Technology ❯ Cybersecurity ❯ Malware

Supply Chain Attacks

npm Packages Credential Theft GlassWorm Open Source Software Sha1-Hulud Ethereum Open Source Threats Data Theft Incident Response Notepad++

Hijacked Axios npm Package Pushed RAT Malware to Developers

Google attributes the breach to UNC1069 to spotlight how a stolen npm token can bypass publish safeguards.

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

TeamPCP Supply-Chain Attacks Hit First 48-Hour Lull as Focus Turns to Monetization

TeamPCP Backdoors LiteLLM on PyPI, Forcing Emergency Secret Rotations

Trivy Supply-Chain Hack Widens as Malicious Images Pulled and 1,000+ Victims Emerge

Trivy Supply-Chain Attack Poisons GitHub Action Tags to Steal CI/CD Secrets

Microsoft Warns of Fake Next.js Repos That Backdoor Developers’ Machines

npm Worm 'SANDWORM_MODE' Exposed Targeting Developer and CI Secrets Through Typosquatted Packages

Abandoned Outlook Add-In Hijacked to Steal 4,000+ Microsoft Credentials

Open VSX Publisher Account Hijacked to Push GlassWorm Through Four Popular Extensions

eScan Update Server Breach Delivered Malicious Patch During Two-Hour Window

Trust Wallet Ties $8.5 Million Chrome Extension Theft to Shai-Hulud Supply-Chain Breach

Malicious npm 'Lotusbail' Package Steals WhatsApp Data and Plants Persistent Backdoor

Shai-Hulud 2.0 Exposes 400,000 Developer Secrets Across NPM and GitHub

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

Malicious NuGet Packages With Delayed Sabotage Removed After Socket Discovery

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

GlassWorm Actively Infects VS Code and OpenVSX Extensions, With 35,800 Installations Reported

Python Software Foundation Flags Active PyPI Phishing With pypi-mirror.org, Urges Immediate Password Resets

Shai-Hulud Worm Infects 187 npm Packages, Steals Secrets and Self‑Replicates via Stolen Tokens