npm

Cybersecurity researchers have identified a significant threat to software developers, uncovering a cluster of 101 malicious npm packages designed to forcibly subscribe users to WhatsApp groups. This campaign, dubbed PhantomSub, exploits the 'Baileys' open-source WhatsApp project to add unsuspecting victims…

Cybersecurity researchers have disclosed the existence of a malicious npm package, identified as "tw-pkgprobe-7731," which has been strategically designed to deceive developers by posing as a legitimate security tool. This package was uploaded to the npm registry, a vast…

A sophisticated npm malware campaign, exemplified by the 'indexed-btree' package, has demonstrated a novel method for evading supply chain security defenses. Threat actors are now embedding malicious code within a package's normal runtime operations, rather than relying on traditional installation…

A financially motivated threat actor has been identified as the likely developer and distributor of PhantomRaven, a JavaScript-based information stealer distributed through the npm package registry. Security researchers have assessed with high confidence that the malware was developed using…

Authorities in Australia have apprehended two men, aged 21 and 23, who are believed to be key figures within TeamPCP, a sophisticated cybercrime syndicate notorious for orchestrating what is considered the longest-running spree of software supply chain attacks ever recorded.

Threat actors have been observed exploiting the Node Package Manager (npm) and its distributed mirror infrastructure to host malicious HTML pages designed to facilitate phishing attacks. These pages are crafted to impersonate Cloudflare's CAPTCHA verification system, a common security measure…

Cybersecurity researchers have uncovered a campaign involving 24 npm packages that are being leveraged as phishing infrastructure. These packages exploit unpkg mirrors to host fake Cloudflare CAPTCHA pages, designed to trick users into revealing sensitive information.

A significant campaign has introduced nearly 800 malicious packages to the npm registry, designed to distribute cross-platform malware capable of targeting Windows, macOS, and Linux operating systems. These packages employ a strategy of AI-generated "slop squatting" or random typo-squatting…

A sophisticated npm worm, initially identified within the keyv package version 6.0.0, has expanded its reach significantly, infecting hundreds of software packages across multiple organizations. The malicious code first surfaced in the Keyv and Cacheable namespaces before spreading more broadly.

Cybersecurity researchers have identified 18 malicious npm packages that deliver a cross-platform remote access trojan (RAT) to users of Alibaba developer tools. This discovery, detailed in a report by ReSecurity, points to a sophisticated, targeted software supply chain attack aimed…

Amazon Web Services (AWS) has linked several significant open-source software supply chain attacks within the Node Package Manager (npm) ecosystem to North Korean state-sponsored hacking groups. These attacks, which targeted widely used packages, aimed to compromise developers' systems and potentially…

Cybersecurity researchers have identified seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The campaign, codenamed ViteVenom by Checkmarx, utilizes an "unprecedented" four-tier blockchain-based command-and-control (C2) infrastructure.

Five malicious versions of AsyncAPI npm packages were published to the Node Package Manager (npm) in a supply-chain attack. These compromised packages delivered a remote access trojan designed with info-stealing capabilities.

Four npm packages within the @asyncapi namespace have been compromised and are distributing multi-stage botnet malware, as reported by OX Security, SafeDep, Socket, and StepSecurity. The identified malicious packages include @asyncapi/generator-helpers version 1.1.1, @asyncapi/generator-components version 0.7.1, @asyncapi/generator version 3.3.1…

A malicious campaign involving 148 npm packages, masquerading as student web proxies, successfully transformed visitors' browsers into a distributed denial-of-service (DDoS) botnet. This operation persisted for approximately two weeks in May, as detailed in recent research from JFrog.

Security researchers at Socket detected an attempted backdoor insertion into the Injective Protocol's official npm package. The malicious code, if successfully deployed, would have aimed to steal users' Injective wallet keys.

Hackers compromised the Injective Labs SDK project's GitHub repository and subsequently published a malicious package on the Node Package Manager (npm). This compromised package was designed to steal cryptocurrency wallet private keys and mnemonic seed phrases from unsuspecting users.

GitHub announced the release of npm version 12, which disables install scripts by default to enhance supply chain security. This change makes previously automatic npm install behaviors opt-in, with `allowScripts` now defaulting to off.

Malicious software packages impersonating legitimate Software Development Kits (SDKs) for Paysafe, Skrill, and Neteller have been discovered on the Node Package Manager (npm) and the Python Package Index (PyPI) platforms.

Threat actors associated with North Korea have deployed malicious npm packages designed to steal developer secrets and provide remote access. JFrog researchers identified these packages, "rollup-packages-polyfill-core" and "rollup-runtime-polyfill-core," which closely imitate the legitimate "rollup-plugin-polyfill-node" project.