npm
-
The Provenance Gap: Analyzing Scope Squatting Vulnerabilities in ClawHub’s Plugin Registry
A critical supply-chain weakness has been identified within the ClawHub plugin registry, specifically concerning a failure in namespace enforcement. This…
Read More » -
Sapphire Sleet Compromises Node.js: Account Takeover, Typosquatting, and Multi-Stage Payloads in @mastra
A sophisticated supply chain attack has been identified targeting the Node.js ecosystem, attributed to the North Korean state-sponsored actor Sapphire…
Read More » -
Supply Chain Warfare: Advanced Typosquatting Targets Web3 Development Ecosystems
Threat actors are increasingly weaponizing the inherent trust placed in open-source dependencies to target Web3 engineering teams. By deploying sophisticated…
Read More » -
The End of Implicit Trust: How npm v12 Introduces Zero Trust for the JavaScript Ecosystem
GitHub has announced a significant architectural shift for the Node Package Manager with the upcoming release of npm v12. This…
Read More » -
Mass Repository Takedown: Analyzing the GitHub Enforcement Wave Against Microsoft Organizations
In a highly compressed window of just 105 seconds, GitHub executed a sweeping enforcement action, disabling 73 repositories distributed across…
Read More » -
Critical Security Alert: Persistent Remote Access Malware Discovered in npm Package ‘dbmux’
A severe supply-chain compromise has been identified within the dbmux npm package. Security researchers have issued a high-priority warning: any…
Read More » -
The Evolution of PyPI Supply Chain Attacks: Analyzing the Newest Waves of Shai-Hulud, Miasma, and Hades
For security researchers and DevOps engineers, the landscape of software supply chain attacks is often a game of cat and…
Read More » -
Architectural Vulnerabilities in AI Tooling: Analyzing the Claude Code MCP Token Hijacking Chain
Recent security research has identified a sophisticated Man-in-the-Middle (MitM) attack vector targeting the Claude Code ecosystem. By exploiting the Model…
Read More » -
The “Miasma” Worm and the Rise of “Phantom Gyp” Supply Chain Attacks
On June 3, 2026, the developer ecosystem faced a highly coordinated and rapid-fire supply chain assault. In a window of…
Read More » -
Deconstructing “Zapocalypse”: A Sophisticated Multi-Stage Attack Chain
The security research community was recently alerted to a critical vulnerability chain dubbed “Zapocalypse.” This discovery demonstrates how a seemingly…
Read More » -
codexui-android Supply Chain Attack: Stealing AI Tokens Through npm and Android
A sophisticated supply chain attack has been identified targeting the AI development ecosystem, leveraging a deceptive developer tool named codexui-android…
Read More » -
Deep Dive: Analyzing Quasar Linux (QLNX), the Stealthy Supply-Chain Trojan
A sophisticated new threat actor has emerged in the Linux ecosystem: Quasar Linux (QLNX). Despite its name, this is not…
Read More » -
SEO Poisoning: Threat Actors Target AI Developers via Malicious CLI Impersonation
A sophisticated SEO poisoning campaign is currently targeting the developer community, leveraging the rapid adoption of AI-driven development tools to…
Read More »