Technology ❯ Cybersecurity ❯ Malware

Supply Chain Attacks

npm Packages GlassWorm Sha1-Hulud Web Development Open Source Threats Credential Theft Ethereum Notepad++ Data Theft Incident Response NPM Security Crypto-Clipper Malware Node.js Shai-Hulud 2.0 NPM Packages npm Registry npm Worms NPM Ecosystem PhantomRaven Developer Tools NuGet Packages NPM Infections Microsoft Outlook Add-ins Behavioral Analysis eScan Antivirus Developer Security Visual Studio Code Extensions Typosquatting App Development

Microsoft Warns of Fake Next.js Repos That Backdoor Developers’ Machines

Malware executes during routine developer actions, prompting Microsoft to urge immediate hardening of developer workflows.

npm Worm 'SANDWORM_MODE' Exposed Targeting Developer and CI Secrets Through Typosquatted Packages

Abandoned Outlook Add-In Hijacked to Steal 4,000+ Microsoft Credentials

Open VSX Publisher Account Hijacked to Push GlassWorm Through Four Popular Extensions

eScan Update Server Breach Delivered Malicious Patch During Two-Hour Window

Trust Wallet Ties $8.5 Million Chrome Extension Theft to Shai-Hulud Supply-Chain Breach

Malicious npm 'Lotusbail' Package Steals WhatsApp Data and Plants Persistent Backdoor

Shai-Hulud 2.0 Exposes 400,000 Developer Secrets Across NPM and GitHub

Shai-Hulud npm Worm Exposes 25,000+ GitHub Repos Through Trojanized Packages

Malicious NuGet Packages With Delayed Sabotage Removed After Socket Discovery

Researchers Uncover 'PhantomRaven' Campaign Flooding npm With 126 Credential-Stealing Packages

GlassWorm Actively Infects VS Code and OpenVSX Extensions, With 35,800 Installations Reported

Python Software Foundation Flags Active PyPI Phishing With pypi-mirror.org, Urges Immediate Password Resets

Shai-Hulud Worm Infects 187 npm Packages, Steals Secrets and Self‑Replicates via Stolen Tokens

Phished npm Maintainer’s Packages Used in Crypto-Clipping Attack as Rapid Takedown Limits Damage

Malicious npm Packages Tap Ethereum Smart Contracts for Stealthy C2

Nx npm Packages Compromised in 'S1ngularity' Attack With Second-Wave Exploitation Emerging

US Sanctions Funnull Technology for Enabling $200M Crypto ‘Pig Butchering’ Scams