npm

April 2, 2026

Axios npm Supply Chain Breach: Microsoft Shares Mitigation Steps

Microsoft hasdetailed how organizations can detect and mitigate a recent supply chain compromise involving malicious Axios npm releases and infrastructure…
Read More »
April 1, 2026

Cisco Faces Alleged Data Leak as ShinyHunters Claims Responsibility

Cisco is actively dealing with a major cybersecurity incident after threat actors breached its internal development networks. The notorious hacking…
Read More »
March 31, 2026

Axios NPM Packages Breached in Ongoing Supply Chain Attack

A severe supply chain attack has compromised the widely used Axios HTTP client on the npm registry. Attackers injected a…
Read More »
March 26, 2026

GhostClaw AI Malware Targets macOS Users with Credential-Stealing Payloads

GhostClaw, a multi-stage macOS infostealer, now exploits both GitHub repositories and AI-assisted development workflows to steal credentials and deploy secondary…
Read More »
March 25, 2026

Five Malicious npm Packages Target Crypto Developers, Steal Wallet Keys via Telegram

Five malicious npm packages impersonating popular crypto libraries are stealing wallet keys from Solana and Ethereum developers and exfiltrating them…
Read More »
March 24, 2026

TeamPCP Unleashes Iran-Targeted CanisterWorm Kubernetes Wiper

CanisterWorm’s latest evolution turns TeamPCP’s cloud-native toolkit into a geopolitically tuned wiper, capable of bricking entire Kubernetes clusters when it…
Read More »
March 11, 2026

UNC6426 Hackers Exploit NPM Package to Gain AWS Admin Access in 72 Hours

Attackers turned a routine NPM update into a direct path to full AWS administrator access in under 72 hours, highlighting…
Read More »
December 11, 2025

19 Fake PNG Extensions Found in VS Code Marketplace

Researchers at ReversingLabs (RL) have uncovered a sophisticated supply chain campaign that involves 19 malicious Visual Studio Code (VS Code)…
Read More »
November 24, 2025

Zapier’s NPM Account Hacked, Multiple Packages Infected with Malware

Zapier’s NPM account has been successfully compromised, leading to the injection of the Shai Hulud malware into 425 packages currently…
Read More »
November 14, 2025

Malicious npm Package with 206K Downloads Targeting GitHub Repositories to Steal Tokens

On Friday, November 7th, Veracode Threat Research discovered a dangerous typosquatting campaign targeting developers using GitHub Actions. The malicious npm…
Read More »
November 7, 2025

Over 15 Malicious npm Packages Exploiting Windows to Deploy Vidar Malware

Datadog Security Research has uncovered a sophisticated supply chain attack targeting the npm ecosystem, involving 17 malicious packages across 23…
Read More »
October 14, 2025

Hackers Target macOS Users with Fake Homebrew Websites to Deliver Malicious Payloads

In September 2025, Kandji’s security researchers uncovered a sophisticated campaign in which attackers deployed multiple spoofed Homebrew installer sites that…
Read More »
October 12, 2025

Threat Actors Exploit Discord Webhooks for C2 via npm, PyPI, and Ruby Packages – GBHackers Security

Threat actors are increasingly abusing Discord webhooks as covert command-and-control (C2) channels inside open-source packages, enabling stealthy exfiltration of secrets,…
Read More »
September 26, 2025

Malicious MCP Server Discovered Stealing Sensitive Emails Using AI Agents

Enterprises everywhere are embracing MCP servers—tools that grant AI assistants “god-mode” permissions to send emails, run database queries, and automate…
Read More »
August 23, 2025

10 Best Network Monitoring Tools in 2025

The digital landscape in 2025 is more complex than ever, with organizations relying on intricate hybrid, cloud, and on-premises networks…
Read More »
August 17, 2025

Threat Actors Abuse npm Developer Accounts Hijacked to Spread Malicious Packages

A sophisticated phishing campaign targeting the maintainer of eslint-config-prettier, a widely-used npm package with over 3.5 billion downloads, resulted in…
Read More »
July 22, 2025

Scavenger Malware Compromises Popular npm Packages to Target Developers

The well-known npm package eslint-config-prettier was released without authorization, according to several GitHub users, even though its repository did not…
Read More »
July 10, 2025

Weaponized AI Extension Used by Hackers to Swipe $500,000 in Crypto

A Russian blockchain engineer lost over $500,000 in cryptocurrency holdings in June 2025 after being the victim of a carefully…
Read More »
May 17, 2025

Sophisticated NPM Attack Leverages Google Calendar2 for Advanced Communication

A startling discovery in the npm ecosystem has revealed a highly sophisticated malware campaign embedded within the seemingly innocuous package…
Read More »
April 4, 2025

Vite Development Server Flaw Allows Attackers Bypass Path Restrictions

A critical security vulnerability, CVE-2025-31125, has been identified in the Vite development server. Due to improper path verification during URL request…
Read More »

Previous page Next page