Do Son A new worm, Shai-Hulud, has compromised CrowdStrike’s NPM packages. The malware steals credentials and can spread rapidly across the developer ecosystem.
supply chain attack
The Shai-Hulud supply chain attack has compromised multiple CrowdStrike npm packages, injecting malware to steal credentials and data.
A sophisticated supply chain attack has compromised over 40 npm packages, including the popular TinyColor library, to steal developer credentials.
A key npm maintainer's account was compromised, leading to a supply chain attack. Malicious code in popular packages is stealing crypto during transactions.
A new report reveals that malicious npm packages are using Ethereum smart contracts as resilient command-and-control servers, a new tactic in open-source attacks.
Cloudflare confirms it was hit by the Salesforce supply chain attack, exposing customer support data. The company is urging users to rotate credentials.
A malicious npm package impersonates the popular nodemailer library to inject code into crypto wallets on developers' PCs and steal funds from outgoing transactions.
A new report reveals the TAOTH cyber-espionage campaign, which hijacks software updates and uses spear-phishing to deliver malware to high-value targets in Asia.
A loophole in the VS Code Marketplace allows attackers to reuse names of removed extensions to spread malware, a flaw that creates a new supply chain attack vector.
A supply chain attack on the Nx build system is stealing crypto wallets and SSH keys from developers. The malware also abuses AI tools for data exfiltration.
A dangerous Go package, disguised as a fast SSH brute-force tool, is secretly stealing login credentials and sending them to an attacker via a Telegram bot.
A critical flaw in the AI tool CodeRabbit allowed a researcher to gain RCE and write access to over a million repositories via a malicious pull request.
A new report reveals a malicious Python package on PyPI that uses a stealthy dependency and DLL sideloading to deliver a multi-stage malware.
PyPI is now checking for expired domains to prevent "domain resurrection attacks," a major step in securing the Python Package Index from account takeovers.
PyPI is implementing new restrictions to reject problematic ZIP archives and protect against "parser confusion" attacks, which could bypass security checks and smuggle malicious files.
Socket uncovers a long-running supply chain attack on RubyGems. A threat actor published 60 malicious gems stealing credentials from grey-hat marketers.
GitLab researchers uncovered a crypto scam on PyPI. Typosquatted Bittensor packages hijacked staking functions to silently drain users' crypto wallets.
Socket uncovers 11 malicious Go packages, including 8 typosquats, on GitHub. The packages deliver stealthy, in-memory payloads that compromise developer machines and CI pipelines.
Two malicious npm packages disguised as WhatsApp libraries contain a kill switch that remotely wipes a developer's system if their phone number isn't whitelisted.
A critical vulnerability (CVE-2025-54594, CVSS 9.1) in React Native Bottom Tabs’ GitHub Actions allowed RCE and secret exfiltration. The flaw was patched, and no packages were affected.
Veracode warns of a North Korean cyber-espionage campaign using malicious NPM packages to spread Beavertail malware and steal crypto from developers via fake interview tasks.
WithSecure uncovers a stealthy campaign using legitimate RMM tools embedded in PDFs to target European organizations, bypassing security with zero malware at initial entry.