ThreatsDay highlights npm campaign, Odysseus flaw and AI agent risks
ThreatsDay’s August 6, 2026 bulletin brings together 30 security developments, led by an active npm supply-chain campaign involving 846 malicious components and a critical CVSS 9.9 vulnerability in Odysseus AI Workspace. The Odysseus flaw could allow an authenticated non-admin user to execute operating-system commands with the privileges of the Odysseus process; version 1.0.2 addresses the issue.
The roundup also examines risks created when software, repositories and AI tools are trusted before their behaviour is properly constrained. In several cases, attackers relied on ordinary deployment paths, remote-access software or long-lived credentials rather than novel techniques.
Package loaders and privileged AI workspaces
Sonatype called the malicious npm operation Flooding Dropper. The packages use a first-stage JavaScript loader to identify the operating system, retrieve a compatible payload for Windows, Linux or macOS from a randomized group of hard-coded hosts, and run it as a detached background process. On Windows, the downloaded loader checks for sandboxed and virtual environments, patches Event Tracing for Windows and Antimalware Scan Interface functions, creates persistence through a scheduled task, and retrieves an encrypted payload.
Manifold Security said the Odysseus defect could be reached across two ordinary API requests by smuggling an admin-only shell action onto a scheduled task. The affected process holds application data and credentials, including password hashes, TOTP secrets, provider API keys, a database and SSH keys used to reach managed remote machines. There was no evidence of exploitation before the fix.
Repositories and agents extend the attack surface
Datadog found that trusting a repository in a coding agent can permit repository-controlled code to run before a user sends the first prompt. It identified automatic execution paths in Codex MCP configuration and Claude Code project environment settings that did not require a model response or shell-command approval. Datadog advised opening unfamiliar repositories in disposable environments without sensitive credentials.
The same trust problem is visible in npm chains and macOS security threats, where npm supply-chain activity and macOS threats showed how useful development ecosystems can become delivery routes when components or projects are compromised. Mitiga also described PromptLogger, in which hidden natural-language instructions in files such as .cursorrules or CLAUDE.md direct coding assistants to collect prompts, environment variables, tokens and deployment details.
Other issues in the weekly bulletin
Samsung fixed CVE-2025-21079 and CVE-2025-58486 late last year after researchers demonstrated that the two flaws could be chained for remote system-level compromise through a link delivered in an advertisement or messaging application. The researchers earned $50,000 for the demonstration at Pwn2Own Ireland in October 2025.
Microsoft said it paid more than $20 million in bug bounties to 562 researchers between July 1, 2025 and June 30, 2026, from 2,531 eligible vulnerability reports. Separately, Microsoft will reduce the lifetime of newly issued NuGet.org API keys from 365 days to 30 days starting August 17, 2026; existing keys created before then are scheduled to expire on November 1, 2026.
For businesses, the practical implication is to treat package installation, repository onboarding, agent configuration and access-token management as connected control points. Applying fixes matters, but so do disposable environments, least privilege, unique credentials and a clear inventory of the systems that can act with stored keys or persistent access.