Elektrine
Log in Register

#npm

65 posts · Last used 20d

OffSequence @offseq@infosec.exchange
· 2w ago
@kartyk-github-org/takedown-b (npm) contains CRITICAL malware: full system compromise if installed/run. All secrets and keys must be rotated from a clean device. Removal alone is insufficient — investigate for persistence. No CVE. https://radar.offseq.com/threat/malicious-code-in-kartyk-github-orgtakedown-b-npm-3a3addb0368973b9 #OffSeq #npm #malware #infosec
OffSeq Threat Radar

Malicious code in @kartyk-github-org/takedown-b (npm) - Live Threat Intelligence - Threat Radar | OffSeq.com

Detailed information about Malicious code in @kartyk-github-org/takedown-b (npm) affecting null @kartyk-github-org/takedown-b. Get real-time updates, technical

0
0
0
0
Zennoxa @Zennoxa@infosec.exchange
· 1mo ago
We resolved the dependency trees of 34 of the most-used npm packages (484 packages). Under 1% run install scripts, but only 21.5% publish build provenance: 78.5% ship with no verifiable link from the package you install back to the source and CI that built it. Scripts and data are published. #npm #supplychain #provenance https://zennoxa.com/research/npm-provenance-census-2026
zennoxa.com

Two years after npm shipped build provenance, 78% of a typical dependency tree still doesn't use it

We resolved the dependency tree of 34 of the most-used npm packages (484 packages) and measured two supply-chain signals against the public npm registry: under 1% run install scripts, but only 21.5% publish build provenance — 78.5% ship with no verifiable link from the package you install back to the source and CI that built it. Every number is reproducible from the published scripts.

0
0
0
0
OTX Bot @techbot@social.raytec.co
· 1mo ago
Popular npm Package With 150K+ Weekly Downloads Hit by Credential-Stealing Supply-Chain Worm Indicators extracted from public reporting. Source: https://research.jfrog.com/post/shai-hulud-trinitite/ Pulse ID: 6a956bc92f739d8a0e243dd2 Pulse Link: https://otx.alienvault.com/pulse/6a956bc92f739d8a0e243dd2 Pulse Author: CyberHunter_NL Created: 2026-08-31 11:55:53 Be advised, this data is unverified and should be considered preliminary. Always do further verification. #CyberSecurity #HTTP #HTTPS #InfoSec #NPM #OTX #OpenThreatExchange #RCE #Worm #bot #CyberHunter_NL
research.jfrog.com

Shai-Hulud Trinitite Hits @7nohe/openapi-react-query-codegen - JFrog Security Research

JFrog Security Research analyzed a new Mini Shai-Hulud wave on @7nohe/openapi-react-query-codegen. Ten npm versions drop a Trinitite-labeled worm through preinstall and an obfuscated binding.gyp command.

0
0
0
0
Maik @maik@norden.social
· 2mo ago
Der GitHub-Account des Maintainers der Key-Value-Datenbank #keyv wurde kompromittiert Durch die Shai-Hulud-Lieferkettenattacke sind über 440 #npm-Pakete betroffen mit rund 2 Milliarden Downloads monatlich Der Schadcode startet automatisch bei Installation und sucht nach Zugangsdaten https://www.heise.de/news/Lieferketten-Angriff-auf-keyv-Shai-Hulud-Wurm-infiziert-mehr-als-440-npm-Pakete-11403078.html?seite=all
Lieferketten-Angriff auf keyv: Shai-Hulud-Wurm infiziert mehr als 440 npm-Pakete
Developer

Lieferketten-Angriff auf keyv: Shai-Hulud-Wurm infiziert mehr als 440 npm-Pakete

Die populäre Key‑Value‑Datenbank keyv und andere weit verbreitete npm-Pakete waren Ziel einer Lieferkettenattacke. Der potenzielle Schaden ist groß.

2
0
4
0
SonstHarmlos @SonstHarmlos@franken.social
· 2mo ago
Replying to
Scherz beiseite, ich benutze natürlich "--ignore-scripts" mit ganz wenigen Ausnahmen und jetzt habe ich entdeckt, dass es seit npm 11 auch eine "min-release-age" Option gibt, mit der man neue Package-Versionen erst mal ein paar Tage abhängen lassen kann. #npm #security #itsec
0
0
0
0
dilshad @dilshad@infosec.exchange
· 2mo ago
NPM account takeovers via expired maintainer domains You don't need to exploit npm to poison it. Buy the expired email domain behind a maintainer's account, reset the password, and the package is yours. We scanned 2.1 million packages, extracted 6.7 million maintainer emails, and found 675 expired domains leaving 2,843 packages open to takeover. Those packages sit under 257,000+ dependent repos and 93,000 downstream packages. One lapsed domain renewal, a supply chain full of blast radius. https://laburity.com/research-npm-account-takeovers/ #SupplyChainSecurity #npm #AccountTakeover #AppSec #Laburity
laburity.com
0
0
0
0
Markus Tacker @coderbyheart@chaos.social
· 2mo ago

That's why you should migrate to #NPM v12, it prevents exactly this kind of attack: https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack

Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a "preinstall": "node setup.mjs" entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed.

aikido.dev

Keyv and friends compromised in npm supply chain attack

0
2
1
0
Cloud 🤖 @cloud@infosec.exchange
· 2mo ago
🤖 ChainDrop: massive npm supply-chain attack. Worm compromised 1,300+ packages (~2B monthly downloads) after hijacking the Keyv maintainer's GitHub account; releases kept valid provenance via legit GitHub Actions. setup.mjs auto-runs on npm install and deploys a Bun-based infostealer. 🔗 https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/ #SupplyChain #npm #Malware #InfoSec
Massive ChainDrop npm supply-chain attack infects hundreds of packages
BleepingComputer

Massive ChainDrop npm supply-chain attack infects hundreds of packages

Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry.

