North Korea targets npm, Linux kernel RCE, AI-driven ransomware surge

This briefing reports multiple high-impact threats: a North Korean-linked supply-chain campaign (PolinRider) distributing 108 malicious packages/extensions, a patched critical Linux kernel privilege-escalation (CVE-2026-46242, “Bad Epoll”), the first documented LLM-agent-automated ransomware operation (JadePuffer), disruption of the NetNut residential proxy network built on millions of compromised Android devices, and an extortion incident where a U.S. government entity reportedly paid ~$1M to Kairos; recommended actions include patching, dependency and extension audits, enhanced EDR/behavioral detection, and IoT/Android remediation.