ChainDrop Worm Compromises npm Supply Chain with Stealthy Techniques
A new variant of the Shai-Hulud npm worm, named ChainDrop, has infected 444 packages, employing unique methods to evade detection and compromise repositories.
Tag npm
Compromised jscrambler 8.14.0 npm Release Deploys Infostealer
The recent npm package release of jscrambler version 8.14.0 has been confirmed to contain a malicious infostealer that executes upon installation, impacting developers and build systems.
Malicious npm Packages Linked to North Korea Target Developer Secrets
Recent findings reveal a set of malicious npm packages linked to North Korean threat actors, designed to steal sensitive developer information under the guise of legitimate tools.
AI Code Vetting Saves Developer from Malicious Attack
Roman Imankulov's experience highlights the critical role of AI in enhancing code security, as he narrowly avoided a potentially devastating attack through a combination of intuition and advanced AI tools.
Malicious npm Packages Target OpenSearch and Elasticsearch Users
A single attacker has published 14 malicious npm packages impersonating popular libraries, raising concerns about supply chain security.
npm Introduces 2FA and Staged Publishing to Enhance Supply Chain Security
GitHub has implemented new security measures for npm, including two-factor authentication for package publishing and new install source controls, aimed at mitigating supply chain attacks.
TrapDoor Supply Chain Attack Distributes Credential-Stealing Malware
A coordinated supply chain attack named TrapDoor has been identified, targeting npm, PyPI, and Crates.io to spread credential-stealing malware through numerous malicious packages.
Grafana Labs Confirms GitHub Breach Linked to TanStack npm Attack
Grafana Labs has reported a breach of its GitHub environment, revealing source code and internal information but confirming no compromise of customer production systems.
OpenAI Faces Supply Chain Compromise Linked to TanStack npm Incident
OpenAI has disclosed a security incident involving the theft of internal credentials due to compromised employee devices, part of a broader supply chain attack affecting npm ecosystems.
Source Code of Anthropic’s Claude Code Leaked
The TypeScript source code for Anthropic's Claude Code CLI tool has been extracted and made publicly available, raising questions about security and intellectual property.
