npm security Archives • Information Security News

Mini Shai-Hulud Alert: TeamPCP Hijacks @tanstack and PyPI to Poison 12 Million Weekly Downloads A message left on the C2 domain

Mini Shai-Hulud Alert: TeamPCP Hijacks @tanstack and PyPI to Poison 12 Million Weekly Downloads

ddos May 14, 2026

The Mini Shai-Hulud incursion has once again laid siege to the software supply chain. While the initial...

The Trojan Coding Assistant: How a Compromised Token Pushed a Shadow Release of Cline PhantomVAI malware loader npm Token Farming SesameOp Malware Flyoobe Malware FlipSwitch Rootkit fezbox Malware ModStealer Malware NightshadeC2 OldGremlin AI ransomware LummaStealer Qilin, ransomware-as-a-service Human Cybersecurity Ransomware ACRStealer Interlock Ransomware OVERSTEP Rootkit Malduck WordPress Malware

PhantomVAI malware loader npm Token Farming SesameOp Malware Flyoobe Malware FlipSwitch Rootkit fezbox Malware ModStealer Malware NightshadeC2 OldGremlin AI ransomware LummaStealer Qilin, ransomware-as-a-service Human Cybersecurity Ransomware ACRStealer Interlock Ransomware OVERSTEP Rootkit Malduck WordPress Malware

The Trojan Coding Assistant: How a Compromised Token Pushed a Shadow Release of Cline

ddos February 23, 2026

An incident has transpired within the npm registry involving the Cline CLI utility; for a duration of...

The Async Escape: Critical 9.8 Flaw in vm2 Turns JavaScript Sandboxes Into Open Gateways University Cyberattacks Hacktivism Hanoi convention IT inspection Asterisk telephony Medical Data Breach Zero Trust Flaws MI6 Silent Courier Jaguar Land Rover cyberattack Clear NDR Zeppelin ransomware FTC encryption McDonald's security AI agents Radio Encryption

University Cyberattacks Hacktivism Hanoi convention IT inspection Asterisk telephony Medical Data Breach Zero Trust Flaws MI6 Silent Courier Jaguar Land Rover cyberattack Clear NDR Zeppelin ransomware FTC encryption McDonald's security AI agents Radio Encryption

The Async Escape: Critical 9.8 Flaw in vm2 Turns JavaScript Sandboxes Into Open Gateways

ddos February 3, 2026

A critical sandbox escape vulnerability has been unearthed within the vm2 library—a utility frequently employed as a...

npm security

Mini Shai-Hulud Alert: TeamPCP Hijacks @tanstack and PyPI to Poison 12 Million Weekly Downloads

The Trojan Coding Assistant: How a Compromised Token Pushed a Shadow Release of Cline

The Async Escape: Critical 9.8 Flaw in vm2 Turns JavaScript Sandboxes Into Open Gateways

You may have missed

The War for Your Documents: Why The Document Foundation is Challenging Microsoft’s OOXML Monopoly

Urgent Patch: Microsoft Defender Update Fixes Critical SYSTEM-Level Privilege Escalation Flaw

The Pre-Boot Breach: Microsoft Releases Critical Emergency Script to Defend Against “YellowKey” BitLocker Bypass

The Reddit Clone: Meta Secretly Launches “Forum” App to Unbundle Facebook Groups