Week in review: Hidden implant in Ledger wallets linked to $93M theft, 1,500+ npm packages exposed

This week's security roundup covers a hidden hardware implant found in Ledger wallets tied to a $93 million theft, traced by Ledger to devices sold through Southeast Asian reseller CryptoBilis. Researchers at Bloom Security also disclosed a flaw in npm's Trusted Publishing feature that let attackers hijack abandoned GitHub repository names to push malicious updates to over 1,500 packages, prompting fixes from GitHub. Elsewhere, Microsoft patched more than 1,400 bugs including an actively exploited Mark of the Web bypass (CVE-2026-96951), GitLab urged patching of a critical CI/CD regex compiler RCE (CVE-2026-97229), and attackers were found chaining three Ivanti Connect Secure zero-days to gain root on fully patched VPN appliances. The digest rounds out with CISA's KEV additions for Palo Alto, Cisco and Ahsay products, European grocery chains hit by cyberattacks, and growing concerns over AI agents as insider risks.