npm · page 2

Cybersecurity researchers have identified two hijacked npm packages and a group of Go packages that are actively distributing a Python-based information stealer. These malicious packages target Windows, Linux, and macOS operating systems, aiming to compromise user data.

Miasma malware has escalated its supply chain attacks by compromising new npm packages and exploiting GitHub Actions, building upon previous campaigns involving the Mini Shai-Hulud and Hades malware families. Researchers observed malicious npm releases targeting the LeoPlatform and RStreams packages…

Malicious npm packages masquerading as PostCSS tools were discovered on March 10, 2024, by security researchers, designed to deploy a Windows remote access trojan (RAT). The identified packages include "aes-decode-runner-pro" with 145 downloads, "postcss-minify-selector" with 256 downloads, and "postcss-minify-selector-parser"…

144 npm packages within the Mastra namespace (@mastra/*) were compromised on March 15, 2024, due to a software supply chain attack identified as easy-day-js. This attack targeted a single npm account, ehindero, which was used to mass-publish malicious code…

GitHub announced significant changes to npm version 12, including disabling install scripts by default, to mitigate software supply chain attacks. These changes target malicious techniques that exploit the "npm install" command and its lifecycle hooks to execute harmful code.