Malicious npm packages evade install-script defenses at runtime:
An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat ...
bleepingcomputer.com/news/security/malicious-npm-packages-evade-install-script-defenses-at-runtime/
Similar to This
Previous
dlvr.it Oct 26
Worm armed 42 GitHub repos by hiding a payload too big to fail: Payload blobs measuring 12.9 to 13.7 MB were large enough to evade GitHub code search
theregister.com/security/2026/10/26/worm-armed-42-github-repos-by-hiding-a-payload-too-big-to-fail/5305570
dlvr.it Aug 15
ChainDrop worm crawls into npm supply chain, evades standard defenses: Shai-Hulud variant poisons 444 packages, spreads via tarballs and dev-tool hooks
theregister.com/security/2026/08/15/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses/5287958
Massive ChainDrop npm supply-chain attack infects hundreds of packages: Self-propagating malware named 'ChainDrop' has compromised more than 1 ...
bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/
dlvr.it Jul 30
Amazon links four poisoned npm packages to one North Korean crew: Researchers say Sapphire Sleet socially engineered maintainers before publishing malicious ...
theregister.com/cyber-crime/2026/07/30/amazon-links-four-poisoned-npm-packages-to-one-north-korean-crew/5281120
AsyncAPI npm packages infected with credential-stealing malware: Five malicious versions of AsyncAPI packages were published to the Node Package Manager ...
bleepingcomputer.com/news/security/-asyncapi-npm-packages-infected-with-credential-stealing-malware/
Microsoft links Mastra AI supply chain attack to North Korean hackers: Microsoft has attributed a recent Mastra AI supply chain attack that compromised more than ...
bleepingcomputer.com/news/security/microsoft-links-mastra-ai-supply-chain-attack-to-north-korean-hackers/
The New Stack May 22
JFrog report recaps a tumultuous year in supply chain security: JFrog's 2026 report reveals npm attacks surged 451%, 495 malicious AI models were found ...
thenewstack.io/jfrog-ai-supply-chain-security/
dlvr.it May 15
OpenAI caught in TanStack npm supply chain chaos after employee devices compromised
theregister.com/security/2026/05/15/openai-caught-in-tanstack-npm-supply-chain-chaos-after-employee-devices-compromised/5241019
dlvr.it May 12
Cache-poisoning caper turns TanStack npm packages toxic: Six-minute supply chain blitz pushed 84 malicious versions with credential theft and disk-wiping code
theregister.com/cyber-crime/2026/05/12/cache-poisoning-caper-turns-tanstack-npm-packages-toxic/5238650
Shai Hulud attack ships signed malicious TanStack, Mistral npm packages: A large-scale software supply-chain attack involving the "Shai-Hulud" malware ...
bleepingcomputer.com/news/security/shai-hulud-attack-ships-signed-malicious-tanstack-mistral-npm-packages/
New npm supply-chain attack self-spreads to steal auth tokens: A new supply chain attack targeting the Node Package Manager (npm) ecosystem is stealing developer ...
bleepingcomputer.com/news/security/new-npm-supply-chain-attack-self-spreads-to-steal-auth-tokens/
Malicious NPM packages abuse Adspect redirects to evade security: Seven packages published on the Node Package Manager (npm) registry use the Adspect cloud-based ...
bleepingcomputer.com/news/security/malicious-npm-packages-abuse-adspect-redirects-to-evade-security/
NPM flooded with malicious packages downloaded more than 86,000 times: Packages downloaded from NPM can fetch dependencies from untrusted sites.
arstechnica.com/security/2025/10/npm-flooded-with-malicious-packages-downloaded-more-than-86000-times/
5 ways to spot software supply chain attacks and stop worms - before it's too late
zdnet.com/article/5-ways-to-spot-software-supply-chain-attacks-and-stop-worms-before-its-too-late/
Hackers left empty-handed after massive NPM supply-chain attack: The largest supply-chain compromise in the history of the NPM ecosystem has impacted roughly 10% ...
bleepingcomputer.com/news/security/hackers-left-empty-handed-after-massive-npm-supply-chain-attack/
JavaScript packages with billions of downloads were injected with malicious code in world's largest supply chain hack ...
tomshardware.com/tech-industry/cyber-security/javascript-packages-with-billions-of-downloads-were-injected-with-malicious-code-in-worlds-largest-supply-chain-hack-geared-to-steal-crypto-a-phishing-email-is-all-it-took-to-undermine-npm-pac
Paid articlePaywallThis 2FA phishing scam pwned a developer - and endangered billions of npm downloads
zdnet.com/article/this-2fa-phishing-scam-pwned-a-developer-and-endangered-billions-of-npm-downloads/
Next