#npmsecurity

CyberMaterial

@cybermaterial.bsky.social

1 week ago

North Korean Hackers Hide RAT In npm
Read More: buff.ly/hueDNJ7

#StegaBin #npmSecurity #SupplyChainAttack #FamousChollima #Steganography #RemoteAccessTrojan #DeveloperSecurity #InfosecAlert

CyberMaterial

@cybermaterial.bsky.social

2 weeks ago

Malicious Npm Packages Steal Secrets
Read More: buff.ly/ZvuFHlP

#SANDWORMMODE #npmSecurity #SupplyChainAttack #PromptInjection #GitHubAbuse #CredentialTheft #AIcodingRisk #ThreatIntel

CyberMaterial

@cybermaterial.bsky.social

2 months ago

Malicious Npm Package Steals Whatsapp
Read More: buff.ly/2PGVDEO

#NPMSecurity #MaliciousPackage #SupplyChainMalware #WhatsAppAPI #DeveloperThreats #OpenSourceSecurity #CredentialExfiltration

Hacker News Companion

@hncompanion.com

2 months ago

Hacker News discussed `lotusbail` npm package, which stole WhatsApp data. It highlights critical supply chain attack risks in JavaScript. We need better security for dependencies given how easily malicious code infiltrates projects. #NPMsecurity 1/6

Manuel Bissey

@mbissey.bsky.social

2 months ago

Poisoned WhatsApp API package steals messages and accounts : And it's especially dangerous because the code works

A malicious npm package is stealing WhatsApp messages — a sharp reminder that the software supply chain can betray even trusted platforms. Verify dependencies, always. 📦🔓 #SupplyChainRisk #NPMSecurity

Hacker News Companion

@hncompanion.com

3 months ago

A major takeaway: package managers like npm allowing arbitrary code execution during installation is a fundamental security flaw. This "feature" creates a huge attack surface, making supply chain attacks like Shai-Hulud possible. Ecosystem-level fixes are critical. #npmsecurity 2/6

Manuel Bissey

@mbissey.bsky.social

3 months ago

DPRK Attackers Spawn Malicious Npm Package Factory North Korean attackers have delivered more than 197 malicious packages as part of ongoing state-sponsored activity to compromise software developers.

A malicious npm package factory is churning out contagious code — proving the software supply chain can be poisoned at the source. Developers must verify every dependency. 🧩⚠️ #NPMSecurity #SupplyChainRisk

Hacker News Companion

@hncompanion.com

3 months ago

The 'Shai-Hulud' NPM supply chain attack is compromising developer systems and exfiltrating credentials. This discussion explores NPM vulnerabilities, mitigation strategies, and the shared responsibilities in securing software development against such widespread threats. #NPMsecurity 1/6

Hacker News Companion

@hncompanion.com

3 months ago

NPM's perceived insecurity is a core theme. Its permissive package updates & install scripts are major concerns. Users suggest alternatives like pnpm/bun & stricter controls. Is Node.js viable for new projects given these risks? 🤔 #NPMsecurity 2/6

Manuel Bissey

@mbissey.bsky.social

4 months ago

Over 67,000 Fake npm Packages Flood Registry in Worm-Like Spam Attack A mysterious npm worm published 46K fake packages in a two-year spam campaign, exposing major security gaps.

Over 46,000 fake npm packages flood the ecosystem — attackers are poisoning the software supply chain at scale. Developers must verify before they install. 📦⚠️ #SoftwareSupplyChain #NPMSecurity

Hacker News Companion

@hncompanion.com

4 months ago

Overview: A flood of malicious NPM packages raises alarms about software supply chain security. The core issue: NPM's architecture allows arbitrary code execution via lifecycle scripts during installation, posing significant risks. Mitigation strategies are urgently needed. #NPMsecurity 1/6

