35 matches found
Toptal GitHub Breach Exposes 73 Repositories and Injects Malware into 10 npm Packages
In what's the latest instance of a software supply chain attack, unknown threat actors managed to compromise Toptal's GitHub organization account and leveraged that access to publish 10 malicious packages to the npm registry. The packages contained code to exfiltrate GitHub authentication tokens...
MAL-2025-6067 Malicious code in @toptal/picasso-utils (npm)
The package communicates with a domain associated with malicious activity...
Embedded Malicious Package
Overview @toptal/picasso-utils is a malicious package. through the preinstall and postinstall scripts. A potentially compromised account operating in Toptal's GitHub organization exposed an AWS token, leading to the account being taken over. This allowed the attackers to expose private...
Malicious code in @toptal/picasso-quote (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-link (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-form (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-popper (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-button (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-alert (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6045 Malicious code in @toptal/picasso-dropdown (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-accordion (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6039 Malicious code in @toptal/picasso-accordion (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-logo (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-paper (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6055 Malicious code in @toptal/picasso-paper (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-image (npm)
The package communicates with a domain associated with malicious activity...
MAL-2025-6051 Malicious code in @toptal/picasso-image (npm)
The package communicates with a domain associated with malicious activity...
Malicious code in @toptal/picasso-grid (npm)
The package communicates with a domain associated with malicious activity...