0
0
0
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2mo ago
A new npm supply chain attack hijacked keyv and dozens of packages, spreading Shai-Hulud malware that steals cloud and CI/CD secrets. Rotate keys now. #npm #SupplyChainAttack #ShaiHulud #keyv #CredentialStealer #Malware #DevSecOps #CICD #CyberSecurity #InfoSec https://securityonline.info/npm-supply-chain-attack-keyv-shai-hulud/?utm_source=mastodon&utm_medium=jetpack_social
npm Supply Chain Attack Hijacks Keyv and Spreads Shai-Hulud Malware
Daily CyberSecurity

npm Supply Chain Attack Hijacks Keyv and Spreads Shai-Hulud Malware

A new npm supply chain attack hijacked keyv and dozens of packages, spreading Shai-Hulud malware that steals cloud and CI/CD secrets. Rotate keys now.

0
0
0
0
AA @AAKL@infosec.exchange
· 2mo ago
New. Socket: Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain @SocketSecurity@fosstodon.org More: The Hacker news: Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html @thehackernews@social.tchncs.de #infosec #npm #threatresearch #JavaScript
socket.dev
0
0
0
0
AmmarSpaces @AmmarSpaces@infosec.exchange
· 2mo ago

Hey, hey, it's been a long time since the last huge supply chain attack (what about AUR? it's for nerds). NPM Supply Chain Attack returned again, this time infecting more than 444 packages with accumulation of 2B (yeah B for billion) downloads. The malware used is Shai-hulud again, but this time, the culprit is Copycat of TeamPCP.

What should you do?

  • Check if you are affected, if so, downgrade your library version
  • Rotate your keys and do 2FA
  • Search for infected accounts in your system, if there is one, remove it... or kill it with cold blood.

More details: https://www.ox.security/blog/a-new-infostealer-worm-hits-npm-affecting-keyv-and-cacheable/

#cybersecurity #infosec #security #supplychainsecurity #supplychain #npm#shaihuludmalware

A Massive Shai-Hulud Campaign Hits npm: +440 Packages Compromised, Over 2B Monthly Downloads
OX Security

A Massive Shai-Hulud Campaign Hits npm: +440 Packages Compromised, Over 2B Monthly Downloads

Breaking News: A Shai-Hulud Campaign hits npm. +350 Packages Compromised, Over 2B Monthly Downloads Affected

0
0
0
0
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange
· 2mo ago
A distributed npm supply chain attack dropped a cross-platform RAT on Alibaba developers. Socket found malicious npm packages hiding loader code. #npm #SupplyChainAttack #RAT #Alibaba #Malware #CyberSecurity https://securityonline.info/npm-supply-chain-attack-alibaba-rat/?utm_source=mastodon&utm_medium=jetpack_social
npm Supply Chain Attack Delivers a Cross-Platform RAT to Alibaba Developers
Daily CyberSecurity

npm Supply Chain Attack Delivers a Cross-Platform RAT to Alibaba Developers

A distributed npm supply chain attack dropped a cross-platform RAT on Alibaba developers. Socket found malicious npm packages hiding loader code.

0
0
0
0
Cloud 🤖 @cloud@infosec.exchange
· 2mo ago
🤖 Amazon attributes Debug/Chalk npm supply-chain attacks to DPRK hackers. Malicious packages target the Node.js ecosystem in ongoing campaign against open-source infrastructure. 🔗 https://www.bleepingcomputer.com/news/security/amazon-links-debug-chalk-npm-supply-chain-attacks-to-north-korean-hackers/ #SupplyChain #npm #CyberSec
Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers
BleepingComputer

Amazon links Debug, Chalk NPM supply-chain attacks to North Korean hackers

Amazon linked multiple high-profile open-source software supply chain attacks targeting the Node Package Manager (npm) ecosystem to North Korean hackers.

0
0
0
0
Web Standards @webstandards_dev@mastodon.social
· 2mo ago
The secure way to release an npm package in 2026. @sitnik_en@mastodon.social breaks down how supply chain attacks now run semi-automatically, compromising hundreds of packages a day, and frames security as raising the cost for attackers rather than chasing perfection. The quick wins, most doable in under a day, include npm Trusted and Staged Publishing, org-wide 2FA, admin-only tags, CI actions pinned to SHA, and a 3-day dependency cooldown. #npm #security https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package
The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog
evilmartians.com

The secure way to release an npm package in 2026—Martian Chronicles, Evil Martians’ team blog

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

1
0
0
0