Mastra npm packages added easy-day-js malware, exposing developer systems and CI runners to infostealer risks.
Android TV botnet Popa linked to Israeli firm, Velvet Ant maintained decade-long stealth, unpatched GCP flaw enables takeover.