Tag: npm
137 articles
MALFEX Campaign Unveils imgdecode npm Package with Shellcode Loader
Meet the sneaky imgdecode npm package, which hides a malicious loader in its code, and has already been downloaded 979 times. This package secretly downloads and injects encrypted shellcode into a new process, making it a serious threat to Windows users.
Shai-Hulud Worm Compromises AI Platform Tensorlake
A malicious version of the Tensorlake SDK, downloaded around 12,000 times per week, was briefly infected with the Shai-Hulud worm, which could have allowed attackers to hijack credentials and sensitive data. Fortunately, the issue was quickly detected and resolved, with the package being pulled and updated to a safe version.
Malware Worm Exploits Tensorlake npm Package to Steal Credentials
A malware worm has been discovered exploiting the popular Tensorlake npm package to steal sensitive credentials, with the first malicious commit occurring on October 7, 2026, at 01:20 a.m. UTC. The compromised package, version 0.5.144, was quickly taken down after publishing to the npm registry on October 8, 2026.
Web3 Enables Sophisticated Cloud Supply Chain Attacks
Malware authors are now using blockchain technology to launch devastating cloud supply chain attacks, as seen in the ChainDrop attack that infected over 400 npm packages. This sneaky tactic uses a custom runtime to launch a credential harvester, allowing attackers to capture sensitive cloud provider IAM keys and more.
Malicious npm Packages Evade Traditional Defenses
Don't rely solely on install-time scanning to protect your projects - also use runtime behavioral analysis to catch malicious npm packages that can evade traditional defenses. JavaScript's widespread use has even led some to label it a bigger security pest than Flash.
Malicious MemTensor Packages Spread sckit Credential Stealer via npm and PyPI
Beware: compromised MemTensor packages on npm and PyPI are spreading a sneaky credential stealer called sckit, which can steal your sensitive info. Malicious actors have hijacked these packages to secretly install the sckit malware, putting your credentials at risk.
Malicious npm Package Exploits Twilio Developers for Credential Theft
Malicious actors have struck again, this time with a fake npm package called tw-pkgprobe-7731 that masquerades as a security research tool to steal credentials from unsuspecting Twilio developers. The package was cleverly designed to evade detection, only collecting and exfiltrating sensitive data when it detected a Twilio developer environment.
Attackers Exploit npm Trusted Publishing in GHAPPIER Supply Chain Campaign
Malicious actors have cleverly exploited npm's trusted publishing feature to unleash a supply-chain attack, using a hijacked maintainer account to distribute a sneaky loader called GHAPPIER. They got away with it by hiding behind a valid provenance attestation, highlighting a loophole in the system.
Malicious npm packages exploit runtime evasion tactics
Meet the sneaky npm package that impersonated a popular library, racking up 2 million weekly downloads before revealing its true malicious intent. This cleverly disguised package, indexed-btree, hid its payload in plain sight, masquerading as a legitimate tool until it was too late.
TanStack npm Attack Exposes 170 Private GitHub Repositories
A shocking npm attack on TanStack exposed a massive 170 private GitHub repositories after a malicious actor exploited a stolen OAuth token from a former employee's account. The breach was linked to a supply-chain compromise of TanStack's npm packages, tracked as CVE-2026-45321, which allowed attackers to steal sensitive credentials.
Threat Actors Target AI Coding Tools in Software Supply Chain Compromises
Threat actors are increasingly targeting AI coding tools to compromise software supply chains, with financially motivated groups like UNC6780 using malware like Dustmaker to gain initial access to AI environments. This growing trend highlights the need for heightened security measures in modern AI development pipelines.
Hackers Exploit npm Mirrors to Host Phishing Pages
Hackers are exploiting npm mirrors to host phishing pages by uploading malicious HTML files to the npm registry, which are then mirrored and can be accessed directly in a browser. This clever tactic turns the trusted registry into a free web host for malware, allowing threat actors to spread phishing pages under the guise of legitimate content.
npm Packages Host Fake Cloudflare CAPTCHA Pages via Unpkg Mirrors
Researchers uncovered a sneaky scam where attackers hide a fake Cloudflare CAPTCHA page inside harmless-looking npm packages, using mirrors to trick victims into revealing sensitive info. This clever tactic relies on exploiting trusted domains to deploy a ClickFix-style scam that redirects users to attacker-controlled infrastructure.
