The coordinated campaign has so far published as many as 46,484 packages, according to SourceCodeRED security researcher Paul ...

The typosquatted “@acitons/artifact” package targeted GitHub’s CI/CD workflows, stealing tokens and publishing malicious ...

Cybersecurity researchers have discovered a malicious npm package named "@acitons/artifact" that typosquats the legitimate " ...

For the past four months, over 130 malicious NPM packages deploying information stealers have been collectively downloaded ...

The payload is triggered only between August 8, 2027, and November 29, 2028, and does two destructive things: randomly kills ...

Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.

PhantomRaven slipped over a hundred credential-stealing packages into npm A new supply chain attack dubbed PhantomRaven has ...

Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.

While robust passwords help you secure your valuable online accounts, hardware-based two-factor authentication takes that security to the next level. Read now DevOps security firm JFrog discovered 17 ...

As poisoned software continues to pop up across the industry, some threat actors have found a way to hide malicious code in npm packages and avoid detection from most security tools. In an blog post ...