Technology ❯ Software Development ❯ Open Source Software

Package Management

npm NPM npm Packages Vulnerabilities PyPI Python Packages Python Package Index NPM Packages Python Crates.io Arch User Repository Node.js RubyGems Python Package Index (PyPI) Security Risks Dependency Management npm and PyPI Node Package Manager npm Ecosystem GitHub Node Package Manager (npm) npm Security

14 ARTICLES

last mo.

ChainDrop Worm Infects Hundreds of npm Packages

Stolen GitHub credentials let poisoned releases run a Bun‑launched infostealer that harvests developer and cloud secrets, repackages them, and propagates through npm.

7 ARTICLES

2mo ago

Injective SDK Npm Release Backdoored to Steal Wallet Keys

3 ARTICLES

3mo ago

AUR Package Takeovers Deliver eBPF Rootkit Through Malicious npm Package

6 ARTICLES

3mo ago

Microsoft Disables Dozens of GitHub Repos After Credential‑stealing Code Targeted AI Coding Tools

3 ARTICLES

3mo ago

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

10 ARTICLES

4mo ago

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

10 ARTICLES

4mo ago

OpenAI Orders Mac App Updates After TanStack Supply-Chain Breach Exposes Signing Certificates

7 ARTICLES

4mo ago

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

14 ARTICLES

5mo ago

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

3 ARTICLES

5mo ago

OpenAI Rotates Mac Signing Certificates, Sets May 8 Update Deadline After Axios Hack

12 ARTICLES

5mo ago

Malicious npm 'Lotusbail' Package Steals WhatsApp Data and Plants Persistent Backdoor

13 ARTICLES

10mo ago

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

7 ARTICLES

10mo ago

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

4 ARTICLES

this yr.

Python Software Foundation Flags Active PyPI Phishing With pypi-mirror.org, Urges Immediate Password Resets

5 ARTICLES

last yr.

Ruby Central Assumes Temporary Administrative Control of RubyGems and Bundler

Package Management

ChainDrop Worm Infects Hundreds of npm Packages

Injective SDK Npm Release Backdoored to Steal Wallet Keys

AUR Package Takeovers Deliver eBPF Rootkit Through Malicious npm Package

Microsoft Disables Dozens of GitHub Repos After Credential‑stealing Code Targeted AI Coding Tools

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

OpenAI Orders Mac App Updates After TanStack Supply-Chain Breach Exposes Signing Certificates

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

OpenAI Rotates Mac Signing Certificates, Sets May 8 Update Deadline After Axios Hack

Never miss stories about

Package Management

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

Meta Halts Work With Mercor After Breach Tied to LiteLLM Supply-Chain Attack

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

TeamPCP Backdoors LiteLLM on PyPI, Forcing Emergency Secret Rotations

Malicious npm 'Lotusbail' Package Steals WhatsApp Data and Plants Persistent Backdoor

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

Python Software Foundation Flags Active PyPI Phishing With pypi-mirror.org, Urges Immediate Password Resets

Ruby Central Assumes Temporary Administrative Control of RubyGems and Bundler

Never miss stories about

Package Management