Tag: supply-chain

art-template npm Hijack Delivers iOS Browser Exploit Kit

art-template versions 4.13.3 through 4.13.7 were compromised after the original author was tricked into transferring ownership through an acquisition fraud. The browser bundle injects scripts that...

Mini Shai-Hulud Strikes Again: 317 npm Packages Compromised

A compromised npm maintainer account published 637 malicious versions across 317 packages including size-sensor, echarts-for-react, timeago.js, and hundreds of @antv scoped packages, affecting 15M+...

Mass Supply Chain Attack Hits TanStack, Mistral AI npm and PyPI Packages

Over 400 compromised npm package versions and at least 2 PyPI packages published in a coordinated supply chain attack targeting TanStack, Mistral AI, UiPath, OpenSearch, guardrails-ai, and dozens of...

Malicious durabletask on PyPI: Multi-Cloud Credential Stealer with Worm Capabilities

Three compromised versions of the Microsoft durabletask Python SDK (1.4.1, 1.4.2, 1.4.3) were published to PyPI, each downloading a stage-2 payload that steals credentials from AWS, Azure, GCP,...

Compromised node-ipc on npm: Credential Stealer via DNS Exfiltration

Analysis of compromised node-ipc versions 9.1.6, 9.2.3, and 12.0.1 on npm: a maintainer account takeover injects an 80KB obfuscated credential stealer that targets 100+ sensitive files (SSH keys,...