#npm-supply-chain
#npm-supply-chain
[ follow ]
fromTheregister
1 week agoPoisoned WhatsApp API package steals messages and accounts
In addition to working as advertised, the secret-stealing library, which is a fork of the legitimate @whiskeysockets/baileys package, uses WebSocket to communicate with WhatsApp. However, this means that every WhatsApp communication passes through the socket wrapper, allowing it to capture your credentials when you log in and intercept messages as they are sent and received. "All your WhatsApp authentication tokens, every message sent or received, complete contact lists, media files - everything that passes through the API gets duplicated and prepared for exfiltration," Admoni wrote.
Information security
Information security
fromThe Hacker News
1 month agoNorth Korean Hackers Deploy 197 npm Packages to Spread Updated OtterCookie Malware
North Korean threat actors published 197 malicious npm packages delivering OtterCookie/BeaverTail malware that establishes C2 and steals credentials, clipboard, keystrokes, screenshots, and wallets.
fromTechzine Global
1 month agoCritical vulnerability exposed in JavaScript library expr-eval
A critical security vulnerability in the popular JavaScript library expr-eval allows remote code execution. The bug, with a CVSS score of 9.8, affects hundreds of projects and is forcing developers to migrate to a secure version quickly. The vulnerability, registered as CVE-2025-12735, is listed in the US National Vulnerability Database (NVD) and is considered one of the most serious security issues in recent JavaScript ecosystems.
Information security
Information security
fromIT Pro
2 months agoHackers are using these malicious npm packages to target developers on Windows, macOS, and Linux systems - here's how to stay safe
Typosquatted npm packages delivered a PyInstaller 24MB infostealer across Windows, macOS, and Linux using multi-layer obfuscation, fake CAPTCHA, and IP fingerprinting.
[ Load more ]