Qix is an open source maintainer account that was compromised by a phishing attack. This allowed attackers to infect 18 popular npm packages with malicious code. Together, these packages are ...

A cryptocurrency thief got into the npm account of a hard-working developer via spearphishing. node.js packages with billions ...

Hackers planted malicious code in open source software packages with more than 2 billion weekly updates in what is likely to ...

An attack targeting the Node.js ecosystem was just identified — but not before it compromised 18 npm packages that account ...

Aikido Security Ltd. today disclosed what is being described as the largest npm supply chain compromise to date, after ...

The credential stealer harvested username, password, and 2FA codes before sending them to a remote host. With full access, ...

Crypto intelligence platform Security Alliance released a report on Sep. 8 to reveal that Ethereum and Solana wallets have ...

Hackers hijacked NPM libraries in a massive supply chain attack, injecting malware that swaps crypto wallet addresses to steal funds.

According to Guillemet, the malicious code — already pushed into packages with over 1 billion downloads — is designed to ...