npm
GitHub Launches New npm Package Firewall to Block Supply Chain Attacks
GitHub has officially introduced a new npm package firewall designed to block supply chain attacks before malicious code reaches developer environments. Launched in public preview…
Over 40,000 Developers May Have Downloaded This Malware Without Knowing
A malicious npm package called imgdecode hides malware inside image files hosted on GitHub. Security researchers at SafeDep discovered the package as part of the…
SAP npm Packages Compromised in Mini Shai-Hulud Supply Chain Attack
Several official SAP npm packages were compromised in a supply chain attack that injected malware to steal developer credentials. The malicious code executes during installation,…
Hackers Exploit npm Supply Chain to Gain AWS Admin Access
A Google report reveals how a stolen developer token from last year’s nx package attack was used to breach a victim’s cloud environment, create an…
Open Source Malware Surges Nearly 73% in 2025, Cybersecurity Report Shows
The number of malicious open source software packages discovered in 2025 jumped dramatically, with detections rising by about 73% compared with 2024, cybersecurity analysts say,…
Developers Hit as Fake WhatsApp API Package Emerges on npm
Security researchers discovered a fake WhatsApp API package on npm that steals developer credentials, raising fresh alarms about the growing risks facing the open source…
Massive npm Supply-Chain Attack: Shai-Hulud Worm Infects Over 180 Packages
A new, alarming software supply-chain attack dubbed ‘Shai-Hulud’ has been uncovered targeting the JavaScript npm ecosystem. Researchers from several security firms, including Palo Alto Networks…
Critical npm Supply Chain Attack Exposes Global Firms
A critical supply chain compromise has been disclosed in the npm JavaScript ecosystem, exposing enterprises worldwide to risks of cryptocurrency theft, credential leakage, and unauthorized…
