The novel malware strain is being dubbed Shai-Hulud — after the name for the giant sandworms in Frank Herbert’s Dune novel series — because it publishes any stolen credentials in a new public GitHub ...

A year after a glitch at cybersecurity company CrowdStrike triggered a global computer outage affecting millions of computers ...

"Each published package becomes a new distribution vector: as soon as someone installs it, the worm executes, replicates, and ...

Security researchers have identified at least 187 npm packages compromised in an ongoing supply chain attack. The coordinated ...

A new supply chain attack on npm, the node package manager, has injected the first malware with self-replicating worm ...

DPRK used ClickFix to deliver compiled BeaverTail to crypto marketers; Windows build used password-protected archives, ...

Hulud" has compromised hundreds of packages in the npm repository with a self-replicating worm that steals secrets like API key, tokens, and cloud credentials and sends them to external servers that ...

So far, according to recent court filings, the DOJ has already terminated monitorships for three firms that agreed to them ...

Halud, is compromising hundreds of NPM packages, spreading self-replicating malware, exfiltrating data, and turning private ...

Process improvements and a closer look at funding streams will provide far more protection for the open source software we ...

A new piece of malware is spreading through the popular tinycolor NPM library and more than 300 other packages, some of which ...

An apparent "Dune" aficionado is responsible for the first self-propagating attack on the npm JavaScript repository in what one security company has ...