Mastodawn

Mini Shai-Hulud Strikes Again: 314 npm Packages Compromised

https://safedep.io/mini-shai-hulud-strikes-again-314-npm-packages-compromised/

#HackerNews #MiniShaiHulud #npmSecurity #CyberThreats #PackageCompromise #SoftwareVulnerability

Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised

A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds of @antv scoped packages, affecting 15M+ monthly downloads.

SafeDep - Real-time Open Source Software Supply Chain Security

N-gated Hacker News Apr 23

🔥🚀 Oh, rejoice! Another day, another hack—this time, Bitwarden's CLI couldn't dodge a bullet in the #Checkmarx supply chain campaign. Thank goodness for Socket Research Team, because without them, we'd never know which npm package will ruin our day next! 🙄🔒💥
https://socket.dev/blog/bitwarden-cli-compromised #Bitwarden #SupplyChain #SocketResearch #npmSecurity #HackNews #HackerNews #ngated

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain Campaign

Bitwarden CLI 2026.4.0 was compromised in the Checkmarx supply chain campaign after attackers abused a GitHub Action in Bitwarden’s CI/CD pipeline.

Socket

NewsletterTF Apr 2

Axios npm Account Hijacked, Malware Injected

Axios npm account hijacked, malware injected into popular JavaScript library. Developers using versions 1.14.1 or 0.30.4 are at risk. Learn how to protect your code.

#AxiosAttack, #npmSecurity, #JavaScriptMalware, #CyberSecurity, #SoftwareSupplyChain

https://newsletter.tf/axios-npm-malware-attack-developers-risk/

NewsletterTF Apr 2

Malicious code was put into the popular Axios JavaScript library for 3 hours. This is a new risk for developers using npm.

#AxiosAttack, #npmSecurity, #JavaScriptMalware, #CyberSecurity, #SoftwareSupplyChain
https://newsletter.tf/axios-npm-malware-attack-developers-risk/

Axios npm Malware Attack 2023: Developers Face New Risks

Axios npm account hijacked, malware injected into popular JavaScript library. Developers using versions 1.14.1 or 0.30.4 are at risk. Learn how to protect your code.

NewsletterTF

sayzard Mar 31

[Claude Code 소스 코드가 npm 레지스트리 맵 파일을 통해 유출

Anthropic의 Claude Code CLI 소스 코드가 npm 레지스트리 내 .map 파일을 통해 유출된 사례가 보고되었다. .map 파일은 소스 코드의 디버깅 정보를 포함하여 원본 소스 코드를 복원 가능한 형태로 제공할 수 있어, 보안상 심각한 문제로 평가된다. 이 사건은 오픈소스 프로젝트나 클라우드 기반 AI 도구 개발 시 보안 취약점 관리와 소스 코드 유출 방지 전략의 중요성을 강조한다.

https://news.hada.io/topic?id=28059

#anthropic #claudecode #sourcecodeleak #npmsecurity #aisecurity

Claude Code 소스 코드가 npm 레지스트리 맵 파일을 통해 유출 | GeekNews

Anthropic의 Claude Code CLI 소스 코드가 npm 레지스트리의 .map 파일을 통해 통째로 복원 가능한 형태로 유출된 사례가 보고됐습니다.

GeekNews

Manuel Bissey Dec 23

A malicious npm package is stealing WhatsApp messages — a sharp reminder that the software supply chain can betray even trusted platforms. Verify dependencies, always. 📦🔓 #SupplyChainRisk #NPMSecurity

https://www.theregister.com/2025/12/22/whatsapp_npm_package_message_steal/

Poisoned WhatsApp API package steals messages and accounts

: And it's especially dangerous because the code works

The Register

N-gated Hacker News Dec 22

Wow, who knew that downloading a seemingly innocent NPM package could lead to your WhatsApp messages being harvested like crops in FarmVille? 🌾📱 Clearly, 56,000 people learned the hard way that trusting random code on the internet is like expecting your cat to respect your personal space. 🐱💻
https://www.koi.ai/blog/npm-package-with-56k-downloads-malware-stealing-whatsapp-messages #NPMsecurity #WhatsAppprivacy #codingrisks #trustissues #cybersecurity #HackerNews #ngated

NPM Package With 56K Downloads Caught Stealing WhatsApp Messages

Manuel Bissey Dec 3

A malicious npm package factory is churning out contagious code — proving the software supply chain can be poisoned at the source. Developers must verify every dependency. 🧩⚠️ #NPMSecurity #SupplyChainRisk

https://www.darkreading.com/application-security/contagious-interview-malicious-npm-package-factory

Soatok Dreamseeker Nov 19

Moving Beyond the NPM elliptic Package

If you're in a hurry, head on over to soatok/elliptic-to-noble and follow the instructions in the README in order to remove the elliptic package from your project and all dependencies in node_modules. Art: CMYKat Why replace the elliptic package? Yesterday, the Trail of Bits blog published a post about finding cryptographic bugs in the elliptic library (a Javascript package on NPM) by using the Wycheproof.

http://soatok.blog/2025/11/19/moving-beyond-the-npm-elliptic-package/

#npm #crypto #cryptography #elliptic #security #infosec #cve #mitigation #appsec #javascript #js #npm #npmsecurity #npmpackages

Moving Beyond the NPM elliptic Package - Dhole Moments

If you’re in a hurry, head on over to soatok/elliptic-to-noble and follow the instructions in the README in order to remove the elliptic package from your project and all dependencies in node…

Dhole Moments

Manuel Bissey Nov 13, 2025

Over 46,000 fake npm packages flood the ecosystem — attackers are poisoning the software supply chain at scale. Developers must verify before they install. 📦⚠️ #SoftwareSupplyChain #NPMSecurity

https://thehackernews.com/2025/11/over-46000-fake-npm-packages-flood.html

Over 46,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack

A mysterious npm worm published 46K fake packages in a two-year spam campaign, exposing major security gaps.

The Hacker News