Approov Mobile Security

@approov.bsky.social

4 months ago

NPM Nightmare: & Cloudflare AI That Secured End Users From 2 Billion Weekly Malicious Downloads The Billion-Download Backdoor: Defending Client-Side Supply Chains Against Crypto-Draining NPM Attacks -------------------------------------------------------------------------------- Episode Notes In early September 2025, the open-source software ecosystem faced a massive supply chain attack when attackers compromised trusted maintainer accounts on npm using targeted phishing emails. This security breach led to the injection of malicious code into 18 widely used npm packages—such as chalk, debug, and ansi-styles—which together account for more than 2 billion downloads per week. This episode dives into the mechanics of the attack, the threat posed by the complex malware deployed, and the role of advanced AI-powered defenses in preventing client-side disaster. Key Takeaways The Threat Landscape The attackers' primary goal was crypto-stealing or wallet draining. The compromised packages contained obfuscated JavaScript, which, when included in end-user applications (including web projects and mobile apps built with frameworks like React Native or Ionic), was activated at the browser level. This malware would intercept network traffic and API requests, ultimately swapping legitimate cryptocurrency addresses (including Bitcoin, Ethereum, and Solana) with the attackers' wallets. The attack leveraged the human factor, as maintainers were tricked by phishing emails urging them to update two-factor authentication credentials via a fake domain, npmjs[.]help. The Evolution of Malware: Shai-Hulud Beyond crypto-hijacking, researchers detected a complex self-replicating worm dubbed Shai-Hulud. This advanced payload targets development and CI/CD environments: • Autonomous Propagation: Shai-Hulud uses existing trust relationships to automatically infect additional NPM packages and projects. • Credential Theft: Using stolen GitHub access tokens, the worm lists and clones private repositories to attacker-controlled accounts. • Secret Harvesting: It downloads and utilizes the secret-scanning tool TruffleHog to harvest secrets, keys, and high-entropy strings from the compromised environment. • Malicious Workflows: Shai-Hulud establishes persistence by injecting malicious GitHub Actions workflows into repositories, enabling automated secret exfiltration. Automated Defense with AI Security Cloudflare’s client-side security offering, Page Shield, proved critical in mitigating this threat. Page Shield assesses 3.5 billion scripts per day (40,000 scripts per second) using machine learning (ML) based malicious script detection. • Page Shield utilizes a message-passing graph convolutional network (MPGCN). This graph-based model learns hacker patterns purely from the structure (e.g., function calling) and syntax of the code, making it resilient against advanced techniques like code obfuscation used in the npm compromise. • Cloudflare verified that Page Shield would have successfully detected all 18 compromised npm packages as malicious, despite the attack being novel and not present in the initial training data. • While patches were released quickly (in 2 hours or less), Page Shield was already equipped to detect and block this threat, helping users "dodge the proverbial bullet". Security Recommendations To protect against fast-moving supply chain attacks, organizations must maintain vigilance and implement automated defenses: 1. Audit Dependencies: Review your dependency tree, checking for versions published around early–mid September 2025. Developers should pin dependencies to known-good versions. 2. Rotate Credentials: Immediately revoke and reissue any exposed CI/CD tokens, cloud credentials, or service keys that might have been used in the build pipeline. 3. Enforce MFA: Tighten access policies and enforce multi-factor authentication (MFA) on all developer and CI/CD access points. 4. Proactive Monitoring: Monitor build logs and environments for signs of suspicious scanning activity, such as the use of TruffleHog. -------------------------------------------------------------------------------- 🔗 Relevant Links and Resources • Cloudflare: https://blog.cloudflare.com/how-cloudflares-client-side-security-made-the-npm-supply-chain-attack-a-non/     ◦ Cloudflare Page Shield Script detection • Trend Micro Research: What We Know About the NPM Supply Chain Attack • Kaspersky Blog: Popular npm packages compromised 🛡️ Sponsor This episode of Upwardly Mobile is brought to you by our friends at https://approov.io/mobile-app-security/rasp/. -------------------------------------------------------------------------------- Keywords: NPM supply chain attack, Cloudflare Page Shield, Shai-Hulud worm, Cryptohijacker, crypto-stealing malware, client-side security, JavaScript obfuscation, open-source security, dependency audit, CI/CD security, phishing attack, MPGCN, machine learning security, developer accounts compromise, npm packages, software security.          

📣 New Podcast! "NPM Nightmare: & Cloudflare AI That Secured End Users From 2 Billion Weekly Malicious Downloads" on @Spreaker #aiinsecurity #approov #clientsidesecurity #cloudflarepageshield #cryptostealing #cybersecurity #devsecops #javascriptsecurity #npmsecurity #shaihulud #supplychainattack

Hacker News Companion

@hncompanion.com

5 months ago

The `postmark-mcp` backdoor highlights how easily malicious code can infiltrate through third-party packages. This specific attack underscores the constant threat of supply chain vulnerabilities in modern software development. #NPMsecurity 2/5

Rene Robichaud

@neroqc.bsky.social

5 months ago

GitHub tightens npm security with mandatory 2FA, access tokens GitHub is introducing a set of defenses against supply-chain attacks on the platform that led to multiple large-scale incidents recently.

GitHub tightens npm security with mandatory 2FA, access tokens
www.bleepingcomputer.com/news/securit...

