Tag: #npm-security5 results
Security researchers at JFrog discovered malicious npm packages impersonating Rollup polyfill tools. These packages are designed to steal developer credentials and provide remote access to infected machines.
A widely used npm package for OpenAI Codex, codexui-android, was discovered to be a malicious tool that silently exfiltrated developer tokens for over a month. Despite its legitimate appearance and high download count, it compromised user security by harvesting sensitive credentials.
The Shai-Hulud npm worm compromised hundreds of packages after taking over a maintainer’s GitHub account. Its malicious releases received legitimate provenance attestations through the maintainer’s trusted GitHub Actions workflow, exposing a major weakness in software supply-chain trust.
Upwind identified and publicly reported a malicious release of the open-source Keyv package, potentially putting thousands of JavaScript projects at risk. The incident reflects a broader shift toward attacking dependencies before they reach deployed applications.
Hackers stole an npm token from an axios maintainer to publish two malicious versions with a cross-platform RAT. The packages targeted macOS, Windows, and Linux, live for three hours and detected infecting 135 systems. This is the third major npm compromise in seven months, bypassing recommended defenses via CLI publish.