#npm
#npm

2 weeks ago

Information security

Malicious npm packages contain Vidar infostealer

Information security

NPM package caught using QR Code to fetch cookie-stealing malware

fromFuturism

Information security

CrowdStrike Infested With "Self-Replicating Worms"

Privacy technologies

fromArs Technica

Supply-chain attacks on open source software are getting out of hand

Malicious npm and PyPI packages enable surveillance malware and have been installed over 56,000 times.

JavaScript

npm phishing attack laces popular packages with malware

The npm package 'is' was infected with cross-platform malware due to a phishing attack via a typosquatted clone of the npm site.

fromTechzine Global

19 hours ago

Information security

NPM hit again by Shai-Hulud worm attack

2 weeks ago

Information security

Malicious npm packages contain Vidar infostealer

Information security

NPM package caught using QR Code to fetch cookie-stealing malware

fromFuturism

Information security

CrowdStrike Infested With "Self-Replicating Worms"

fromArs Technica

Privacy technologies

Supply-chain attacks on open source software are getting out of hand

JavaScript

npm phishing attack laces popular packages with malware

Information security

Shai-Hulud worm returns stronger and more automated than ever before

Information security

Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft

Information security

Crims flood npm with 150K+ junk packages to farm TEA tokens

fromInfoQ

Information security

NPM Ecosystem Suffers Two AI-Enabled Credential Stealing Supply Chain Attacks

fromDevOps.com

Information security

Shai-Hulud Attacks Shake Software Supply Chain Security Confidence - DevOps.com

Information security

Self-propagating supply chain attack hits 187 npm packages - DataBreaches.Net

fromCyberScoop

Information security

Shai-Hulud worm returns stronger and more automated than ever before

Information security

Second Sha1-Hulud Wave Affects 25,000+ Repositories via npm Preinstall Credential Theft

Information security

Crims flood npm with 150K+ junk packages to farm TEA tokens

fromInfoQ

Information security

NPM Ecosystem Suffers Two AI-Enabled Credential Stealing Supply Chain Attacks

fromDevOps.com

Information security

Shai-Hulud Attacks Shake Software Supply Chain Security Confidence - DevOps.com

Information security

Self-propagating supply chain attack hits 187 npm packages - DataBreaches.Net

more#supply-chain-attack

New Shai-Hulud worm spreading through npm, GitHub

A new version of the Shai-Hulud credentials-stealing self-propagating worm is expanding through the open npm registry, a threat that developers who download packages from the repository have to deal with immediately. Researchers at Wiz Inc. said Monday that in the early stages of the campaign late last week,a thousand new GitHub repositories containing harvested victim data were being added every 30 minutes. And researchers at JFrog identified 181 compromised packages.

Information security

#software-supply-chain

Information security

Wormable npm attack returns as 25,000 repos spill secrets

Information security

PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs

fromSecuritymagazine

Information security

2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss

Information security

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

Information security

Nx NPM packages poisoned in AI-assisted supply chain attack

Information security

Wormable npm attack returns as 25,000 repos spill secrets

Information security

PhantomRaven Malware Found in 126 npm Packages Stealing GitHub Tokens From Devs

fromSecuritymagazine

Information security

2B Weekly Downloads at Risk: Supply Chain Attack Targets Popular npm Packages, Security Leaders Discuss

Information security

20 Popular npm Packages With 2 Billion Weekly Downloads Compromised in Supply Chain Attack

more#software-supply-chain

Information security

Nx NPM packages poisoned in AI-assisted supply chain attack

#supply-chain-security

Information security

Worm flooding npm registry with token stealers still isn't under control

Information security

GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

Information security

Worm flooding npm registry with token stealers still isn't under control

more#supply-chain-security

Information security

GitHub Mandates 2FA and Short-Lived Tokens to Strengthen npm Supply Chain Security

Over 46,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

The coordinated campaign has so far published as many as 46,484 packages, according to SourceCodeRED security researcher Paul McCarty, who first flagged the activity. The end goal is quite unusual - It's designed to inundate the npm registry with random packages rather than focusing on data theft or other malicious behaviors. The worm-life propagation mechanism and the use of a distinctive naming scheme that relies on Indonesian names and food terms for the newly created packages have lent it the moniker IndonesianFoods.

Information security

#supply-chain

Information security

Malicious npm package sneaks into GitHub Actions builds

Information security

npm hit by PhantomRaven supply chain attack

Information security

Massive NPM Supply Chain Attack Hits Crypto Wallets - DataBreaches.Net

fromTechzine Global

Information security

Supply chain attack via Nx rages on GitHub

Information security

Wave of npm supply chain attacks exposes thousands of enterprise developer credentials

Information security

Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

Information security

Malicious npm package sneaks into GitHub Actions builds

Information security

npm hit by PhantomRaven supply chain attack

Information security

Massive NPM Supply Chain Attack Hits Crypto Wallets - DataBreaches.Net

fromTechzine Global

Information security

Supply chain attack via Nx rages on GitHub

Information security

Wave of npm supply chain attacks exposes thousands of enterprise developer credentials

Information security

Malicious Nx Packages in 's1ngularity' Attack Leaked 2,349 GitHub, Cloud, and AI Credentials

Node JS

Node.js tutorial: Get started with Node

fromnodesource.com

Node JS

15 Recent Node.js Features that Replace Popular npm Packages

Node JS

Node.js 24 drops MSVC support

Node JS

Node.js tutorial: Get started with Node

fromnodesource.com

Node JS

15 Recent Node.js Features that Replace Popular npm Packages

Node.js 24 drops MSVC support

Node.js 24 brings significant updates to the V8 engine and NPM, crucial for JavaScript development.