#Infosec #Security #Cybersecurity #CeptBiro #GitHub #NpmSecurity #Mandatory2FA #AccessTokens

HARP Coin

@harpcoin.co

5 months ago

GitHub Tightens npm Security with Mandatory 2FA and Access Tokens GitHub enhances npm security by mandating two-factor authentication (2FA) and introducing advanced access tokens, drastically strengthening defenses against supply chain attacks. Learn what these changes mean for developers and how to adapt securely.

GitHub Tightens npm Security with Mandatory 2FA and Access Tokens Security hasn’t always been the most robust attribute of open-source package repositories, but recent events.... @cosmicmeta.ai #NpmSecurity

https://u2m.io/gzxcQSFg

Hacker News Companion

@hncompanion.com

5 months ago

A recent NPM supply chain attack sparked Hacker News debate on JavaScript's dependency vulnerabilities. Discussion focused on mitigating risks, balancing code reuse vs. security, and improving ecosystem safeguards. #NPMsecurity 1/5

Hacker News Companion

@hncompanion.com

6 months ago

NPM-like platforms need stronger security. Phishing leads to account takeovers. Solutions include stricter auth like passkeys, publish freeze periods after credential changes, and mandatory code signing for packages. Protect your software supply chain! #NPMsecurity 2/6

Metadrop

@metadrop.bsky.social

6 months ago

Although npm has been compromised, your site is probably not affected. Read this article to help you keep calm and avoid panicking, while still keeping an eye on web security:

metadrop.net/en/articles/...

#SupplyChainAttack #npmSecurity #npmAttack

Hacker News Companion

@hncompanion.com

6 months ago

The #NPM ecosystem's vulnerability to supply chain attacks is a major concern. Discussions highlighted how easily malicious code can infiltrate widely used packages, emphasizing the need for robust verification processes beyond basic checks. #NPMsecurity 2/6

Hacker News Companion

@hncompanion.com

6 months ago

Hacker News discussed the compromise of NPM packages like `debug` & `chalk` via a targeted phishing attack on maintainer junon. The community analyzed the attack, its JS ecosystem implications, and debated mitigation & security responsibilities. #NPMsecurity 1/6

Checkmarx Zero

@checkmarxzero.bsky.social

6 months ago

Last Week in AppSec for 26. August 2025 - Checkmarx Here are some news items our team found interesting over the past week, which you might have missed. NPM package `cipher-base` through 1.0.4 has insecure hash implementations…

Here 👇 are some AppSec news items our team found interesting last week that you might have missed. See buff.ly/hvYIJI6 for details #AppSec #SupplyChainSecurity #OpenSourceSecurity #NpmSecurity #CVE #VulnerabilityManagement #DevSecOps 🧵 1/4

@cyfluencer.bsky.social

9 months ago

Dozens of malicious packages on NPM collect host and network data 60 packages have been discovered in the NPM index that attempt to collect sensitive host and network data and send it to a Discord webhook controlled by the threat actor.

NPM under attack! ⚠️

Malicious packages are exfiltrating system info via Discord. Don’t get caught off guard.

www.bleepingcomputer.com/news/securit...

#DevSecOps #NPMSecurity

The DefendOps Diaries

@defendopsdiaries.bsky.social

1 year ago

Lazarus Group's Latest Supply Chain Attacks on Developers | The DefendOps Diaries Explore Lazarus Group's supply chain attacks on developers using malicious NPM packages and learn how to protect against these threats.

Lazarus Group's Latest Supply Chain Attacks on Developers

#lazarusgroup
#supplychainattack
#npmsecurity
#cybersecurity
#malware

The DefendOps Diaries

@defendopsdiaries.bsky.social

1 year ago

Lazarus Group's Latest Supply Chain Attacks on Developers | The DefendOps Diaries Explore Lazarus Group's supply chain attacks on developers using malicious NPM packages and learn how to protect against these threats.

Lazarus Group's Latest Supply Chain Attacks on Developers

#lazarusgroup
#supplychainattack
#npmsecurity
#cybersecurity
#malware

David @ InnoVirtuoso

@innovirtuoso.bsky.social

1 year ago

Rising Threat of Malicious npm Libraries: A Cautionary Tale The npm ecosystem is crucial for modern web development, but it faces risks from malicious libraries that impersonate trusted tools.

The npm ecosystem powers modern web development 🌐, but it's not without risks. 🚨 Malicious libraries mimicking trusted tools can compromise projects. Stay vigilant: verify packages🛡️ #WebDev #npmSecurity

Read more at: innovirtuoso.com/technology/t...