Ten typosquatted npm packages (Jul 4, 2025) delivered a 24MB PyInstaller info stealer using 4 obfuscation layers; ~9,900 ...
Recently, security researchers Socket found 10 packages on npm targeting software developers, specifically those who use the ...
Ten malicious packages mimicking legitimate software projects in the npm registry download an information-stealing component ...
The typosquatted packages auto-execute on installation, fingerprint victims by IP, and deploy a PyInstaller binary to harvest ...
An advanced malware campaign on the npm registry steals the very keys that control enterprise cloud infrastructure.
The npm packages were available since July, have elaborately obfuscated malicious routines, and rely on a fake CAPTCHA to ...
A sophisticated supply chain attack has compromised the widely-used Nx build system package and exposed thousands of enterprise developer credentials. The campaign weaponized artificial intelligence ...
Researchers have found malicious software that received more than 6,000 downloads from the NPM repository over a two-year span, in yet another discovery showing the hidden threats users of such open ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results
Feedback