DeceptiveDevelopment poisons repos after stealing developer credentials
ESET says the group planted code on npm, PyPI, Packagist, Go modules, and extension stores from April to September 2026.
76
- Mentions · 7d7
- Mentions · 30d30
- All mentions58
- First seenAug 26, 2026
- Last mentioned21h ago
Timeline
58 articles · newest firstGitHub previews npm firewall that blocks packages at install
Enterprise Cloud customers can enforce malware advisories, severity, attestations, new install scripts and a package-age cooldown.
44
GitHub npm package firewall can block new versions before install
Enterprises can set a cooldown, alongside AI Scan, Copilot checks, and Dependabot reachability ranking.
38
Malware planted in 42 GitHub repos targets Claude, Gemini and Cursor
Hooks in .github/init.js run at session start; JFrog links the traps to the testmetest npm campaign.
76
testmetest npm campaign hijacks 42 GitHub repositories to steal credentials
JFrog links the worm to hidden CI publishers on short-lived branches; disabling install scripts does not stop a newer import-triggered path.
74
Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
76
Miasma npm worm armed 42 GitHub repositories, JFrog says
Oversized blobs hid credential theft and a token-revocation wiper on real developer accounts, not only test repos.
74
Exaforce says GitHub token theft and vishing drain data in minutes
A dormant OAuth token pulled 472 of 638 repositories; ClickFix and help-desk vishing followed the same pattern.
36
Paper: building from source stops most npm and PyPI malware
A source check blocked 87.7 to 99.9 percent of 47,066 malicious packages, depending on how strictly the source was vetted.
52
Wiz pipeline flags malicious npm packages before a CVE exists
Wiz says notable supply-chain attacks rose from about 10% of significant incidents in late 2025 to 1 in 4.
48
Roundup cites infostealers, malicious packages and ClickFix as rising malware trends
Immersive says Lumma Stealer, StealC and RisePro now account for 75% of stolen credentials sold for initial access.
34
Ledger implant linked to $93M theft; npm flaw hit 1,500 packages
The roundup also covers an exploited Windows Shell flaw and an Ivanti Connect Secure zero-day chain.
74
MALFEX npm Package 'imgdecode' Hides Shellcode Loader in Windows Native Addon
Malicious npm package imgdecode, tied to MALFEX, loads a DLL that downloads and injects shellcode.
74
GitHub Tightens npm Publishing After Flaw Left 1,500+ Packages Vulnerable to Hijacking
GitHub expires unused npm trusted-publisher configs after 48 hours following a slug-reuse flaw affecting 1,500-plus packages.
76
Over 1,500 npm packages exposed by Trusted Publishing validation flaw
A now-fixed npm Trusted Publishing flaw exposed over 1,500 packages to repository-name hijacks.
74
Auditing the auditor: Unmasking Apex Accelerator
Elastic unmasked Apex, a fake Web3 accelerator pushing malicious npm packages and infostealers to crypto founders.
61
New GhostAction Attack Compromises Hundreds of GitHub Repos to Steal Secrets
GhostAction hit 346 GitHub repositories, including Uber's, with malicious Actions workflows that stole CI secrets.
82
Shai-Hulud worm makes jump to AI infrastructure with Tensorlake compromise
Shai-Hulud infected Tensorlake’s npm SDK 0.5.144, stealing credentials before the package was removed within minutes.
78
Tensorlake npm Package Compromised to Spread Shai-Hulud Worm and Steal Developer Secrets
Malicious tensorlake@0.5.144 on npm delivers a Shai-Hulud worm that steals developer secrets and can wipe hosts.
82
Hackers Use Web3 and Blockchain C2 to Hide Supply Chain Attacks Targeting Cloud Credentials
Unit 42 says the ChainDrop npm worm uses Ethereum smart contracts as C2 to steal cloud and developer credentials.
79
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Attackers published a malicious tensorlake npm package that spreads a new Shai-Hulud supply-chain worm.
