Package Management

npm NPM Python Node Package Manager Dependency Management Node.js npm Packages Updates Linux Distributions Linux Package Management

4 ARTICLES

6h ago

Multi‑Stage Malware Found in Four AsyncAPI npm Packages

Researchers say attackers used compromised push access to abuse the project's GitHub Actions release workflow and publish poisoned packages that fetch a large, multi‑channel command framework from IPFS.

Stories older than 24h

8 ARTICLES

5d ago

HalluSquatting Lets Attackers Pre-Register AI Hallucinations to Seed Malicious Packages

3 ARTICLES

4w ago

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

7 ARTICLES

2mo ago

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

14 ARTICLES

2mo ago

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

9 ARTICLES

3mo ago

OpenAI Requires macOS App Updates After Axios Supply-Chain Compromise

12 ARTICLES

3mo ago

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

29 ARTICLES

3mo ago

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

3 ARTICLES

3mo ago

LiteLLM Supply-Chain Breach Put Backdoored PyPI Releases in Developers’ Workflows

4 ARTICLES

3mo ago

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

11 ARTICLES

3mo ago

TeamPCP Supply-Chain Attacks Hit First 48-Hour Lull as Focus Turns to Monetization

17 ARTICLES

3mo ago

TeamPCP Backdoors LiteLLM on PyPI, Forcing Emergency Secret Rotations

4 ARTICLES

3mo ago

Researchers Link Iran-Targeted ‘CanisterWorm’ to Trivy Supply-Chain Breach

6 ARTICLES

3mo ago

Trivy Supply-Chain Attack Poisons GitHub Action Tags to Steal CI/CD Secrets

4 ARTICLES

4mo ago

npm Worm 'SANDWORM_MODE' Exposed Targeting Developer and CI Secrets Through Typosquatted Packages

Package Management

Multi‑Stage Malware Found in Four AsyncAPI npm Packages

HalluSquatting Lets Attackers Pre-Register AI Hallucinations to Seed Malicious Packages

AUR Package Takeovers Deliver eBPF Rootkit Through Malicious npm Package

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

Red Hat npm Packages Backdoored to Deliver 'Miasma' Credential‑Stealing Worm

TrapDoor Malware Hits npm, PyPI and Crates.io to Steal Developer Secrets

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

Never miss stories about

Package Management

OpenAI Requires macOS App Updates After Axios Supply-Chain Compromise

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

LiteLLM Supply-Chain Breach Put Backdoored PyPI Releases in Developers’ Workflows

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

TeamPCP Supply-Chain Attacks Hit First 48-Hour Lull as Focus Turns to Monetization

TeamPCP Backdoors LiteLLM on PyPI, Forcing Emergency Secret Rotations

Researchers Link Iran-Targeted ‘CanisterWorm’ to Trivy Supply-Chain Breach

Trivy Supply-Chain Attack Poisons GitHub Action Tags to Steal CI/CD Secrets

npm Worm 'SANDWORM_MODE' Exposed Targeting Developer and CI Secrets Through Typosquatted Packages

Never miss stories about

Package Management