Cybersecurity researchers have discovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate " ...

The typosquatted “@acitons/artifact” package targeted GitHub’s CI/CD workflows, stealing tokens and publishing malicious ...

The coordinated campaign has so far published as many as 46,484 packages, according to SourceCodeRED security researcher Paul ...

A threat actor has published tens of thousands of malicious NPM packages that contain a self-replicating worm, security ...

Goal is to steal Tea tokens by inflating package downloads, possibly for profit when the system can be monetized.

Israeli security researchers identified a malicious spyware campaign in the NPM ecosystem that remained hidden from most ...

The world's biggest tech companies use a program liable to introduce malware in their software. The potential consequences ...

Developers will have to contend with a dormant turned active malicious code on Visual Studio Code (VS Code) extensions, which ...

PhantomRaven slipped over a hundred credential-stealing packages into npm A new supply chain attack dubbed PhantomRaven has flooded the npm registry with malicious packages that steal credentials, ...

Recently, security researchers Socket found 10 packages on npm targeting software developers, specifically those who use the npm (Node Package Manager) ecosystem to install JavaScript and Node.js ...

A new proof-of-concept attack shows that malicious Model Context Protocol servers can inject JavaScript into Cursor’s browser ...

Sharp7Extend was programmed differently in that it does not have a delayed fuse. Downloaded more than 2,000 times according ...