Researchers from ReversingLabs have highlighted a malicious campaign that bridges two critical ecosystems: Visual Studio Code (VSCode) Marketplace and npm, the popular JavaScript package repository. The campaign, first observed in...
Researchers at Socket have uncovered a malicious campaign targeting crypto developers. The attacker, operating under the pseudonym “topnotchdeveloper12”, has published three malicious npm packages—crypto-keccak, crypto-jsonwebtoken, and crypto-bignumber—that mimic legitimate cryptographic...
In a report by Yehuda Gelb and Elad Rapoport from the Checkmarx Security Research Team, a new supply chain attack technique has been uncovered that could compromise the integrity of...
Recently, the Phylum team’s automated risk detection platform uncovered a suspicious publication on npm, a popular package manager for JavaScript. This discovery shed light on a complex attack orchestrated through...
In the rapidly evolving digital landscape, software development has become a battleground, with npm (Node Package Manager) sitting at the heart of numerous security challenges. As the default package manager...
According to the npm bug report on GitHub, npm user Crunkle noted that npm 5.7.0 completely corrupted his file system permissions, making it necessary for him to manually patch permissions...
Support Securityonline.info site. Thanks!
