Sysdig Security Briefing: September 2025

In September, the Sysdig Threat Research Team reported widespread NPM supply-chain compromises—dozens to hundreds of packages (including popular packages like chalk, debug, duck, and @ctrl/tinycolor) were backdoored via maintainer compromise and a self-replicating worm (Shai‑Hulud) that exfiltrated secrets; a separate malicious package (Fezbox) stole browser cookies and embedded QR-code payloads. The team also published analysis of ZynorRAT (a Turkish Go-based RAT), and summarized active, high-impact exploits and vulnerabilities (Phoenix rowhammer CVE-2025-6202, Android/Chrome zero-days, Cisco CVEs), providing IOCs, detection guidance, and remediation recommendations.