Tag: npm
AI slop-squatted npm packages hide WEL1DROPPER malware
Nearly 800 npm packages hide a cross-platform RAT and infostealer behind fake README instructions.
Typosquat flood drops Sliver implants across three operating systems
A campaign of nearly 800 npm packages uses README lures and DNS tricks to deliver RATs on every platform.
Self-propagating npm worm poisons 400-plus packages via stolen tokens
The Mini Shai-Hulud worm stole publisher credentials, republished tainted packages, and burrowed into AI coding tools.
Amazon ties debug and chalk npm hijacks to North Korean hackers
Amazon attributes the debug and chalk npm hijacks to the North Korean group behind the axios attack.
AsyncAPI npm packages with millions of weekly downloads compromised via GitHub actions
Five AsyncAPI npm packages with 2.9 million weekly downloads were trojanized after a GitHub Actions token theft.
PyTorch Lightning and Intercom-client Hit in Supply Chain Attacks to Steal Credentials
The compromise cascaded from PyPI to npm to Packagist when a transitive dependency of pyannote-audio introduced the malicious Lightning package…
Axios NPM Package Breached in North Korean Supply Chain Attack Affecting Millions
Backdoored versions of the Axios JavaScript library, downloaded by roughly 3% of its 100M weekly userbase, deployed cross-platform RATs via…