Elektrine
Log in Register

#npm

61 posts · Last used 5d

Back to Timeline
maik
Maik @maik@norden.social · 5d ago
Der GitHub-Account des Maintainers der Key-Value-Datenbank #keyv wurde kompromittiert Durch die Shai-Hulud-Lieferkettenattacke sind über 440 #npm-Pakete betroffen mit rund 2 Milliarden Downloads monatlich Der Schadcode startet automatisch bei Installation und sucht nach Zugangsdaten https://www.heise.de/news/Lieferketten-Angriff-auf-keyv-Shai-Hulud-Wurm-infiziert-mehr-als-440-npm-Pakete-11403078.html?seite=all
2
0
2
SonstHarmlos
SonstHarmlos @SonstHarmlos@franken.social · Aug 07, 2026
Replying to @SonstHarmlos@franken.social
Scherz beiseite, ich benutze natürlich "--ignore-scripts" mit ganz wenigen Ausnahmen und jetzt habe ich entdeckt, dass es seit npm 11 auch eine "min-release-age" Option gibt, mit der man neue Package-Versionen erst mal ein paar Tage abhängen lassen kann. #npm #security #itsec
0
0
0
dilshad @dilshad@infosec.exchange · Aug 07, 2026
NPM account takeovers via expired maintainer domains You don't need to exploit npm to poison it. Buy the expired email domain behind a maintainer's account, reset the password, and the package is yours. We scanned 2.1 million packages, extracted 6.7 million maintainer emails, and found 675 expired domains leaving 2,843 packages open to takeover. Those packages sit under 257,000+ dependent repos and 93,000 downstream packages. One lapsed domain renewal, a supply chain full of blast radius. https://laburity.com/research-npm-account-takeovers/ #SupplyChainSecurity #npm #AccountTakeover #AppSec #Laburity
0
0
0
securestep9
Sam Stepanyan :verified: 🐘 @securestep9@infosec.exchange · Aug 04, 2026
#npm: A massive #SupplyChain attack has compromised 868+ npm packages carrying 2 billion+ monthly installs with a credential-stealing worm. It started with the compromise of the #GitHub account of the #keyv library with 127 million+ weekly downloads: 👇 https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack
1
2
4
coderbyheart
Markus Tacker @coderbyheart@chaos.social · Aug 04, 2026

That's why you should migrate to #NPM v12, it prevents exactly this kind of attack: https://www.aikido.dev/blog/keyv-and-friends-compromised-in-npm-supply-chain-attack

Every package in the family received two new files, setup.mjs and Math_Symbol.js, along with a "preinstall": "node setup.mjs" entry added to each package.json. Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed.

0
0
0
Cloud 🤖 @cloud@infosec.exchange · Aug 04, 2026
🤖 ChainDrop: massive npm supply-chain attack. Worm compromised 1,300+ packages (~2B monthly downloads) after hijacking the Keyv maintainer's GitHub account; releases kept valid provenance via legit GitHub Actions. setup.mjs auto-runs on npm install and deploys a Bun-based infostealer. 🔗 https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/ #SupplyChain #npm #Malware #InfoSec
0
0
0
DailyCyberSecurity
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange · Aug 04, 2026
A new npm supply chain attack hijacked keyv and dozens of packages, spreading Shai-Hulud malware that steals cloud and CI/CD secrets. Rotate keys now. #npm #SupplyChainAttack #ShaiHulud #keyv #CredentialStealer #Malware #DevSecOps #CICD #CyberSecurity #InfoSec https://securityonline.info/npm-supply-chain-attack-keyv-shai-hulud/?utm_source=mastodon&utm_medium=jetpack_social
0
0
0
AAKL
AA @AAKL@infosec.exchange · Aug 04, 2026
New. Socket: Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack https://socket.dev/blog/popular-npm-packages-in-the-keyv-and-cacheable-namespaces-compromised-in-active-supply-chain @SocketSecurity@fosstodon.org More: The Hacker news: Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks https://thehackernews.com/2026/08/keyv-linked-npm-worm-poisons-hundreds.html @thehackernews@social.tchncs.de #infosec #npm #threatresearch #JavaScript
0
0
0
AmmarSpaces
AmmarSpaces @AmmarSpaces@infosec.exchange · Aug 04, 2026

Hey, hey, it's been a long time since the last huge supply chain attack (what about AUR? it's for nerds). NPM Supply Chain Attack returned again, this time infecting more than 444 packages with accumulation of 2B (yeah B for billion) downloads. The malware used is Shai-hulud again, but this time, the culprit is Copycat of TeamPCP.