77
ChainDrop and PolinRider Use Blockchain C2 to Steal Cloud and CI/CD Credentials
ChainDrop and North Korea-linked PolinRider use blockchain C2 to steal cloud and CI/CD credentials.
78
MALFEX npm Malware Hides Executables in PNG Files to Infect Windows Developers
MALFEX npm packages hide Windows malware in fake PNG files, delivering Overlord RAT and the movinlike stealer.
72
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.
73
Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
The MALFEX npm campaign ships Overlord RAT and movinlike to steal browser passwords, Discord tokens, and crypto wallets.
71
Evolution of Web3 in Cloud Supply Chain Attacks
Unit 42 says DPRK-linked actors use Web3 smart contracts as C2 for npm worms stealing cloud credentials.
78
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Eight malicious npm packages, downloaded 40,767 times, installed Overlord RAT and a Node.js stealer.
73
Long-Running NPM Malware Campaign Accumulates 40,000 Downloads
Checkmarx says a long-running npm campaign passed 40,000 downloads of packages dropping Overlord RAT and stealers.
63
Hackers Poison Trusted Software Updates to Steal Developer and Cloud Credentials
ReversingLabs traces S1ngularity, Shai-Hulud, and TeamPCP campaigns that poisoned npm updates to steal developer and cloud credentials.
58
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware
Supply-chain worms in npm packages, including Nx, steal developer credentials and can enlist local AI coding tools.
76
Over 543,000 valid credentials exposed in public GitHub repositories
Truffle Security found 543,699 still-valid credentials exposed in public GitHub repositories.
74
Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches
Qualys says supply-chain malware on developer machines is stealing cloud credentials and enabling downstream breaches.
72
Attackers Target Developer Credentials to Expand Supply Chain Intrusions Beyond Source Code
Malicious npm packages, including Mini Shai-Hulud, steal developer and CI/CD cloud credentials during install.
62
DPRK-Linked Hackers Add HashHiding to Blockchain C2 Network for Takedown-Resistant Malware
DPRK-linked hackers added Ethereum HashHiding so malware can recover C2 addresses from ordinary transfers.
76
GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Two compromised GitHub Actions stayed live for nine days still serving the Mini Shai-Hulud payload.
78
Kothamine malware uses Tailscale’s tailcat to evade network detection
Malwarebytes details Kothamine, a Windows RAT spread via npm that tunnels commands through Tailscale tailcat.
67
Malicious npm Packages That Evade Defenses
Schneier highlights malicious npm packages designed to evade existing software supply-chain defenses.
42
npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence)
npm keeps timestamps for removed package versions but drops the removal reason, hindering supply-chain response.
36
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Compromised MemTensor packages on npm and PyPI deliver a cross-platform credential stealer, using stolen GitHub Actions tokens for distribution.
80
Graphalgo Malware Uses Malicious Terraform Providers and Go Modules to Deploy RAT
Graphalgo malware expands supply-chain attacks to Terraform providers and Go modules, using Slack and blockchain for C2.
75
Related CVEs
by mentions- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
- CVE-2026-6303011%9.8WordPress Core Route Confusion (wp2shell) Enables SQL Injection to RCE
- CVE-2026-9695110%8.8Windows Shell command injection bypasses a security feature
- CVE-2026-601375%5.9WordPress Core SQL Injection via WP_Query author__not_in (CVE-2026-60137)
- CVE-2026-194786%9.1Unauthenticated GraphQL Code Injection in GitLab CE/EE Enables Data Tampering
Appears with
- GitHubvendor · 19
- Shai-Huludmalware · 17
- GitHuborganization · 14
- PyPIproduct · 11
- GitHub Actionsproduct · 10
- Socketorganization · 9
- SafeDeporganization · 8
- npmvendor · 7
- Microsoftvendor · 7
- Checkmarxorganization · 7
- TeamPCPthreat actor · 6
- Mini Shai-Huludmalware · 6
- movinlikemalware · 5
- GitHubproduct · 5
- Visual Studio Codeproduct · 5
- ChainDropmalware · 5
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.