Over 1,500 npm packages exposed by Trusted Publishing validation flaw
A now-fixed npm Trusted Publishing flaw exposed over 1,500 packages to repository-name hijacks.
74
- Mentions · 7d0
- Mentions · 30d1
- All mentions12
- First seenSep 16, 2026
- Last mentioned29d ago
Timeline
12 articles · newest firstResearchers Find 543,699 Active Credentials Leaked in Public GitHub Repos
Truffle Security verified 543,699 credentials still active after exposure in public GitHub repositories.
78
Fake Express Packages on npm Spread a Linux Worm
Nine fake Express and React npm packages install a Linux worm deploying a CHAOS RAT backdoor that spreads via SSH keys and npm tokens.
60
101 Malicious npm Packages Add Developers' WhatsApp Accounts to Groups Without Consent
OX Security found 101 malicious npm packages totaling 490,000 downloads that hijack developers' WhatsApp accounts into attacker-controlled groups.
55
npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence)
npm keeps timestamps for removed package versions but drops the removal reason, hindering supply-chain response.
36
Malicious B-tree NPM Package Accumulates Millions of Downloads
Ongoing NPM supply chain campaign hides malware in indexed-btree's prototype code, reaching 2 million weekly downloads before detection.
58
GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package
GHAPPIER supply chain campaign compromised 65 GitHub repositories and pushed a malicious four-stage npm loader via compromised maintainer trusted publishing.
55
Malicious npm Package indexed-btree Hid Its Loader in Runtime Code Before Removal
Checkmarx details malicious npm package indexed-btree hiding its loader in runtime code, netting €230,000; Socket flags PolinRider Packagist compromise.
62
Hackers Compromise 65 GitHub Repositories and Poison npm Package With Hidden Backdoor
CloudSEK details GHAPPIER campaign compromising 65 GitHub repos to backdoor the @dforge-core/dforge-mcp npm package with cryptographically verified provenance.
65
New npm malware finds a way around install script defenses
Checkmarx details npm supply-chain malware hiding in BTree methods, using Ethereum smart-contract C2 and Slack/Telegram exfiltration; ten packages pulled.
60
Attackers Abuse npm Trusted Publishing in GHAPPIER Campaign
Attackers abused npm trusted publishing to ship the GHAPPIER loader via a legitimate package in the North Korea-linked PolinRider campaign.
72
CASHEWS: Source Preprocessor for LLM-based Malicious Package Detection
CASHEWS preprocessor boosts LLM-based malicious npm package detection, raising coverage to 98.8-100% and cutting false negatives by up to 18.6 points.
42
Appears with
- GitHuborganization · 6
- PolinRiderorganization · 3
- Checkmarxorganization · 3
- CloudSEKorganization · 3
- npmproduct · 3
- GitHub Actionsproduct · 2
- GitHubvendor · 2
- MongoDBvendor · 1
- CloudSEKvendor · 1
- GHAPPIERorganization · 1
- GitHubproduct · 1
- WhatsApporganization · 1
- SafeDeporganization · 1
- MongoDBproduct · 1
- Sigstoreproduct · 1
- Xygeniorganization · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.