Do Son A new worm, Shai-Hulud, has compromised CrowdStrike’s NPM packages. The malware steals credentials and can spread rapidly across the developer ecosystem.
NPM packages
Attackers used Google Calendar invites and Unicode PUAs to deliver obfuscated malware via NPM. Aikido uncovers this novel supply chain attack.
FortiGuard Labs discovers malicious NPM packages targeting PayPal users. Attackers use deceptive tactics to steal usernames, paths, and hostnames