SHA1-Hulud the Second Comming – Postman, Zapier, PostHog All Compromised via NPM(aikido.dev)

317 points by birdculture 11 months ago | 98 comments

Aikido Security blog post reporting a second Shai Hulud npm supply-chain attack compromising packages from Zapier, ENS, AsyncAPI, PostHog, and Postman.

Telnyx package compromised on PyPI(aikido.dev)

70 points by overflowy 7 months ago | 25 comments

Keyv and friends compromised in active Shai-Hulud supply chain attack(aikido.dev)

238 points by cimi_ 2 months ago | 126 comments

Pnpm has a new setting to stave off supply chain attacks(pnpm.io)

191 points by ivanb 1 year ago | 121 comments

Hackers are spoofing themselves as GitHub's Dependabot to steal user passwords(checkmarx.com)

59 points by Beggers1960 3 years ago | 30 comments

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised(safedep.io)

350 points by theanonymousone 5 months ago | 272 comments

SafeDep blog post analyzing a new Mini Shai-Hulud supply-chain malware campaign that compromised over 300 npm packages.

Upcoming breaking changes for npm v12(github.blog)

459 points by plasma 4 months ago | 189 comments

GitHub Changelog post announcing upcoming breaking changes in npm version 12.

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware(github.com)

367 points by tosh 1 year ago | 263 comments

GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.

NPM flooded with malicious packages downloaded more than 86k times(arstechnica.com)

349 points by jnord 1 year ago | 248 comments

Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.

Malicious versions of Nx and some supporting plugins were published(github.com)

427 points by longcat 1 year ago | 421 comments

GitHub security advisory from the nrwl/nx repository reporting that malicious versions of Nx and several supporting npm plugins were published.

Malicious npm packages detected across Red Hat Cloud Services(github.com)

728 points by kurmiashish 4 months ago | 411 comments

GitHub issue in RedHatInsights/javascript-clients reporting malicious npm releases published under the @redhat-cloud-services scope, citing StepSecurity analysis.

RCE Vulnerability in React and Next.js(github.com)

559 points by rayhaanj 10 months ago | 214 comments

GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.