Alibaba Users Targeted: 18 Malicious npm Packages Deliver Cross-Platform RAT in Supply Chain Attack
18 malicious npm packages deliver a cross-platform RAT to Alibaba developer tool users, exploiting supply chain trust.
npm-security
North Korea's Stealthy 'Warm-Up Act': Unmasking the Precursor to the Axios npm Hack
Amazon's intel team linked the axios hack to an earlier, smaller npm compromise by North Korea, revealing their evolving supply chain tactics.
VS Code Tasks: The Stealth Vector for Hijacked npm & Go Packages Deploying Python Infostealers
Uncovered: Hijacked npm and Go packages using VS Code tasks to deploy Python infostealers on Windows, Linux, and macOS hosts.
npm Under Siege: IronWorm & Miasma Worm Variant Unleash Sophisticated Supply Chain Attacks
Rust-based info stealer (IronWorm) and self-spreading Miasma worm hit npm, leveraging over 50 poisoned packages in supply chain attacks.
Fortifying the Software Supply Chain: npm's 2FA-Gated Publishing and Staged Release Controls
npm enhances supply chain security with mandatory 2FA for publishing and staged releases, mitigating package compromise risks.
Supply Chain & Endpoint Zero-Days: Analyzing Axios npm Compromise & Critical FortiClient EMS Exploits
Deep dive into the Axios npm supply chain compromise and critical FortiClient EMS vulnerabilities, detailing technical impacts and mitigation strategies.
Supply Chain Alert: 36 Malicious npm Packages Leverage Redis & PostgreSQL for Persistent Implants and Covert Data Exfiltration
36 malicious npm packages masquerading as Strapi plugins exploit Redis/PostgreSQL for reverse shells, credential harvesting, and persistent implants.
Malicious npm Package Unmasked: "@openclaw-ai/openclawai" Deploys RAT, Targets macOS Credentials in Supply Chain Attack
Malicious npm package "@openclaw-ai/openclawai" masquerades as OpenClaw installer, deploying a RAT to steal macOS credentials.
Shai-Hulud's Shadow: A Deep Dive into the npm Supply Chain Worm Targeting AI Developers
Analysis of the Shai-Hulud-like supply chain worm exploiting npm packages to compromise AI development environments.
SANDWORM_MODE Unleashed: Malicious npm Packages Steal Crypto Keys, CI Secrets, and API Tokens in a Shai-Hulud-like Supply Chain Attack
Active npm supply chain worm, SANDWORM_MODE, harvests crypto keys, CI secrets, and API tokens, demanding urgent developer vigilance.