ChainDrop worm crawls into npm supply chain, evades standard defenses

A new variant of the Shai-Hulud npm worm has poisoned hundreds of packages while adding propagation techniques that can leave ...
Tech Times on MSN

Keyv npm supply chain attack hides malware in AI agent files scanners never read

keyv npm supply chain attack on August 4, 2026 let the Shai-Hulud worm compromise 400-plus packages and more than two billion ...
Bleeping Computer

Compromised JavaScript Package Caught Stealing npm Credentials

A hacker has gained access to a developer's npm account and injected malicious code into a popular JavaScript library, code that was designed to steal the npm credentials of users who utilize the ...
Developer Tech

npm supply-chain attack hits 400+ packages and steals developer credentials

A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.
Threat Post

Microsoft Azure Developers Awash in PII-Stealing npm Packages

A large-scale, automated typosquatting attack saw 200+ malicious packages flood the npm code repository, targeting popular Azure scopes. Researchers have found hundreds of malicious packages in the ...
Dark Reading

Novel npm Timing Attack Allows Corporate Targeting

A novel timing attack has emerged for targeting private corporate software packages hosted in the npm code repository. The goal is to uncover the legitimate offerings and then create malicious public ...