Hundreds of trojanized versions of well-known packages such as Zapier, ENS Domains, PostHog, and Postman have been planted in ...

The second Shai-Hulud attack last week exposed around 400,000 raw secrets after infecting hundreds of packages in the NPM ...

North Korean attackers have delivered more than 197 malicious packages as part of ongoing state-sponsored activity to ...

The originators of the Contagious Interview cyberattack campaign are stitching GitHub, Vercel, and NPM together into a ...

North Korean actors deployed 197 new npm packages delivering evolved OtterCookie and GolangGhost malware through fake ...

The latest version also executes malicious code during the preinstall phase, and is bigger and faster than the first wave, ...

Approximately 640 NPM packages have been infected with a new variant of the Shai-Hulud self-replicating worm in a fresh wave of attacks.

A new iteration of the Shai-Hulud malware that ran through npm repositories in September is faster, more dangerous, and more destructive, creating huge numbers of malicious repositories, compromised ...

On November 24, a new wave of the Shai-Hulud supply chain attack emerged. The threat actors exfiltrate stolen credentials ...

Malware is back on the OpenVSX and Microsoft Visual Studio marketplaces, researchers are warning. In mid-September this year, ...

"As a new and significantly more aggressive wave of npm supply chain malware, Shai-Hulud 2 combines stealthy execution, ...

The latest attack from the self-replicating npm-package poisoning worm can also steal credentials and secrets from AWS, ...