“After GlassWorm showed how quickly a malicious package could self-replicate across npm, and the chalk/debug hijacking ...

A threat actor has published tens of thousands of malicious NPM packages that contain a self-replicating worm, security ...

The coordinated campaign has so far published as many as 46,484 packages, according to SourceCodeRED security researcher Paul ...

The typosquatted “@acitons/artifact” package targeted GitHub’s CI/CD workflows, stealing tokens and publishing malicious ...

A widely-adopted JavaScript library has been found carrying a critical vulnerability which could allow threat actors to ...

Cybersecurity researchers have discovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate " ...

A critical vulnerability in the popular expr-eval JavaScript library, with over 800,000 weekly downloads on NPM, can be ...

The security research team at JFrog, a provider of a platform for building and deploying software, have discovered a critical vulnerability in a node ...

The npm packages were available since July, have elaborately obfuscated malicious routines, and rely on a fake CAPTCHA to appear authentic.

The Indian Computer Emergency Response Team (CERT-In) has issued an advisory, noting the risk of a cyber threat campaign specifically targeting JavaScript’s node package manager (npm) ecosystem. The ...