A dangerous worm dubbed Shai-Hulud has been uncovered in the JavaScript ecosystem, infecting at least 187 packages in the NPM repository. What sets it apart is that it not only steals developer credentials but...
Researchers at Socket have disclosed a new attack against the npm ecosystem, in which more than 40 packages were discovered to be laced with embedded malicious code. The compromise mechanism was meticulously engineered: it...
The Chinese cybersecurity firm QiAnXin has identified a new campaign by the Lazarus group, which employs npm packages to launch supply chain attacks through a multi-tiered loading method to conceal the traces of their...
