Cyber Crimenpm Mirrors Turned into Phishing Hosts
Attackers abuse npm mirrors to host HTML phishing pages, bypassing security filters by serving from legitimate domains.
> Search
17 results for “npm”
Cyber Crime
SecurityTrojan npm Packages Drop AI-Powered Linux Backdoor
Researchers uncover 14 malicious npm packages delivering RedC2 4.0, an AI-assisted Linux backdoor, via stealthy loader.
SecurityMalware Uses Ethereum Wallet as C2 Dead Drop
Sonatype finds six npm packages reading C2 addresses from an Ethereum wallet transaction linked to DPRK.
Cyber CrimeChainDrop Worm Exploits npm Ecosystem
A self-propagating malware campaign has compromised over 1,300 npm packages, leveraging legitimate GitHub workflows to spread.
Cyber CrimeNullReceiver Uses Blockchain for Stealth
New npm malware hides command-and-control infrastructure within zero-value Ethereum transfer addresses to bypass traditional detection.
SecurityShescape Shell Injection Flaw Patched
A critical shell injection vulnerability in the Shescape library allows attackers to bypass security filters when using CMD on Windows systems.
SecurityCritical Seroval Deserialization Flaw Patched
A type confusion vulnerability in seroval.fromJSON() allows attackers to trigger unintended server-side code execution through malicious JSON payloads.
SecurityCritical DoS Flaw Found in npm tar Package
A severe vulnerability in the node-tar library allows attackers to crash servers and exhaust storage through maliciously crafted archive files.
SecurityVite Ecosystem Faces Blockchain-Led RAT
A new campaign targeting Vite developers uses a four-tier blockchain infrastructure to bypass traditional security takedown efforts.
SecuritySupply Chain Breach Targets npm Ecosystem
Compromised AsyncAPI and Jscrambler packages expose developers to credential theft via automated malicious injection.
SecurityAsyncAPI Breach Exposes CI/CD Pipeline Risk
A sophisticated supply chain attack used legitimate GitHub pipelines to push malicious code via the AsyncAPI npm namespace.
Cyber CrimeSupply Chain Breach Hits Jscrambler NPM Package Integrity
Compromised publishing credentials allowed attackers to inject malicious binaries into widely used Jscrambler NPM versions.
SecurityStudent Proxy Campaign Turns npm Into a Distributed DDoS Weapon
A swarm of 148 malicious npm packages exploited student browsers to fuel a sophisticated, dual-layered botnet operation.
SecuritySupply Chain Breach Targets Jscrambler Dependency Pipeline
A malicious npm package injection forced a swift cleanup, highlighting the persistent dangers of compromised build environments.
SecurityWhen Build Tools Turn Hostile: Inside the jscrambler Poisoning
A compromised jscrambler package release highlights how modern software pipelines are weaponized to harvest developer secrets.
SecurityWhen Trust is Weaponized: Inside the Injective Labs SDK Compromise
A compromised developer account on GitHub allowed attackers to inject silent credential-stealing malware into a popular Web3 ecosystem.
Securitynpm 12 Reinforces Open-Source Supply Chains Against Covert Exploits
GitHub's npm 12 release hardens software supply chains by disabling install scripts by default and overhauling granular access tokens to mitigate critical risks.