OpenHack Blog

Insights on application security, vulnerability research, and building secure software at scale.

Vulnerability ResearchThreat IntelligenceAnnouncements
One missing await: How OpenHack hacked Papermark and got unlimited uploads — CVE-2026-36755
Vulnerability Research12 min read

One missing await: How OpenHack hacked Papermark and got unlimited uploads

How OpenHack found, validated, and verified a missing await that turned Papermark's authenticated upload route into a public pipe for unlimited uploads.

Ananay AroraAnanay Arora·
Thirty-seven npm typosquat packages converging through Windows and WSL into an infostealer targeting credentials, cryptocurrency wallets, and Telegram data
Threat Intelligence11 min read

Inside a 37-Package npm Typosquatting Campaign Targeting Windows and WSL

OpenHack correlated 37 npm typosquats carrying the same install-time dropper, decoded its XOR-obfuscated configuration, and traced a Windows and WSL infostealer chain from npm postinstall to credential exfiltration.

Ananay AroraAnanay Arora·
Introducing OpenHack — the open-source AI security agent
Announcements6 min read

Introducing OpenHack: The Open-Source AI Security Agent

OpenHack is now live — an open-source AI security agent that hunts, validates, and verifies real vulnerabilities in your code. It runs on open-source models at 40× the cost-efficiency of Claude Opus 4.6 on CVE-Bench.

Ananay AroraAnanay Arora·