The npm ecosystem is crucial for modern web development, but it faces risks from malicious libraries that impersonate trusted tools.

GitHub is introducing a set of defenses against supply-chain attacks on the platform that led to multiple large-scale incidents recently.

The notify-utilities package (version 1.3.5) impersonates the pino logger by copying its package.json description, keywords, and type definitions. Upon requiring and invoking its exported factory, it spawns a detached, unreferenced Node.js

Hackers hijacked the npm account for the popular Axios package and published two malicious releases that included a dependency which installs remote access trojans on Linux, Windows, and macOS. The tainted releases (axios@1.14.1 and axios@0.30.4) lacked OIDC provenance, were staged in advance with OS-specific droppers that self-destruct, and users are advised to pin to axios@1.14.0 and axios@0.30.3, rotate credentials, and rebuild from known-good states. #Axios #plain-crypto-js

https://www.osintinvestigate.com GuardBreaker exploits AI safety mechanisms to disrupt malware analysis, as Russia-aligned UAC-0099 targets AI-assisted cybersecurity workflows.

The 'merchantprefsservice-paypal' package at version 28.0.0 on npm is flagged as malicious due to its communication with a domain linked to malicious behavior. This classification comes from the OpenSSF Package Analysis project and is recor

Securing npm: DepsGuard and Red Hat's Backdoor Fiasco > **TL;DR:** Recent backdoors in Red Hat npm packages highlight the need for tools like DepsGuar

Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities.

The tinyparrot package version 0.4.1 includes a postinstall script (src/build.js) that reconstructs strings such as 'https', 'POST', and the destination host 'rnjkerbf.org/P' from integer-encoded arrays using base decoders in src/const.js a

Malicious npm packages are installing SSH backdoors, exfiltrating data from affected systems. #npmsecurity #typosquatting #supplychainattack

Lazarus group deploys new malware via npm packages, using advanced obfuscation. #npmsecurity #LazarusGroup #cybersecurity

North Korean Lazarus Group deploys malicious npm packages, targeting developers via typosquatting. #npmsecurity #LazarusGroup #supplychainattack

Malicious npm packages stole Ethereum developer keys; 1000+ downloads affected. #EthereumSecurity #NpmSecurity #SupplyChainAttack

Cybersecurity researchers have discovered a set of malicious npm packages that are designed to deliver a Windows-based remote access trojan (RAT). The list of identified packages, is below - aes-decode-runner-pro (145 downloads) postcss-minify-selector (256 downloads) postcss-minify-selector-parser (615 downloads) All the packages were published over the past month by an npm user named

60 packages have been discovered in the NPM index that attempt to collect sensitive host and network data and send it to a Discord webhook controlled by the threat actor.

Researchers have flagged a supply-chain worm dubbed CanisterSprawl that uses compromised npm packages and stolen developer npm tokens to push poisoned releases and self-propagate via malicious postinstall hooks. The campaign exfiltrates extensive developer secrets to an HTTPS webhook and an ICP canister, includes PyPI propagation logic, and sits alongside other attacks...

The Axios maintainers published a post-mortem showing a targeted social engineering campaign that led to malicious Axios npm releases (1.14.1 and 0.30.4) which injected a dependency, plain-crypto-js, that deployed a cross-platform RAT. Google TAG attributed the operation to North Korean actor UNC1069 using WAVESHAPER.V2, and maintainers have wiped affected systems, reset credentials, and advised rotating all keys. #Axios #UNC1069

A supply chain attack on the popular Axios NPM package published two backdoored releases that executed cross-platform payloads via a staged dependency and were downloaded by roughly 3% of users before removal. Security researchers attribute the operation to North Korean threat actor UNC1069, which used compromised maintainer credentials and long-lived NPM...

An attacker used compromised credentials of an Axios maintainer to publish poisoned npm packages that added a malicious dependency and executed a postinstall script to deploy a platform-specific Remote Access Trojan. Developers who ran npm install for the affected versions should treat build machines as fully compromised and rotate secrets immediately....