Tag: npm
Malware turns up in HashiCorp Terraform registry packages
Aikido traced Go malware inside two Terraform providers and two Go modules, the first abuse of HashiCorp's registry as a…
Malware hides in a B-tree library now that npm blocks install hooks
A malicious npm package pulled two million weekly downloads while running its payload from ordinary library code instead of an…
A lighter stealer called WeaselBiscuit turns up in 13 npm packages
A small JavaScript stealer with fingerprints of North Korean developer-targeting campaigns has been found riding a cluster of malicious packages.
Calendar add-ons on npm hide Linux backdoor in plain sight
Trend Micro finds 14 trojanized packages that drop the RedC2 4.0 implant the moment they are imported.
AI slop-squatted npm packages hide WEL1DROPPER malware
Nearly 800 npm packages hide a cross-platform RAT and infostealer behind fake README instructions.
Typosquat flood drops Sliver implants across three operating systems
A campaign of nearly 800 npm packages uses README lures and DNS tricks to deliver RATs on every platform.
Self-propagating npm worm poisons 400-plus packages via stolen tokens
The Mini Shai-Hulud worm stole publisher credentials, republished tainted packages, and burrowed into AI coding tools.
Amazon ties debug and chalk npm hijacks to North Korean hackers
Amazon attributes the debug and chalk npm hijacks to the North Korean group behind the axios attack.