Technology ❯ Cybersecurity ❯ Malware ❯ Supply Chain Attacks

npm Packages

ChainDrop Worm Infects Hundreds of npm Packages

Stolen GitHub credentials let poisoned releases run a Bun‑launched infostealer that harvests developer and cloud secrets, repackages them, and propagates through npm.

4 ARTICLES

2mo ago

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

7 ARTICLES

4mo ago

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

14 ARTICLES

5mo ago

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

12 ARTICLES

5mo ago

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

29 ARTICLES

5mo ago

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

4 ARTICLES

7mo ago

npm Worm 'SANDWORM_MODE' Exposed Targeting Developer and CI Secrets Through Typosquatted Packages

13 ARTICLES

10mo ago

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

7 ARTICLES

10mo ago

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

18 ARTICLES

last yr.

Shai-Hulud Worm Infects 187 npm Packages, Steals Secrets and Self‑Replicates via Stolen Tokens

42 ARTICLES

last yr.

Phished npm Maintainer’s Packages Used in Crypto-Clipping Attack as Rapid Takedown Limits Damage

npm Packages

ChainDrop Worm Infects Hundreds of npm Packages

Multi‑Stage Malware Found in Four AsyncAPI npm Packages

Injective SDK Npm Release Backdoored to Steal Wallet Keys

Red Hat npm Packages Backdoored to Deliver 'Miasma' Credential‑Stealing Worm

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

npm Worm 'SANDWORM_MODE' Exposed Targeting Developer and CI Secrets Through Typosquatted Packages

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

Shai-Hulud Worm Infects 187 npm Packages, Steals Secrets and Self‑Replicates via Stolen Tokens

Phished npm Maintainer’s Packages Used in Crypto-Clipping Attack as Rapid Takedown Limits Damage

Never miss stories about

npm Packages