An analysis of how malicious npm packages impersonating cloud SDKs can steal secrets from JavaScript developers, with concrete defensive steps for detecting and blocking supply-chain attacks.
A deep technical walkthrough for hardening npm dependencies and GitHub Actions workflows using CISA's supply chain security checklist to reduce the risk of package, token, and CI/CD compromise.
A deep-technical walkthrough of practical checks developers can run to detect and defend against Glassworm-style supply-chain compromise across npm, PyPI, and OpenVSX dependencies.
A deep technical walkthrough of GitHub's staged publishing changes for npm, how they disrupt scripted supply chain attacks, and what maintainers should do to harden release workflows.
A technical breakdown of malicious packages across npm, PyPI, and Crates.io that were used to steal SSH keys, cloud credentials, and crypto-wallet data, with practical guidance for identifying and containing supply-chain compromise.
npm’s new enforced 2FA-gated publishing and package install controls aim to reduce JavaScript supply chain risk by tightening how packages are published and consumed.
A practical deep-technical walkthrough for auditing npm packages and detecting Hugging Face-hosted second-stage malware used in a modern supply chain attack.
A deep technical breakdown of how the Mini Shai-Hulud attack bypassed npm’s 2FA publishing flow, why npm was forced to revoke and reset tokens, and what package publishers can do to harden their release process.
Explains how a North Korean-linked npm infostealer RAT targets developers, what it steals, and how to detect and defend against supply-chain compromise.
Mini Shai-Hulud is an npm supply-chain attack that compromised @antv packages to steal CI/CD credentials from JavaScript development pipelines.
This post examines the Mini Shai-Hulud npm supply chain attack, where hundreds of packages were compromised through typosquatting and dependency confusion, and outlines practical defenses for maintainers and developers.
A technical audit of the Shai-Hulud worm explains how it spreads through npm workflows and exfiltrates developer secrets from GitHub, AWS, and Kubernetes environments.
A technical breakdown of the Shai-Hulud worm and how a compromised npm package can pivot through developer pipelines to steal secrets and reach GitHub, AWS, and Kubernetes environments.
A counterfeit npm package campaign tied to the TanStack incident compromised employee devices at OpenAI and Mistral, exposing internal repositories and highlighting the risks of open-source supply chain attacks.
A large-scale npm supply chain attack weaponized 170 packages to exfiltrate GitHub, AWS, and Kubernetes credentials from developers and organizations.
A supply-chain attack compromised 84 TanStack npm packages, using SLSA-attested malware to target CI credentials and expose weaknesses in build integrity controls.
A technical walkthrough of the TanStack npm supply-chain compromise, focusing on how the backdoored packages attempted to harvest CI/CD, GitHub, and cloud credentials and what npm consumers should check immediately.
Fake Gemini CLI downloads and typosquatted npm packages are being used in active malware campaigns that target developers with reverse shells and fileless attacks on macOS and Windows.
The Bitwarden CLI npm compromise briefly exposed users who installed @bitwarden/[email protected] during a narrow April 22, 2026 window and prompted immediate uninstall, cache cleanup, script hardening, and secret rotation steps.