Supply Chain Attacks Target SDLC's Overlooked Corners
Meet the ChainDrop npm worm, a sneaky threat that infiltrated over 400 packages, including popular libraries like keyv and cacheable-request, by hiding in plain sight within routine developer workflows. This highly evasive threat uses a three-step chain to steal sensitive tokens and secrets, spreading its reach with alarming ease.
Malware Packages Exploit Ethereum for C2 Communications
Malicious actors have cleverly exploited Ethereum to spread malware, with six suspicious npm packages found querying an attacker-controlled wallet to fetch additional malicious payloads. This sneaky tactic was uncovered by Sonatype Research Labs on August 10, revealing a new level of sophistication in cyber attacks.
Malicious npm Packages Deliver Cross-Platform Malware
Nearly 800 malicious npm packages have been discovered delivering a potent cross-platform malware payload, including a remote access trojan and infostealer, via a sneaky trick that tricks developers into loading the malicious code. These packages use cleverly crafted names and README instructions to evade detection and deploy the WEL1DROPPER downloader.
Malware Worm Disrupts 440 npm Packages in Four Hours
In a shocking display of speed and agility, a malware worm spread its reach to over 440 npm packages in just four hours, leaving a trail of compromised code in its wake. The attack began with a single GitHub maintainer account, specifically targeting the popular data management interface package keyv, which boasts over 600 million monthly downloads.
npm Supply-Chain Attack Exposes Hundreds of Packages
A massive npm supply-chain attack has compromised at least 868 packages, with over 1,300 affected and a staggering 2 billion monthly downloads impacted. The self-propagating malware, ChainDrop, has spread rapidly, infecting widely-used caching utilities and leaving a trail of damage in its wake.
AWS Tracks North Korean Group in npm Supply Chain Attacks
AWS has uncovered a string of sneaky supply-chain attacks on popular npm libraries, and their threat intel team is pointing to a notorious North Korean group, known as Saphire Sleet, as the likely culprit. The attacks hit big-name libraries like axios, debug, and chalk, raising concerns about the security of the software supply chain.
Amazon Ties npm Hijack to North Korea's Sapphire Sleet
In a shocking supply-chain hijack, North Korea's Sapphire Sleet group compromised over 2 billion weekly downloads of popular npm packages, including debug and chalk, in a brazen attack tied to multiple other malicious campaigns. Amazon Threat Intelligence has linked this September 2025 incident to a string of attacks dating back to March 2025.
Compromised npm Packages Deliver DEV#POPPER Malware via Blockchain
Malicious npm packages have been discovered delivering DEV#POPPER malware via blockchain, with two beta releases in the @joyfill namespace containing a sneaky JavaScript implant that springs into action the moment Node.js loads the package. This stealthy implant can execute in any process that requires the compromised package, making it a serious threat.
Malicious Vite npm Packages Exploit Blockchain C2 for RAT Delivery
Security researchers have uncovered a sneaky campaign, dubbed ViteVenom, involving seven malicious npm packages that target Vite developers, executing malicious code as soon as they're imported. These packages, published in a matter of days, may have modest download counts, but their stealthy nature raises major red flags for the supply-chain community.
Malicious AsyncAPI Packages Target npm Users with Credential-Stealing Malware
On July 14, a supply-chain intrusion briefly introduced trojanized AsyncAPI packages into the npm ecosystem, putting users at risk of credential-stealing malware. Five malicious releases in the @asyncapi namespace were downloaded hundreds of thousands of times during a four-hour window.
Compromised AsyncAPI Packages Deliver Multi-Stage Botnet Malware
Malicious actors have compromised several AsyncAPI packages, delivering a sophisticated multi-stage botnet malware that uses a command framework with six independent communication channels. The affected packages include @asyncapi/generator-helpers, @asyncapi/generator-components, @asyncapi/generator, and @asyncapi/specs in specific versions.