Axios compromised on NPM – Malicious versions drop remote access trojan(stepsecurity.io)

1891 points by mtud 6 months ago | 763 comments

StepSecurity blog post reporting that a hijacked maintainer account published malicious axios versions 1.14.1 and 0.30.4 on npm that drop a cross-platform RAT.

Active NPM supply chain attack: Tinycolor and 40 Packages Compromised(socket.dev)

29 points by feross 1 year ago | 4 comments

Tj-actions/changed-files GitHub Action Compromised – used by over 23K repos(stepsecurity.io)

215 points by varunsharma07 1 year ago | 254 comments

Disrupting supply chain attacks on NPM and GitHub Actions(github.blog)

77 points by nyku 2 months ago | 26 comments

GitLab discovers widespread NPM supply chain attack(about.gitlab.com)

330 points by OuterVale 11 months ago | 181 comments

GitLab blog post describing a widespread npm supply chain malware attack that includes a "dead man's switch" capable of harming user data.

GitHub Copilot CLI downloads and executes malware(promptarmor.com)

43 points by sarelta 8 months ago | 12 comments

NPM debug and chalk packages compromised(aikido.dev)

1287 points by universesquid 1 year ago | 699 comments

Aikido Security blog post reporting that the popular npm packages debug and chalk were compromised with malicious code in a supply-chain attack.

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised(safedep.io)

350 points by theanonymousone 5 months ago | 272 comments

SafeDep blog post analyzing a new Mini Shai-Hulud supply-chain malware campaign that compromised over 300 npm packages.

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library(semgrep.dev)

450 points by j12y 5 months ago | 172 comments

Semgrep security research post reporting that PyPI package lightning versions 2.6.2 and 2.6.3 were compromised with Shai-Hulud themed credential-stealing malware.

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware(github.com)

367 points by tosh 1 year ago | 263 comments

GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.

What a Hacker Stole from Me(mynoise.net)

355 points by wonger_ 1 year ago | 106 comments

A myNoise blog post by founder Stéphane describing a hacker's attack on the myNoise website, first via code-injection attempts and then a different strategy.

Shai-Hulud Returns: Over 300 NPM Packages Infected(helixguard.ai)

967 points by mrdosija 11 months ago | 733 comments

HelixGuard blog post reporting that the Shai-Hulud worm returned, infecting over 300 npm packages via a fake Bun runtime within hours.