SANS Internet Storm Center Stormcast: PNG Steganography, npm Supply Chain Attack, and Pi-hole Vulnerabilities

This September 22nd, 2026 SANS Internet Storm Center Stormcast covers three cybersecurity topics. The first discusses a PNG file used in a terminal fix campaign that Microsoft reported, where an executable was encoded inside the PNG pixel data using steganography. Unlike typical steganography, the entire image data was the executable itself, and the PE data was obfuscated by encoding differences in pixel values, requiring a Python tool called PNGdump.py to extract. The second topic covers a supply chain attack against npm called the B3 malware campaign, which uses a library named indexed B3 to mimic a legitimate sorted B3 library. This attack differs from previous npm attacks by avoiding install scripts and instead executing malicious code as part of the library's own code, evading current detection techniques and remaining on GitHub at the time of reporting. The third topic announces four vulnerabilities in Pi Hole, including two remote code execution vulnerabilities that require authenticated sessions to exploit.