Malicious code in browser-webdriver-downloader (npm)

🗓️ 16 Sep 2025 07:50:07Reported by OSSF Malicious PackagesType

ossf🔗 github.com👁 2 Views

Browser-webdriver-downloader npm package is compromised with malware; it may fully compromise machines; rotate secrets and remove it; Shai-Hulud worm steals tokens and uploads to GitHub.

Source	Link
socket	www.socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages
github	www.github.com/advisories/GHSA-cjq2-vw8m-2c29
wiz	www.wiz.io/blog/shai-hulud-npm-supply-chain-attack
semgrep	www.semgrep.dev/blog/2025/security-advisory-npm-packages-using-secret-scanning-tools-to-steal-credentials/
aikido	www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again
stepsecurity	www.stepsecurity.io/blog/ctrl-tinycolor-and-40-npm-packages-compromised
socket	www.socket.dev/blog/tinycolor-supply-chain-attack-affects-40-packages

18 Sep 2025 04:14Current

7.1High risk

Vulners AI Score7.1