DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware (github.com)

Screenshot of aikido.dev: NPM debug and chalk packages compromised

NPM debug and chalk packages compromised (aikido.dev)

1287 points by universesquid 1 year ago | 699 comments

Aikido Security blog post reporting that the popular npm packages debug and chalk were compromised with malicious code in a supply-chain attack.

npm supply-chain-attack malware javascript

Screenshot of arstechnica.com: NPM flooded with malicious packages downloaded more than 86k times

NPM flooded with malicious packages downloaded more than 86k times (arstechnica.com)

349 points by jnord 1 year ago | 248 comments

Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.

npm supply-chain-attack malware phantomraven

Screenshot of github.com: Malicious versions of Nx and some supporting plugins were published

Malicious versions of Nx and some supporting plugins were published (github.com)

427 points by longcat 1 year ago | 421 comments

GitHub security advisory from the nrwl/nx repository reporting that malicious versions of Nx and several supporting npm plugins were published.

supply-chain-attack nx npm malware

Screenshot of github.com: RCE Vulnerability in React and Next.js

RCE Vulnerability in React and Next.js (github.com)

559 points by rayhaanj 10 months ago | 214 comments

GitHub security advisory GHSA-9qr9-h5gf-34mp for a critical (CVSS 10.0) remote code execution vulnerability in React Server Components affecting Next.js, with patched versions listed.

nextjs react-server-components rce vulnerability

Screenshot of nikolasgoebel.com: DuckDB Doesn't Need Data to Be a Database

DuckDB Doesn't Need Data to Be a Database (nikolasgoebel.com)

353 points by tosh 2 years ago | 115 comments

A blog post by Nikolas Göbel discussing how DuckDB can act as a database without storing data itself, querying external data sources directly.

duckdb databases storage-compute-separation sql

Screenshot of about.gitlab.com: GitLab discovers widespread NPM supply chain attack

GitLab discovers widespread NPM supply chain attack (about.gitlab.com)

330 points by OuterVale 11 months ago | 181 comments

GitLab blog post describing a widespread npm supply chain malware attack that includes a "dead man's switch" capable of harming user data.

npm supply-chain-attack malware gitlab

Looks similar

RCE Vulnerability in React and Next.js (github.com)

Notepad++ Zero-Click RCE via Path Traversal (CVE-2026-52884)(github.com)

Trivy ecosystem supply chain briefly compromised (github.com)

DuckDuckGo for Mac is now open source (github.com)

Show HN: Tips to stay safe from NPM supply chain attacks (github.com)

Composer leaks contents of tokens configured as GitHub OAuth tokens (github.com)

Related stories

NPM debug and chalk packages compromised (aikido.dev)

NPM flooded with malicious packages downloaded more than 86k times (arstechnica.com)

Malicious versions of Nx and some supporting plugins were published (github.com)

RCE Vulnerability in React and Next.js (github.com)

DuckDB Doesn't Need Data to Be a Database (nikolasgoebel.com)

GitLab discovers widespread NPM supply chain attack (about.gitlab.com)