Malicious code in rainbow-bonfire-xre036-project (npm)

The package rainbow-bonfire-xre036-project was found to contain malicious code...

Malicious code in uniform-papa-grape-pkmiq (npm)

The package uniform-papa-grape-pkmiq was found to contain malicious code...

Malicious code in snap-score-meaning137 (npm)

The package snap-score-meaning137 was found to contain malicious code...

Malicious code in avail-able-albu-m-down-load-118093-electric-messiah-ne6od-mtsuyr (npm)

The package avail-able-albu-m-down-load-118093-electric-messiah-ne6od-mtsuyr was found to contain malicious code...

Malicious code in wespeople (npm)

The package wespeople was found to contain malicious code...

Malicious code in strawberry-pxr-project (npm)

The package strawberry-pxr-project was found to contain malicious code...

MAL-2025-38184 Malicious code in veda-crypto (npm)

The package veda-crypto was found to contain malicious code...

MAL-2025-14589 Malicious code in antd-cloud (npm)

The package antd-cloud was found to contain malicious code...

MAL-2025-12421 Malicious code in @zalastax/nolb-mua (npm)

The package @zalastax/nolb-mua was found to contain malicious code...

MAL-2025-11546 Malicious code in @zalastax/nolb-funt (npm)

The package @zalastax/nolb-funt was found to contain malicious code...

MAL-2025-16456 Malicious code in callback-cross-env-technosignature-ganymede (npm)

The package callback-cross-env-technosignature-ganymede was found to contain malicious code...

MAL-2025-38891 Malicious code in wati-empal44-breki (npm)

The package wati-empal44-breki was found to contain malicious code...

MAL-2025-17280 Malicious code in coldkey (npm)

The package coldkey was found to contain malicious code...

RubyGems, PyPI Hit by Malicious Packages Stealing Credentials, Crypto, Forcing Security Changes

A fresh set of 60 malicious packages has been uncovered targeting the RubyGems ecosystem by posing as seemingly innocuous automation tools for social media, blogging, or messaging services to steal credentials from unsuspecting users and likely resell them on dark web forums like Russian Market...

AI-Generated Malicious npm Package Drains Solana Funds from 1,500+ Before Takedown

Cybersecurity researchers have flagged a malicious npm package that was generated using artificial intelligence AI and concealed a cryptocurrency wallet drainer. The package, @kodane/patch-manager, claims to offer "advanced license validation and registry optimization utilities for high-performan...

Malicious code in maventa_utils (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in karma-jasmine-sinon (PyPI)

--- -= Per source details. Do not edit below this line.=-...

Toptal GitHub Breach Exposes 73 Repositories and Injects Malware into 10 npm Packages

In what's the latest instance of a software supply chain attack, unknown threat actors managed to compromise Toptal's GitHub organization account and leveraged that access to publish 10 malicious packages to the npm registry. The packages contained code to exfiltrate GitHub authentication tokens...

Google Launches OSS Rebuild to Expose Malicious Code in Widely Used Open-Source Packages

Google has announced the launch of a new initiative called OSS Rebuild to bolster the security of the open-source package ecosystems and prevent software supply chain attacks. "As supply chain attacks continue to target widely-used dependencies, OSS Rebuild gives security teams powerful data to...

North Korean Hackers Flood npm Registry with XORIndex Malware in Ongoing Attack Campaign

The North Korean threat actors linked to the Contagious Interview campaign have been observed publishing another set of 67 malicious packages to the npm registry, underscoring ongoing attempts to poison the open-source ecosystem via software supply chain attacks. The packages, per Socket, have...