Do Son A key npm maintainer's account was compromised, leading to a supply chain attack. Malicious code in popular packages is stealing crypto during transactions.
npm
A new report reveals that malicious npm packages are using Ethereum smart contracts as resilient command-and-control servers, a new tactic in open-source attacks.
A malicious npm package impersonates the popular nodemailer library to inject code into crypto wallets on developers' PCs and steal funds from outgoing transactions.
A supply chain attack on the Nx build system is stealing crypto wallets and SSH keys from developers. The malware also abuses AI tools for data exfiltration.
A critical directory traversal vulnerability (CVE-2025-48387) in the popular NPM package tar-fs allows attackers to write arbitrary files and gain RCE.
A phishing attack compromised the maintainer of a popular npm package, eslint-config-prettier, leading to the spread of malware to thousands of projects.
Two malicious npm packages disguised as WhatsApp libraries contain a kill switch that remotely wipes a developer's system if their phone number isn't whitelisted.
Veracode warns of a North Korean cyber-espionage campaign using malicious NPM packages to spread Beavertail malware and steal crypto from developers via fake interview tasks.
North Korea's Lazarus Group is waging a covert cyberespionage campaign, poisoning 234+ open-source packages on npm/PyPI to steal secrets from CI/CD pipelines and developer environments.
A phishing attack compromised the 'is' npm library maintainer, leading to malicious versions being published with backdoors for remote code execution. Update immediately!
Socket discovered 10 malicious npm packages from Toptal's GitHub, exfiltrating GitHub tokens and wiping systems. The compromise vector is under investigation.
Four open-source packages on npm and PyPI (56k+ downloads) are secretly deploying sophisticated spyware, performing webcam surveillance, keylogging, and credential theft.
A sophisticated phishing campaign using a typosquatting domain (npnjs.com) stole an npm maintainer's credentials, injecting malware into popular packages like eslint-config-prettier and synckit.
Socket researchers uncovered widespread "protestware" in 28+ npm packages, silently disabling mouse interactions and playing the Ukrainian anthem for Russian-language users.
North Korean APTs are using XORIndex malware in a new npm supply chain attack, infiltrating developers via 67 malicious packages to steal crypto wallets and credentials.
North Korean APTs are using 35 typosquatted npm packages and fake job offers to spread HexEval, BeaverTail, and InvisibleFerret malware, stealing crypto and data from developers.
Two critical flaws (CVE-2025-6545, CVE-2025-6547, CVSS 9.1) in pbkdf2 npm package allow silent compromise of cryptographic keys. Update to 3.1.3+ immediately!
PoCGen is a new AI tool using LLMs, static, and dynamic analysis to automate PoC exploit generation for npm vulnerabilities, achieving high success rates at low cost.
Two malicious npm packages, express-api-sync and system-health-sync-api, act as remote-controlled time bombs, wiping entire directories with a single POST request.
Socket discovers 4 malicious npm packages designed to drain crypto wallets on BSC & Ethereum, downloaded over 2,100 times.
A new npm supply chain attack, "xlsx-to-json-lh," uses typosquatting to enable remote code execution, silently awaiting a "kill switch" to delete project directories.
An active npm malware campaign uses over 60 packages to steal internal/external IP addresses, hostnames, and user paths, designed for enterprise network mapping.