Technology ❯ Cybersecurity ❯ Malware

Supply Chain Attacks

npm Packages Credential Theft Open Source Software Python Packages GlassWorm Python Libraries App Development Behavioral Analysis TeamPCP Typosquatting

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

Stolen maintainer credentials let the worm ship install-time stealers that raid developer and CI secrets.

Stories older than 24h

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

Checkmarx Confirms Tainted Jenkins Plugin and Ships Clean Updates

JDownloader Restores Site After Hack Replaced Official Installers With Malware

DAEMON Tools Confirms Supply-Chain Breach, Releases Clean Lite 12.6

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

73 Cloned OpenVSX Extensions Linked to GlassWorm Act as Malware Loaders

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

CPUID Confirms Brief Website Hijack That Served Malware via CPU-Z and HWMonitor Links

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

TeamPCP Supply-Chain Attacks Hit First 48-Hour Lull as Focus Turns to Monetization

TeamPCP Backdoors LiteLLM on PyPI, Forcing Emergency Secret Rotations

Trivy Supply-Chain Hack Widens as Malicious Images Pulled and 1,000+ Victims Emerge

Trivy Supply-Chain Attack Poisons GitHub Action Tags to Steal CI/CD Secrets

Microsoft Warns of Fake Next.js Repos That Backdoor Developers’ Machines

npm Worm 'SANDWORM_MODE' Exposed Targeting Developer and CI Secrets Through Typosquatted Packages

Abandoned Outlook Add-In Hijacked to Steal 4,000+ Microsoft Credentials

Open VSX Publisher Account Hijacked to Push GlassWorm Through Four Popular Extensions