A major JavaScript supply-chain attack has compromised hundreds of software packages — including at least 10 used widely ...

Cybersecurity researchers have revealed a set of seven npm packages published by a single threat actor. These packages use a ...

Charlie Eriksen, a researcher at Aikido, identified the infected libraries and confirmed each detection manually to minimize ...

Shai-Hulud malware infiltrates 490 NPM packages, stealing API keys and credentials from ENS and major crypto development ...

Cybersecurity researchers have discovered a set of seven npm packages published by a single threat actor that leverages a cloaking service called Adspect to differentiate between real victims and ...

Sha1-Hulud malware is an aggressive npm supply-chain attack compromising CI/CD and developer environments. This blog addresses frequently asked questions and advises cloud security teams to ...

The latest version also executes malicious code during the preinstall phase, and is bigger and faster than the first wave, ...

A new version of the Shai-Hulud worm has infected hundreds of npm packages and caused disruption to global CI/CD workflows ...

NPM has removed multiple packages hosted on its repository this week that established connection to remote servers and exfiltrated user data. These 4 packages had collected over 1,000 total downloads ...

Following the first Shai-Hulud attacks, which infected more than 500 packages in total, and GitHub having to scour its users' ...