Technology ❯ Cybersecurity ❯ Malware

Supply Chain Attacks

npm Packages Credential Theft Python Packages Open Source Software GlassWorm NPM Packages npm Ecosystem GitHub Actions Sha1-Hulud VS Code Extensions

4 ARTICLES

last wk.

Multi‑Stage Malware Found in Four AsyncAPI npm Packages

Researchers say attackers used compromised push access to abuse the project's GitHub Actions release workflow and publish poisoned packages that fetch a large, multi‑channel command framework from IPFS.

7 ARTICLES

2w ago

Microsoft Disables Dozens of GitHub Repos After Credential‑stealing Code Targeted AI Coding Tools

3 ARTICLES

last mo.

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

6 ARTICLES

last mo.

Red Hat npm Packages Backdoored to Deliver 'Miasma' Credential‑Stealing Worm

3 ARTICLES

2mo ago

JINX-0164 Uses Fake Recruiter Lures to Deliver macOS Malware to Crypto Developers

9 ARTICLES

2mo ago

TrapDoor Malware Hits npm, PyPI and Crates.io to Steal Developer Secrets

10 ARTICLES

2mo ago

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

13 ARTICLES

2mo ago

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

3 ARTICLES

2mo ago

Checkmarx Confirms Tainted Jenkins Plugin and Ships Clean Updates

3 ARTICLES

2mo ago

JDownloader Restores Site After Hack Replaced Official Installers With Malware

9 ARTICLES

2mo ago

DAEMON Tools Confirms Supply-Chain Breach, Releases Clean Lite 12.6

7 ARTICLES

2mo ago

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

3 ARTICLES

3mo ago

73 Cloned OpenVSX Extensions Linked to GlassWorm Act as Malware Loaders

14 ARTICLES

3mo ago

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

7 ARTICLES

3mo ago

CPUID Confirms Brief Website Hijack That Served Malware via CPU-Z and HWMonitor Links

12 ARTICLES

3mo ago

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

29 ARTICLES

3mo ago

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

Supply Chain Attacks

Multi‑Stage Malware Found in Four AsyncAPI npm Packages

Injective SDK Npm Release Backdoored to Steal Wallet Keys

Malicious JetBrains Plugins Steal AI API Keys From Developers

AUR Package Takeovers Deliver eBPF Rootkit Through Malicious npm Package

Microsoft Disables Dozens of GitHub Repos After Credential‑stealing Code Targeted AI Coding Tools

Rust Stealer IronWorm and New Miasma Worm Infect Dozens of npm Packages

Red Hat npm Packages Backdoored to Deliver 'Miasma' Credential‑Stealing Worm

JINX-0164 Uses Fake Recruiter Lures to Deliver macOS Malware to Crypto Developers

TrapDoor Malware Hits npm, PyPI and Crates.io to Steal Developer Secrets

Mini Shai-Hulud Poisons Hundreds of AntV npm Packages in One-Hour Burst

Never miss stories about

Supply Chain Attacks

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

Checkmarx Confirms Tainted Jenkins Plugin and Ships Clean Updates

JDownloader Restores Site After Hack Replaced Official Installers With Malware

DAEMON Tools Confirms Supply-Chain Breach, Releases Clean Lite 12.6

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

73 Cloned OpenVSX Extensions Linked to GlassWorm Act as Malware Loaders

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

CPUID Confirms Brief Website Hijack That Served Malware via CPU-Z and HWMonitor Links

Axios npm Package Briefly Trojanized After Maintainer Account Takeover

Axios npm Package Hijacked to Drop RATs as Google Links Attack to UNC1069

Never miss stories about

Supply Chain Attacks