A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...

Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly ...

NullReceiver lets two North Korea-linked npm packages decode a C2 IP from blank Ethereum transfers without smart contracts or ...

More than 400 NPM packages have been infected with the Mini Shai-Hulud worm in the ChainDrop supply chain attack.

Malicious npm packages impersonate Alibaba tools to deliver a cross-platform RAT with command execution, persistence, and ...

keyv npm supply chain attack on August 4, 2026 let the Shai-Hulud worm compromise 400-plus packages and more than two billion ...

Overview:  Learn how to use Playwright for modern web testing, from installation and project setup to writing reliable ...

Upwind identified a malicious release of keyv@6.0.0 that harvested AWS, GitHub, and npm credentials via a hidden preinstall script. With 154 million weekly downloads, the compromise had ecosystem-wide ...

Aikido Security says an npm supply chain attack has infected Keyv packages with a variant of the credential-stealing ...

The Shai Hulud variant’s blast radius includes several highly popular packages thus far.. Security teams are urged to perform ...

Reports from Cisco Talos and CrowdStrike provide real-world insights into how AI is evolving attackers’ tradecraft and ...