npm news
6 stories
⚡ Weekly Recap: AI-Powered PLC Attacks, GitLab Attacks, Stripe Key Leaks and More
This week's cybersecurity reporting highlights several significant threats, including the emergence of AI-powered attacks against industrial control systems (ICS), active exploitation of a critical vulnerability in GitLab, and the discovery of trojanized npm packages distributing a sophisticated Linux backdoor. Further reports detailed a novel method for exploiting expired credit cards in…
14 Trojanized npm Packages Drop RedC2 4.0 Linux Backdoor With AI-Assisted C2
A recent report indicates that security researchers have uncovered 14 malicious npm packages designed to deploy a Linux backdoor identified as RedC2 4.0. These packages were reportedly masquerading as legitimate utilities related to calendar and streak tracking functionalities within the npm ecosystem. The discovery highlights an ongoing threat vector targeting developers and systems reliant…
Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
A recent report details the discovery of a campaign involving nearly 800 malicious npm packages designed to deliver a cross-platform Remote Access Trojan (RAT) and an infostealer. The packages leverage various deceptive tactics, including apparent AI generation and typo-squatting, to entice developers into incorporating them into their projects. The primary infection vector involves developers…
The security signal log tailing can't see: tracking npm cooldown removals with Elastic Agent
Elastic has developed a new detection engineering method to track the removal of the `min-release-age` setting from `.npmrc` files on developer workstations. This setting, available since npm version 11.10, is designed to prevent the installation of recently published package versions, mitigating supply chain attacks such as Compromise Software Dependencies and Development Tools (T1195.001).
Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver RAT
Researchers have uncovered a software supply chain attack involving seven malicious npm packages targeting the Vite frontend tooling ecosystem. These packages, collectively named ViteVenom, were found to employ a sophisticated, multi-tier blockchain-based command-and-control (C2) infrastructure to deliver a remote access trojan (RAT) to compromised systems.
Miasma Worm Exploits Developer Credentials in Supply Chain Attacks
A sophisticated supply chain attack campaign, dubbed Miasma, has targeted multiple organizations by exploiting stolen developer credentials, leading to the compromise of numerous software packages. The campaign, which began on June 1, affected packages within Red Hat, Vapi.ai, and Microsoft Azure repositories. Researchers observed that the malicious packages generated by Miasma included valid…