#npm
-
GitHub Launches npm Firewall to Stop Malicious Packages Before Installation
GitHub has opened a public preview of a package firewall for npm. It checks dependencies against a set of policies and blocks suspicious packages at install time.
-
AGENTS.md file in Downloads folder hijacks AI coding agents
Researchers found a malicious AGENTS.md instruction file on a customer's machine that pushed an AI coding agent to install a rogue npm package. Browsers save downloads there automatically — and agents read instructions from the same folder without asking.
-
Fake Web3 Accelerator Pushed Malicious npm Packages Posing as Free AI Credits
A crew masquerading as a venture accelerator for crypto startups spread infostealers and backdoors through npm, dangling free Claude and Gemini credits — while quietly hijacking the traffic of AI agents.
-
Malicious npm Package imgdecode Hides a Shellcode Loader in a Windows Native Addon
SafeDep researchers flagged imgdecode, an npm package that is part of the long-running MALFEX campaign aimed at compromising Windows systems. Despite public exposure, it remains available and has already been downloaded 979 times.
-
DirtyBlanket: fake Express packages on npm spread a self-replicating Linux worm
In 33 minutes the npm account dirtyblanket published nine malicious packages impersonating Express and React. Installing any of them on Linux starts a worm that steals keys and tokens and infects new machines.
-
Compromised GitHub Actions brought back online with malware still attached
Two third-party GitHub Actions infected in May's Mini Shai-Hulud campaign were re-enabled and kept serving the old malicious payload for more than a week.
-
Schneier: Defense-Evading Malicious npm Packages Feel Like Nation-State Work
Bruce Schneier flagged a set of malicious npm packages built to slip past defenses. Their sophistication, he says, hints at a nation-state — though there is no direct evidence and no attribution.
-
Malware Sneaks Into HashiCorp Registry via Rogue Terraform Providers
Researchers found Go-based malware distributed through two Terraform providers and two Go modules in the HashiCorp registry — the first time the centralized repository has been used as a delivery channel for malicious payloads.
-
Malicious npm packages slip past install-script defenses by hiding in runtime code
The indexed-btree package poses as the popular sorted-btree library and hides its malicious loader not in install scripts but in an ordinary method that runs during normal application use.
-
North Korean WaterPlum group infects 30,000 devices worldwide
A joint alert from the intelligence agencies of four countries reports that North Korean hackers have stolen more than $10.7 million in cryptocurrency, targeting job seekers under the guise of fake interviews.
-
PhantomRaven: An AI-Written npm Stealer Built to Chase Bug Bounties
CrowdStrike has linked a financially motivated threat actor to malicious npm packages that stole developer tokens. In the analysts' assessment, the stealer's code was almost certainly generated by a large language model.
-
A Nix binary cache is just three functions — which means anything can be one
Farid Zakaria shows that to play the part of a Nix binary cache, all you need to do is answer three HTTP requests — and he proves it by turning GitHub Pages, npm, and even DNS into substituters.
-
14 Trojanized npm Packages Deploy the AI-Controlled Linux Backdoor RedC2 4.0
Trend Micro researchers have found a set of npm packages that, posing as calendar utilities, covertly deploy the Linux implant RedC2 4.0. A single import anywhere in the dependency tree — even a transitive one — is enough to trigger the payload.
-
ChainDrop worm infects more than 1,300 npm packages with 2 billion downloads a month
The self-propagating ChainDrop malware has compromised popular npm packages, including the Keyv and Cacheable caching utilities, and steals developer and cloud-service credentials.
-
18 Malicious npm Packages Target Alibaba Tooling Developers
Researchers have uncovered a targeted supply-chain attack: masquerading as private Alibaba packages, a cross-platform remote access trojan is being spread to Chinese-speaking developers.
-
Amazon Attributes the Hijack of the npm Packages debug and chalk to North Korea's Sapphire Sleet
Ten months on, Amazon has tied the September 2025 attack on popular npm packages to the DPRK. The published evidence, however, turned out to be thinner than the bold claim.
-
Two @joyfill npm packages compromised: RAT fires the moment you import them
Malicious code has been found in the beta releases of the npm packages @joyfill/layouts and @joyfill/components; it pulls down a remote access trojan through blockchain transactions. According to Socket, North Korean hackers are behind the attack.
-
Seven Malicious npm Packages for Vite Used the Blockchain as a C2 Server
Researchers have uncovered the ViteVenom campaign — seven malicious npm packages targeting the Vite ecosystem and using blockchain infrastructure to control infected systems.
-
Credential-Stealing Trojan Planted in AsyncAPI npm Packages
Attackers published five malicious versions of AsyncAPI packages in the npm registry, using them to distribute a remote access trojan with data-theft capabilities. The attack struck the open-source software supply chain.
-
148 npm Packages Turned Students' Browsers into a DDoS Botnet
JFrog researchers uncovered a campaign of 148 npm packages disguised as student web proxies that, for about two weeks in May, turned visitors' browsers into nodes of a DDoS botnet.
- More