GitHub Copilot CLI downloads and executes malware(promptarmor.com)

43 points by sarelta 8 months ago | 12 comments

GitLab discovers widespread NPM supply chain attack(about.gitlab.com)

330 points by OuterVale 11 months ago | 181 comments

GitLab blog post describing a widespread npm supply chain malware attack that includes a "dead man's switch" capable of harming user data.

Telnyx package compromised on PyPI(aikido.dev)

70 points by overflowy 7 months ago | 25 comments

Flock Hardcoded the Password for America's Surveillance Infrastructure 53 Times(nexanet.ai)

456 points by fuck_flock 9 months ago | 147 comments

Nexanet threat intel blog post reporting that Flock Safety hardcoded a password 53 times across its surveillance infrastructure software.

InfluxDB 3.0 System Architecture(influxdata.com)

52 points by ren_engineer 3 years ago | 15 comments

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised(safedep.io)

350 points by theanonymousone 5 months ago | 272 comments

SafeDep blog post analyzing a new Mini Shai-Hulud supply-chain malware campaign that compromised over 300 npm packages.

NPM flooded with malicious packages downloaded more than 86k times(arstechnica.com)

349 points by jnord 1 year ago | 248 comments

Ars Technica article on the PhantomRaven campaign, in which malicious NPM packages that fetch dependencies from untrusted sites were downloaded over 86,000 times.

Shai-Hulud malware attack: Tinycolor and over 40 NPM packages compromised(socket.dev)

1182 points by jamesberthoty 1 year ago | 965 comments

StepSecurity blog post reporting that @ctrl/tinycolor and 40+ npm packages were compromised by self-propagating malware that steals cloud credentials.

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised(safedep.io)

350 points by theanonymousone 5 months ago | 272 comments

SafeDep blog post analyzing a new Mini Shai-Hulud supply-chain malware campaign that compromised over 300 npm packages.

DuckDB NPM packages 1.3.3 and 1.29.2 compromised with malware(github.com)

367 points by tosh 1 year ago | 263 comments

GitHub security advisory reporting that DuckDB npm packages (duckdb 1.3.3, node-api, node-bindings, duckdb-wasm 1.29.2) were published with malware, listing patched versions.

Shai-Hulud Themed Malware Found in the PyTorch Lightning AI Training Library(semgrep.dev)

450 points by j12y 5 months ago | 172 comments

Semgrep security research post reporting that PyPI package lightning versions 2.6.2 and 2.6.3 were compromised with Shai-Hulud themed credential-stealing malware.

50% of new NPM packages are spam(blog.sandworm.dev)

417 points by miohtama 3 years ago | 277 comments

Sandworm blog post reporting that roughly half of newly published npm packages are SEO spam, illustrated with a Futurama meme.