Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code HooksThe Hacker News·Aug 4, 15:03 UTC · Aug 4, 2026Malware142
Megalodon GitHub Attack Targets 5,561 Repos with Malicious CI/CD WorkflowsThe Hacker News·May 26, 11:56 UTC · May 26, 2026Ransomware57
145 Mastra npm Packages Compromised via Hijacked Contributor AccountThe Hacker News·Jun 22, 05:41 UTC · Jun 22, 2026Malware42
36 Malicious npm Packages Exploited Redis, PostgreSQL to Deploy Persistent ImplantsThe Hacker News·Apr 6, 06:40 UTC · Apr 6, 2026Vulnerability142
PyPI, npm, and AI Tools Exploited in Malware Surge Targeting DevOps and Cloud EnvironmentsThe Hacker News·Jun 15, 00:00 UTC · Jun 15, 2025Malware142
Two Compromised joyfill npm Packages Run RAT When Imported Into Node.jsThe Hacker News·Aug 4, 05:21 UTC · Aug 4, 2026Malware142
Compromised AsyncAPI npm Packages Deliver MultiThe Hacker News·Jul 15, 00:00 UTC · Jul 15, 2026Exploit / PoC157
North Korea-Linked npm Packages Mimic Rollup Polyfills to Steal Developer SecretsThe Hacker News·Jul 3, 16:07 UTC · Jul 3, 2026Data breach57
Malicious npm Packages Pose as PostCSS Tools to Deliver Windows RATThe Hacker News·Jun 23, 09:01 UTC · Jun 23, 2026Malware42
ThreatsDay Bulletin: Worm Code Leaked, AI Agent Phished, Claude Code Patch + 28 New StoriesThe Hacker News·Jun 12, 05:36 UTC · Jun 12, 2026Vulnerability142
Miasma Supply Chain Attack Compromises Red Hat npm Packages with CredentialThe Hacker News·Jun 2, 08:55 UTC · Jun 2, 2026Vulnerability42
Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud SecretsThe Hacker News·May 31, 12:15 UTC · May 31, 2026Data breach157
⚡ Weekly Recap: Instagram Account Hacks, Android ZeroThe Hacker News·Jun 9, 05:53 UTC · Jun 9, 2026Exploit / PoC in the wildCVE-2025-48595CVE-2026-28318CVE-2026-39210+43 CVEs60
Miasma Worm Hits 73 Microsoft GitHub Repositories in Major Supply Chain AttackThe Hacker News·Jun 9, 05:50 UTC · Jun 9, 2026Vulnerability142
JINX-0164 Targets Cryptocurrency Firms with Fake Recruiter Lures and macOS MalwareThe Hacker News·May 28, 12:59 UTC · May 28, 2026Malware42
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer AccountThe Hacker News·May 21, 05:56 UTC · May 21, 2026Malware42
New Wave of DPRK Attacks Uses AI-Inserted npm Malware, Fake Firms, and RATsThe Hacker News·Apr 30, 06:31 UTC · Apr 30, 2026Malware142
Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain CampaignThe Hacker News·Apr 26, 07:45 UTC · Apr 26, 2026Threat actor57
TeamPCP Pushes Malicious Telnyx Versions to PyPI, Hides Stealer in WAV FilesThe Hacker News·Mar 28, 06:25 UTC · Mar 28, 2026Malware42
TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malwareHelp Net Security·Mar 27, 00:00 UTC · Mar 27, 2026Malware42
Vet: Open-source software supply chain security toolHelp Net Security·Jun 3, 00:00 UTC · Jun 3, 2025Vulnerability42