Self-propagating npm worm steals tokens via postinstall hooks, impacting six packages and expanding supply chain attacks.
CVE-2026-5752 CVSS 9.3 flaw in Terrarium enables root code execution via Pyodide prototype traversal, risking container ...
A new supply chain attack targeting the Node Package Manager (npm) ecosystem is stealing developer credentials and attempting to spread through packages published from compromised accounts.
A previously undocumented state-backed threat actor named GopherWhisper is using a Go-based custom toolkit and legitimate ...
Fake packages aim to steal data, credentials, and secrets, and to infect every package created using them, in what could be ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results