Technology ❯ Cybersecurity ❯ Malware

Supply Chain Attacks

npm Packages Credential Theft Python Packages Open Source Software npm Worms NPM Packages npm Ecosystem GitHub Actions GlassWorm GitHub Exploits

Compromised GitHub Actions Were Re‑enabled and Resumed Running Old Mini Shai‑Hulud Malware

The reactivation allowed injected code to harvest CI/CD credentials, highlighting the need for SHA pinning, secret rotation, workflow audits.

ChainDrop Worm Infects Hundreds of npm Packages

Adform Tracking Script Compromised to Swap Cryptocurrency Wallets

Sandworm_Mode Worm Targets AI Development Toolchains

Multi‑Stage Malware Found in Four AsyncAPI npm Packages

Injective SDK Npm Release Backdoored to Steal Wallet Keys

Malicious JetBrains Plugins Steal AI API Keys From Developers

AUR Package Takeovers Deliver eBPF Rootkit Through Malicious npm Package

Microsoft Disables Dozens of GitHub Repos After Credential‑stealing Code Targeted AI Coding Tools

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

Red Hat npm Packages Backdoored to Deliver 'Miasma' Credential‑Stealing Worm

JINX-0164 Uses Fake Recruiter Lures to Deliver macOS Malware to Crypto Developers

TrapDoor Malware Hits npm, PyPI and Crates.io to Steal Developer Secrets

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

Checkmarx Confirms Tainted Jenkins Plugin and Ships Clean Updates

JDownloader Restores Site After Hack Replaced Official Installers With Malware

DAEMON Tools Confirms Supply-Chain Breach, Releases Clean Lite 12.6

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

73 Cloned OpenVSX Extensions Linked to GlassWorm Act as Malware Loaders