10 npm Packages Caught Stealing Developer Credentials on Windows, macOS, and Linux

Ten malicious npm packages deliver a multi-stage information stealer using obfuscation, fake CAPTCHA, IP fingerprinting, and a 24MB PyInstaller payload targeting Windows, Linux, and macOS.

fromArs Technica

NPM flooded with malicious packages downloaded more than 86,000 times

Attackers exploited NPM's Remote Dynamic Dependencies to publish over 100 credential-stealing packages that downloaded unseen malicious code from untrusted servers.

#phishing

Information security

175 Malicious npm Packages with 26,000 Downloads Used in Credential Phishing Campaign

fromCSO Online

JavaScript

Supply chain attack compromises npm packages to spread backdoor malware

fromTechRadar

JavaScript

More popular npm packages hijacked to spread malware

Information security

175 Malicious npm Packages with 26,000 Downloads Used in Credential Phishing Campaign

fromCSO Online

JavaScript

Supply chain attack compromises npm packages to spread backdoor malware

fromTechRadar

JavaScript

More popular npm packages hijacked to spread malware

GitHub Boosting Security in Response to NPM Supply Chain Attacks

GitHub will require two-factor authentication for local NPM publishing and deploy short-lived, granular tokens plus trusted publishing to mitigate NPM supply-chain attacks.

GitHub to remove weak security options for npm registry

GitHub is tightening npm publishing security by removing legacy authentication, shortening token lifetimes, enforcing 2FA, and shifting to trusted publishing with short-lived tokens.

fromZDNET

5 ways to spot software supply chain attacks and stop worms - before it's too late

Shai-Hulud is an ongoing, widespread npm software supply-chain worm attack compromising JavaScript packages and posing a major security crisis for JavaScript developers.

Web development

from2ality

Learning web development: Native package managers

Install an OS package manager to get native shell commands (like curl) that npm cannot provide, enabling non-JavaScript tools for web development tasks.

Web development

from2ality

Learning web development: Installing npm packages and bundling

Web apps use npm libraries, tests, and a bundling build step that outputs a single bundle and follows a project file structure.

Malicious npm Packages Exploit Ethereum Smart Contracts to Target Crypto Developers

Malicious npm packages used Ethereum smart contracts to hide commands and deliver downloader malware, leveraging GitHub repositories to lure developers and evade detection.

npm 'accidentally' removes Stylus package, breaks builds and pipelines

npm has taken down all versions of the real Stylus library and replaced them with a 'security holding' page, breaking pipelines and builds worldwide that rely on the package.

Web development

North Korean XORIndex malware hidden in 67 malicious npm packages

North Korean threat actors delivered malware through 67 malicious npm packages, affecting over 17,000 downloads.

fromInfoQ

5 months ago

Deno 2.3 Now Supports Local NPM Packages

Deno 2.3 enhances local NPM package support and deno compile for streamlined development.

#cybersecurity

fromDeveloper Tech News

5 months ago

Node JS

Veracode unravels 12-layer npm attack to find RAT

Growth hacking

Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

Three malicious npm packages targeting Cursor on macOS are stealing user credentials and distributing harmful upgrades to the software.

7 months ago

Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems

Three malicious npm packages disguised as a Telegram bot library have been found, containing SSH backdoors and data exfiltration functionalities.

fromDeveloper Tech News

5 months ago

Node JS

Veracode unravels 12-layer npm attack to find RAT

Growth hacking

Malicious npm Package Leverages Unicode Steganography, Google Calendar as C2 Dropper

Node JS

Malicious npm Packages Infect 3,200+ Cursor Users With Backdoor, Steal Credentials

7 months ago

Rogue npm Packages Mimic Telegram Bot API to Plant SSH Backdoors on Linux Systems

Three malicious npm packages disguised as a Telegram bot library have been found, containing SSH backdoors and data exfiltration functionalities.

NPM adds Workspaces for managing multiple packages

NPM 7.0.0 introduces Workspaces and automatic peer dependency installation, streamlining package management for developers.

fromSitePoint Forums | Web Development & Design Community

1 year ago

Deno boosts dependency management with JSR

Deno 1.42 includes major updates for Node.js and NPM compatibility, enhancing modules such as async_hooks, crypto, and worker_threads for improved performance.

Node JS

Unhandled Runtime Error ChunkLoadError

The Dockerfile demonstrates a streamlined setup for a Node.js application, starting from the lightweight Node.js 23-alpine image and ensuring the latest npm is installed.

Node JS