Technology ❯ Software Development ❯ Open Source Software ❯ Package Management

npm

Self-Spreading npm Worm Steals Developer Tokens to Push Malicious Releases

Researchers warn the worm turns stolen publish tokens into fresh releases across npm and PyPI.

OpenAI Rotates Mac Signing Certificates, Sets May 8 Update Deadline After Axios Hack

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

Shai-Hulud Worm Infects 187 npm Packages, Steals Secrets and Self‑Replicates via Stolen Tokens

Phished npm Maintainer’s Packages Used in Crypto-Clipping Attack as Rapid Takedown Limits Damage

LottieFiles Supply Chain Attack Drains Users' Crypto Wallets