The popular NPM package 'is' has been compromised in a supply chain attack that injected backdoor malware, giving attackers full access to compromised devices. This occurred after maintainer accounts ...

Malicious Jscrambler NPM package versions distributed a cross-platform credential stealer in a new supply chain attack.

What is Mini Shai-Hulud npm supply chain attack, and was Microsoft and Socket hit by malware? A new software supply chain attack has affected the npm ecosystem and raised concern across developer and ...

Malicious jscrambler 8.14.0 runs hidden binaries during npm install on Windows, macOS, and Linux, with no fix available as of ...

Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that ...

JFrog says six malicious npm packages used hidden install-time execution, JSONKeeper fetches, and sandbox checks to enable remote access.

Upwind traces multiple compromised AsyncAPI npm packages to a coordinated supply chain attack targeting software release pipelines and publishing identities.

That it's an abbreviation is not really relevant here. It sort of stands for "node package manager" but that really doesn't tell you anything. It consists of a command line client, also called npm, ...

Hackers created a fake trading bot for Polymarket’s prediction markets on GitHub. The bot was used to spread malware that steals credentials like wallet keys and browser passwords. 30 malicious ...

Malicious code continues to be uploaded to open source repositories, making it a challenge for responsible developers to trust what’s there, and for CISOs to trust applications that include open ...

An attack targeting the Node.js ecosystem was just identified — but not before it compromised 18 npm packages that account for billions of weekly downloads. In a massive attack on the JavaScript ...

NPM, the Node Package Manager, hosts millions of packages and serves billions of downloads annually. It has served well over the years but has its shortcomings, including with TypeScript build ...