Week in review: Ledger wallet implant tied to $93M theft, 1,500+ npm packages exposed

Help Net Security roundup: a hidden implant in Ledger hardware wallets is linked to a $93M theft, an npm Trusted Publishing flaw exposed over 1,500 packages to takeover, and Microsoft patched 1,400+ bugs including an exploited Mark of the Web bypass (CVE-2026-96951).

• Ledger wallet implant tied to $93M theft; affected devices sold via reseller CryptoBilis
• npm Trusted Publishing flaw exposed 1,500+ packages to takeover without credential theft
• Microsoft fixed 1,400+ vulnerabilities, including exploited CVE-2026-96951
• Let's Encrypt to cut certificate lifetimes from 90 to 64 days starting February 2027