Do Son Google warns of a massive Axios supply chain attack. Versions 1.14.1 & 0.30.4 deploy the WAVESHAPER.V2 backdoor via a hijacked NPM account. Patch now!
npm
Anthropic's proprietary Claude Code logic and unreleased features leaked via an npm source map error. Explore the 46,000-line blueprint here.
Axios versions 1.14.1 & 0.30.4 have been poisoned. A hijacked maintainer account is dropping a RAT via postinstall scripts. Revert to safe versions now!
Node-convict (CVE-2026-33864) faces a 9.4 CVSS Prototype Pollution flaw. Bypass filters and hijack Node.js apps. Update to version 6.2.5 now to stay secure.
Critical binary-parser flaw CVE-2026-1245 allows code injection in Node.js. Versions < 2.3.0 are vulnerable to RCE. Update to v2.3.0 immediately.
Critical Orval flaw CVE-2026-23947 (CVSS 9.3) allows code injection via OpenAPI specs. Update to v8.0.2 now to secure your generated TypeScript clients.
Zscaler detects NodeCordRAT, a new malware in malicious npm packages. It uses Discord as a C2 server to loot crypto wallets and Chrome data.
Koi Security uncovers lotusbail, a malicious npm package with 56k downloads that functions perfectly while stealing WhatsApp credentials and chats.
Socket uncovers an npm-based phishing campaign using CDNs to host lures targeting sales teams in critical infrastructure via fake MicroSecure pages.
A critical OS Command Injection (CVE-2025-68154) in the systeminformation Node.js library risks RCE on Windows. Affects 16M+ users. Upgrade to v5.27.14.
A Critical flaw (CVE-2025-12816) in node-forge allows attackers to bypass signature verification by manipulating ASN.1 structures. The vulnerability affects 21M+ weekly downloads. Update to v1.3.2.
Socket exposed a new npm attack (dino_reborn) using Adspect cloaking to hide behind a fake crypto CAPTCHA for victims, while showing a polished decoy site (Offlido) to researchers.
AWS Inspector exposed the largest npm supply chain incident ever: 150,000+ malicious packages were uploaded in a coordinated campaign to exploit tea.xyz token rewards via tea.yaml files.
Datadog exposed MUT-4831, a cluster that deployed Vidar Infostealer via 17 malicious npm packages. The malware uses postinstall scripts to download and execute the payload, stealing credentials and crypto wallets.
Koi Security exposed PhantomRaven, an npm supply chain attack using 126 packages. It leverages Remote Dynamic Dependencies (RDD) and AI slopsquatting to steal GitHub/CI/CD secrets from 86,000+ downloads.
Socket exposed an npm typosquat campaign using 10 fake packages (Netherеum.All). The malicious postinstall script deploys a 24MB PyInstaller stealer after prompting a fake CAPTCHA.
Malicious packages across npm, PyPI, and RubyGems are exploiting Discord webhooks as stealthy, resilient C2 endpoints to exfiltrate developer config files and sensitive host data.
North Korean actors launched "Contagious Interview," flooding npm with 338 malicious packages to deliver BeaverTail/InvisibleFerret. The campaign targets Web3 developers via fake job offers.
Socket’s Threat Research Team has uncovered a massive supply-chain abuse campaign leveraging npm’s public registry and unpkg.com’s...
A new malicious npm package, "fezbox," hides a credential-stealing payload within a QR code, which it uses to exfiltrate web cookies and credentials.
The Shai-Hulud supply chain attack has compromised multiple CrowdStrike npm packages, injecting malware to steal credentials and data.
A sophisticated supply chain attack has compromised over 40 npm packages, including the popular TinyColor library, to steal developer credentials.