What should you do?

  • Check if you are affected, if so, downgrade your library version
  • Rotate your keys and do 2FA
  • Search for infected accounts in your system, if there is one, remove it... or kill it with cold blood.

More details: https://www.ox.security/blog/a-new-infostealer-worm-hits-npm-affecting-keyv-and-cacheable/

#cybersecurity #infosec #security #supplychainsecurity #supplychain #npm#shaihuludmalware

0
0
0
DailyCyberSecurity
Daily CyberSecurity @DailyCyberSecurity@infosec.exchange · Aug 03, 2026
A distributed npm supply chain attack dropped a cross-platform RAT on Alibaba developers. Socket found malicious npm packages hiding loader code. #npm #SupplyChainAttack #RAT #Alibaba #Malware #CyberSecurity https://securityonline.info/npm-supply-chain-attack-alibaba-rat/?utm_source=mastodon&utm_medium=jetpack_social
0
0
0
Cloud 🤖 @cloud@infosec.exchange · Jul 31, 2026
🤖 Amazon attributes Debug/Chalk npm supply-chain attacks to DPRK hackers. Malicious packages target the Node.js ecosystem in ongoing campaign against open-source infrastructure. 🔗 https://www.bleepingcomputer.com/news/security/amazon-links-debug-chalk-npm-supply-chain-attacks-to-north-korean-hackers/ #SupplyChain #npm #CyberSec
0
0
0
webstandards_dev
Web Standards @webstandards_dev@mastodon.social · Jul 30, 2026
The secure way to release an npm package in 2026. @sitnik_en@mastodon.social breaks down how supply chain attacks now run semi-automatically, compromising hundreds of packages a day, and frames security as raising the cost for attackers rather than chasing perfection. The quick wins, most doable in under a day, include npm Trusted and Staged Publishing, org-wide 2FA, admin-only tags, CI actions pinned to SHA, and a 3-day dependency cooldown. #npm #security https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package
1
0
0
lazarusholic
lazarusholic @lazarusholic@infosec.exchange · Jul 30, 2026
"Amazon identifies North Korean hacker group behind open-source supply chain attacks" published by Amazon. #SupplyChain, #NPM, #SapphireSleet, #Axios https://aws.amazon.com/blogs/security/amazon-identifies-north-korean-hacker-group-behind-open-source-supply-chain-attacks
0
0
0
offseq
OffSequence @offseq@infosec.exchange · Jul 26, 2026
'preferenceslifecycle-paypal' npm v28.0.0 marked HIGH severity for malicious behavior — communicates with a malicious domain. No CVE, no known exploits yet. Remove or avoid usage until official guidance. https://radar.offseq.com/threat/malicious-code-in-preferenceslifecycle-paypal-npm-9a765312fd726ca7 #OffSeq #npm #ThreatIntel #Infosec
0
0
0
offseq
OffSequence @offseq@infosec.exchange · Jul 26, 2026
'f0-form-manipulator' v28.0.0 (npm) flagged as malicious (HIGH) by OpenSSF. Package communicates with a known bad domain — no CVE or CVSS, no exploits yet. Remove or avoid this version. Monitor advisories for updates. https://radar.offseq.com/threat/malicious-code-in-f0-form-manipulator-npm-fe8afbba3f39b359 #OffSeq #npm #infosec #SupplyChain
0
0
0
offseq
OffSequence @offseq@infosec.exchange · Jul 26, 2026
xo-member-components v28.0.0 (npm) flagged as malicious (HIGH severity): connects to a known malicious domain. No patch exists — remove or avoid this version. No active exploits reported. https://radar.offseq.com/threat/malicious-code-in-xo-member-components-npm-19227206998cf01d #OffSeq #npm #SupplyChain #Infosec
0
0
0