#supply-chain
-
18 Malicious npm Packages Target Alibaba Tooling Developers
Researchers have uncovered a targeted supply-chain attack: masquerading as private Alibaba packages, a cross-platform remote access trojan is being spread to Chinese-speaking developers.
-
The Adform Breach: A Swapped Script Rewrote Crypto Wallets on Clients' Sites
Attackers altered a JavaScript file belonging to the Adform advertising platform, turning it into an in-browser tool for swapping crypto wallet addresses. The incident affected sites that used the shared tracking script.
-
Claude Escaped the “Sandbox”: Three Real Companies and Malware on PyPI
Anthropic has admitted that during internal tests its models mistakenly gained access to the internet and attacked three real organizations — one of the models even published a malicious package on PyPI.
-
Amazon Attributes the Hijack of the npm Packages debug and chalk to North Korea's Sapphire Sleet
Ten months on, Amazon has tied the September 2025 attack on popular npm packages to the DPRK. The published evidence, however, turned out to be thinner than the bold claim.
-
Two @joyfill npm packages compromised: RAT fires the moment you import them
Malicious code has been found in the beta releases of the npm packages @joyfill/layouts and @joyfill/components; it pulls down a remote access trojan through blockchain transactions. According to Socket, North Korean hackers are behind the attack.
-
ShinyHunters claim responsibility for the Ernst & Young data breach
The extortion group ShinyHunters says it is behind the recent breach at auditing firm Ernst & Young and is threatening to publish the stolen data unless the firm gets in touch by July 31.
-
GitHub and PyPI Introduce “Time-Based Holds” Against Supply-Chain Attacks
Dependabot now waits three days by default before updating dependencies, while PyPI bars adding files to releases older than two weeks. Both measures aim to narrow the window in which malicious code can make its way into projects.
-
Trojanized Newtonsoft.Json Fork Rigs Online Game Results
JFrog researchers found a typosquatting package on NuGet that behaves like the real library for everyone — except a single victim, whose betting rounds it quietly rigs.
-
SleeperGem: Three Malicious RubyGems Packages Target Developer Machines
Researchers have detailed a supply-chain attack on Ruby: the attackers hijack long-abandoned RubyGems accounts and use updates to deliver a loader that installs a stealthy daemon on developers' computers.
-
Seven Malicious npm Packages for Vite Used the Blockchain as a C2 Server
Researchers have uncovered the ViteVenom campaign — seven malicious npm packages targeting the Vite ecosystem and using blockchain infrastructure to control infected systems.
-
Credential-Stealing Trojan Planted in AsyncAPI npm Packages
Attackers published five malicious versions of AsyncAPI packages in the npm registry, using them to distribute a remote access trojan with data-theft capabilities. The attack struck the open-source software supply chain.
-
148 npm Packages Turned Students' Browsers into a DDoS Botnet
JFrog researchers uncovered a campaign of 148 npm packages disguised as student web proxies that, for about two weeks in May, turned visitors' browsers into nodes of a DDoS botnet.
-
Crypto-wallet stealer planted in Injective SDK npm package
Attackers hacked the GitHub repository of the Injective Labs SDK project and used it to publish a malicious package to npm that steals private keys and seed phrases from crypto wallets.