2026

North Korea Buried Four-Stage Malware in Flag Images: Zero Antivirus Detections

North Korea's Contagious Interview hackers have been using a deceptive strategy to target developers by posing as recruiters and embedding malware in SVG files. Elastic Security Labs discovered that the attackers hid malicious payloads within HTML comment blocks of these files, allowing the malware to evade antivirus detection. At the time of the findings, no antivirus engines flagged the compromised repositories, which included trojanized GitHub repositories disguised as coding challenges. The malware executed automatically at server startup and deployed four modules: a browser credential and cryptocurrency wallet stealer, a file stealer, a remote access Trojan, and a clipboard monitor. The campaign, tracked as REF9403, is part of the ongoing Contagious Interview operation attributed to North Korea's Lazarus Group, which aims to generate revenue through cryptocurrency theft. Developers are advised to audit any projects run from unsolicited sources and to monitor specific domains associated with the attack.

Winsage

July 16, 2026

Microsoft’s July patches fix over 600 flaws, shattering last month’s record

Microsoft has released its July 2026 Patch Tuesday updates, addressing 570 new security vulnerabilities, bringing the total for the month to over 620. The cumulative count of vulnerabilities patched this year has reached 1,380, exceeding the total of 1,250 for the entire year of 2020. Over 400 vulnerabilities are related to various versions of Windows, and the Windows 10 Extended Security Update program has been extended until October 12, 2027. Notable vulnerabilities include CVE-2026-56155 in Active Directory Federation Services, which allows attackers to gain administrator rights, and several critical Remote Code Execution vulnerabilities, including CVE-2026-57092 in Hyper-V and CVE-2026-56190 in Remote Desktop Protocol. Microsoft has also patched 97 vulnerabilities in Office products, with 17 classified as critical RCE vulnerabilities, and four vulnerabilities in Exchange Server, including CVE-2026-55008. The latest Microsoft Edge update addresses 27 vulnerabilities related to Chromium, and a vulnerability in Minecraft Bedrock servers has been patched.

Winsage

July 15, 2026

LabubaRAT malware infiltrates Windows systems while posing as NVIDIA software

LabubaRAT is a newly identified Rust-based remote access tool (RAT) that disguises itself as NVIDIA software to facilitate operations on Windows systems. It establishes a reusable foothold for hands-on activity and can profile the host system, identify security tools, execute commands, transfer files, capture screenshots, and proxy network traffic. LabubaRAT retrieves its configuration at launch via command-line arguments or environment variables, allowing operators to specify parameters like the command-and-control server and API key at runtime. It maintains local state in a SQLite database and supports communication through HTTPS polling, Microsoft Edge WebView2, and DNS tunneling. The malware includes capabilities for command execution, file handling, and establishing persistence through a Windows Run registry key. The entry point for the attack is an executable named nvidia-sysruntime.exe, which masquerades as NVIDIA’s container runtime toolkit. LabubaRAT conducts thorough profiling of the host, checking for installed browsers and security products, and gathers information on the system's specifications. Blackpoint Cyber has shared indicators of compromise to help detect LabubaRAT activity.

TrendTechie

July 10, 2026

Выпуск qBittorrent 5.2.3

qBittorrent 5.2.3 was released on July 7, 2026. It is an open-source torrent client developed using the Qt toolkit, available for Linux, Windows, and macOS under the GPLv2+ license. The project began with version 4.0 in November 2017, followed by versions 5.0 in September 2024, 5.1 in April 2025, and 5.2 in May 2026. Notable features include an integrated search engine, RSS feed subscriptions, remote management, sequential downloading, and advanced settings for torrents. The 5.2.3 update focuses on bug fixes and improvements, including corrections to plugin counting, file renaming issues in Windows, RSS feed intervals, HTML link parsing, peer address input analysis, web seed encoding, torrent tracker conversion, database transaction failures, transfer filter clearing, MIME header encoding, and updated libraries for performance enhancement.

AppWizard

July 5, 2026

You can now play Half-Life 2 right inside your browser at over 100 FPS with save states & console support — Ingenious port recreates the entire game campaign using WebGL 2

A fully playable browser version of Half-Life 2 has been released, created by developers Slqnt and 98006 in three months. This version includes the entire main campaign and two episodic DLCs, operating natively on devices without cloud streaming. It utilizes WebGL 2 and WebAssembly to run graphics-intensive tasks and translate C++ code into JavaScript. The port features a Source console for accessing developer commands, though it does not support Steam achievements. Testing on various devices showed the best performance on a Windows PC, achieving over 100 FPS. The future of the port depends on Valve's response, and while copyright issues pose challenges, many classic games are available for free online.

Tech Optimizer

July 2, 2026

How JSON.stringify Corrupted 150,000 Rows in My Postgres Database

A dataset of over 100,000 company profiles was found to have approximately 150,000 corrupted values across ten jsonb columns due to incorrect serialization caused by using JSON.stringify on values intended for jsonb columns. The problematic code was `await sql` update listings set services = ${JSON.stringify(record.services)} where id = ${record.id}`. This resulted in jsonb strings instead of jsonb arrays. The issue was detected by querying the type of the jsonb columns, revealing that two frequently updated columns had around 105,000 and 41,000 corrupted values, respectively. The repair process involved extracting the inner text and re-casting it as valid jsonb, while also addressing complications such as NUL bytes and double-encoding. The correct method for inserting jsonb values is to use `sql.json(record.services)` instead of JSON.stringify. Regular type checks are now part of a daily integrity job to prevent similar issues.