Supply Chain Security
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.
Hi, what are you looking for?
SecurityWeek
All posts tagged "NPM"
Malware & Threats
Arch Linux suspended account registrations in response to the wave of malicious packages being uploaded to AUR.
Supply Chain Security
By default, npm install will no longer execute scripts from dependencies, unless explicitly allowed.
Malware & Threats
The most recent variants of the self-propagating attacks are named Miasma and Hades.
Supply Chain Security
Hackers published 96 malicious package versions, injected with a credential-stealing worm similar to Mini Shai-Hulud.
Supply Chain Security
The compromised Lightning and Intercom packages have a combined monthly download count of nearly 10 million.
Malware & Threats
The Mini Shai-Hulud attack introduced a preinstall hook to fetch and execute a Bun binary and bypass security monitoring.
Supply Chain Security
Tied to a fresh Checkmarx supply chain attack claimed by TeamPCP, the incident references the Shai-Hulud worm.
Malware & Threats
Hackers published 36 NPM packages posing as Strapi plugins to execute shells, escape containers, and harvest credentials.
Application Security
A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored package versions.
Application Security
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
Malware & Threats
The malicious code propagates like a worm, poisons AI assistants, exfiltrates secrets, and contains a destructive dead switch.
Supply Chain Security
The protections against NPM supply chain attacks could be bypassed, leading to arbitrary code execution.
Vulnerabilities
The bug can allow attackers to read arbitrary files from the system, potentially exposing configurations and credentials.
Malware & Threats
The package provides legitimate functionality to evade detection, while stealing users’ data and deploying a backdoor.
Supply Chain Security
The new self-replicating worm iteration has destructive capabilities, erasing home directory contents if it cannot spread to more repositories.
Application Security
A financially motivated threat actor automated the package publishing process in a coordinated tea.xyz token farming campaign.
Malware & Threats
The spam campaign is likely orchestrated by an Indonesian threat actor, based on code comments and the packages’ random names.
Application Security
Arbitrary command/code execution has been demonstrated through the exploitation of CVE-2025-11953 on Windows, macOS and Linux.
Malware & Threats
The packages deployed malicious code harvesting system information, credentials, tokens, API keys, and other sensitive information.
Data Breaches
Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact.
Vulnerabilities
Artificial Intelligence
AWS has patched the vulnerability and published its own advisory to inform customers about the potential impact.
Artificial Intelligence
Artificial Intelligence
Application Security
