Technology ❯ Software Development ❯ Open Source Software

Package Management

npm NPM npm Packages Vulnerabilities PyPI Python Packages Python Package Index NPM Packages Python Crates.io Arch User Repository Node.js RubyGems Python Package Index (PyPI) Security Risks Dependency Management npm and PyPI Node Package Manager npm Ecosystem GitHub Node Package Manager (npm) npm Security

AUR Package Takeovers Deliver eBPF Rootkit Through Malicious npm Package

The native payload uses eBPF to hide in the Linux kernel by exfiltrating developer credentials.

Microsoft Disables Dozens of GitHub Repos After Credential‑stealing Code Targeted AI Coding Tools

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

OpenAI Orders Mac App Updates After TanStack Supply-Chain Breach Exposes Signing Certificates

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

OpenAI Rotates Mac Signing Certificates, Sets May 8 Update Deadline After Axios Hack

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

Meta Halts Work With Mercor After Breach Tied to LiteLLM Supply-Chain Attack

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

TeamPCP Backdoors LiteLLM on PyPI, Forcing Emergency Secret Rotations

Malicious npm 'Lotusbail' Package Steals WhatsApp Data and Plants Persistent Backdoor

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

Python Software Foundation Flags Active PyPI Phishing With pypi-mirror.org, Urges Immediate Password Resets

Ruby Central Assumes Temporary Administrative Control of RubyGems and Bundler

Phished npm Maintainer’s Packages Used in Crypto-Clipping Attack as Rapid Takedown Limits Damage

Nx npm Packages Compromised in 'S1ngularity' Attack With Second-Wave Exploitation Emerging