Technology ❯ Software Development ❯ Open Source Software

Package Management

npm NPM npm Packages PyPI Python Packages Vulnerabilities Python Package Index Python RubyGems Node Package Manager (npm) Dependency Management NPM Packages Node Package Manager Node.js Security Risks Crates.io npm Security npm and PyPI Python Package Index (PyPI) npm Ecosystem Arch User Repository GitHub Malicious Packages Internal Tools

14 ARTICLES

3mo ago

ChainDrop Worm Infects Hundreds of npm Packages

Stolen GitHub credentials let poisoned releases run a Bun‑launched infostealer that harvests developer and cloud secrets, repackages them, and propagates through npm.

7 ARTICLES

4mo ago

Injective SDK Npm Release Backdoored to Steal Wallet Keys

3 ARTICLES

4mo ago

AUR Package Takeovers Deliver eBPF Rootkit Through Malicious npm Package

6 ARTICLES

5mo ago

Microsoft Disables Dozens of GitHub Repos After Credential‑stealing Code Targeted AI Coding Tools

3 ARTICLES

5mo ago

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

10 ARTICLES

5mo ago

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

10 ARTICLES

5mo ago

OpenAI Orders Mac App Updates After TanStack Supply-Chain Breach Exposes Signing Certificates

7 ARTICLES

6mo ago

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

14 ARTICLES

6mo ago

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

3 ARTICLES

6mo ago

OpenAI Rotates Mac Signing Certificates, Sets May 8 Update Deadline After Axios Hack

12 ARTICLES

7mo ago

Malicious npm 'Lotusbail' Package Steals WhatsApp Data and Plants Persistent Backdoor

13 ARTICLES

11mo ago

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

7 ARTICLES

last yr.

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

4 ARTICLES

last yr.

Python Software Foundation Flags Active PyPI Phishing With pypi-mirror.org, Urges Immediate Password Resets

5 ARTICLES

last yr.

Ruby Central Assumes Temporary Administrative Control of RubyGems and Bundler

Package Management

ChainDrop Worm Infects Hundreds of npm Packages

Injective SDK Npm Release Backdoored to Steal Wallet Keys

AUR Package Takeovers Deliver eBPF Rootkit Through Malicious npm Package

Microsoft Disables Dozens of GitHub Repos After Credential‑stealing Code Targeted AI Coding Tools

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

OpenAI Orders Mac App Updates After TanStack Supply-Chain Breach Exposes Signing Certificates

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

OpenAI Rotates Mac Signing Certificates, Sets May 8 Update Deadline After Axios Hack

Never miss stories about

Package Management

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

Meta Halts Work With Mercor After Breach Tied to LiteLLM Supply-Chain Attack

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

TeamPCP Backdoors LiteLLM on PyPI, Forcing Emergency Secret Rotations

Malicious npm 'Lotusbail' Package Steals WhatsApp Data and Plants Persistent Backdoor

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

Python Software Foundation Flags Active PyPI Phishing With pypi-mirror.org, Urges Immediate Password Resets

Ruby Central Assumes Temporary Administrative Control of RubyGems and Bundler

Never miss stories about

Package Management