TanStack has released a detailed postmortem describing a sophisticated supply-chain attack that compromised 42 npm packages ...
Popular JavaScript modules including size-sensor and echarts-for-react hit as hijacked account closed GitHub warnings ...
Threat actors earlier today published more than 600 malicious packages to the Node Package Manager (npm) index as part of a ...
TanStack had 2FA, OIDC publishing, and Sigstore provenance on every release. The Mini Shai-Hulud worm published 84 malicious ...
Hackers have injected credential-stealing malware into newly published versions of node-ipc, a popular inter-process communication package, in a new supply chain attack targeting npm. The node-ipc ...
While robust passwords help you secure your valuable online accounts, hardware-based two-factor authentication takes that security to the next level. Read now DevOps security firm JFrog discovered 17 ...
Attackers stole a long-lived npm access token belonging to the lead maintainer of axios, the most popular HTTP client library in JavaScript, and used it to publish two poisoned versions that install a ...
The tactical sequence here is worth breaking down because it reveals a deliberate two-stage approach. First, the attackers did not try to brute-force their way into npm infrastruc ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results