Morning Review in IT Security — September 21, 2026

The threat landscape continues to evolve with sophisticated supply chain attacks, nation-state operations targeting cryptocurrency infrastructure, and critical vulnerabilities being actively exploited in production environments. Today's briefing covers four significant security incidents affecting developers, enterprises, and critical infrastructure worldwide.

Malicious npm Packages Evade Install-Script Defenses at Runtime

An ongoing npm malware campaign demonstrates how threat actors are circumventing traditional supply chain security measures by embedding malicious code within a package's normal runtime behavior rather than relying on installation scripts. The campaign involves the 'indexed-btree' package and related malware variants including btree-core, btree-leaderboard, btree-lru-cache, btree-range-store, btree-time-index, neighbor-key-map, ordered-kv-index, priority-slot-queue, and sliding-score-window. The threat actors have configured these packages to exfiltrate data to command-and-control infrastructure hosted on slack.com and telegram.org domains.

This attack methodology represents a significant evolution in npm ecosystem threats, as it bypasses security tools that focus exclusively on detecting suspicious installation script behavior. Organizations relying on npm packages must implement runtime monitoring and behavioral analysis alongside traditional supply chain defenses. Source: Malicious npm packages evade install-script defenses at runtime

North Korean WaterPlum Hackers Infected 30,000 Devices Worldwide

A joint law enforcement advisory has documented a North Korean hacking campaign attributed to the WaterPlum group that compromised at least 30,000 devices globally between December 2025 and July 2026. The operation successfully transferred more than $10.7 million in stolen cryptocurrency to North Korean accounts, representing a significant financial impact. The campaign utilized malware families designated as BeaverTail, InvisibleFerret, OtterCandy, OtterCookie, and StoatWaffle to establish persistence and facilitate data theft.

The scale and financial success of this operation underscore the continued threat posed by nation-state actors targeting cryptocurrency infrastructure and related systems. The use of multiple malware families suggests a coordinated, well-resourced campaign with distinct operational phases. Source: North Korean WaterPlum hackers infected 30,000 devices worldwide

Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

A critical vulnerability in the Orkes Conductor workflow platform is currently being actively exploited in production environments, according to Fortinet. CVE-2026-58138 carries a CVSS v3.1 score of 9.8 and a CVSS v4 score of 9.3, reflecting its severe impact. The vulnerability affects Orkes Conductor versions prior to 3.30.2 and permits unauthenticated remote code execution, allowing attackers to gain complete control of vulnerable systems without requiring valid credentials.

Organizations operating Orkes Conductor deployments should prioritize immediate patching to version 3.30.2 or later. The active exploitation of this pre-authentication vulnerability means that any internet-exposed instance remains at critical risk. Source: Critical Pre-Auth RCE in Orkes Conductor Workflow Platform Exploited in the Wild

CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

The U.S. Cybersecurity and Infrastructure Security Agency has added three Linux kernel vulnerabilities to its Known Exploited Vulnerabilities catalog following confirmation of active exploitation in the field. CVE-2025-39682 carries a CVSS score of 9.8 and involves an improper check for unusual or exceptional conditions in the TLS receive path. The advisory also covers CVE-2025-39964 and CVE-2026-53266, indicating a coordinated exploitation effort targeting critical kernel subsystems.

The inclusion of these vulnerabilities in CISA's KEV catalog signals that patches are available and immediate remediation is necessary for systems exposed to untrusted networks. Linux administrators should prioritize kernel updates across their infrastructure to address these actively exploited flaws. Source: CISA Flags Three Linux Kernel Vulnerabilities Exploited in the Wild

Today's threat intelligence reflects a coordinated ecosystem of attacks spanning open-source supply chains, nation-state cryptocurrency theft operations, and exploitation of critical infrastructure components. Security teams should prioritize patch management for the Orkes Conductor and Linux kernel vulnerabilities while implementing enhanced dependency scanning and runtime monitoring for npm packages.