Miasma Malware Hits 32 Red Hat Packages via Compromised GitHub Account

32 Red Hat npm packages compromised by Miasma malware expose cloud tokens, CI/CD secrets and developer credentials in supply chain attack.

·

Cyber Attack, cybersecurity, Data Breaches, GitHub, Malware, Miasma, npm, Red Hat, Security, vulnerability

¶¶¶¶¶

27,000-Download Codex UI Tool Secretly Stole OpenAI Refresh Tokens

A malicious Codex UI npm package with 27,000 weekly downloads was caught exfiltrating OpenAI refresh tokens, exposing developers to account takeover risks.

·

Android, Artificial Intelligence, Codex UI, cybersecurity, GitHib, npm, OpenAI, OpenAI Codex, SCAM, Security, typosquatting

¶¶¶¶¶

TeamPCP Claims Sale of Mistral AI Repositories Amid Mini Shai-Hulud Attack

TeamPCP claims to be selling alleged Mistral AI repositories on a hacker forum after the Mini Shai-Hulud attack targeted npm and PyPI ecosystems.

·

AI, Cyber Attack, Cyber Crime, cybersecurity, Data Breaches, Mistral AI, npm, PyPI, Security, Supply Chain, TeamPCP

¶¶¶¶¶

TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages

Research reveals that TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.

·

Cyber Attack, Malware, Mini Shai-Hulud, npm, PyPI, Security, Supply Chain, TeamPCP

¶¶¶¶¶

TeamPCP Hijacks Bitwarden CLI, Uses Dependabot to Deploy Shai-Hulud Malware

GitGuardian uncovers TeamPCP attack on Bitwarden CLI, abusing GitHub Dependabot to spread Shai-Hulud and poison AI coding tools.

·

Bitwarden, Cyber Attack, Cyber Crime, Cyber-Attacks, cybersecurity, Developer, Malware, npm, Password manager, Security, TeamPCP

¶¶¶¶¶

52M-Download protobuf.js Library Hit by RCE in Schema Handling

Critical RCE flaw in protobuf.js lets attackers execute code via malicious schemas. Learn who is at risk, affected versions, and how to fix it.

·

cloud, Cyber Attack, cybersecurity, npm, protobuf, RCE, Security

¶¶¶¶¶

Hackers Poison Axios npm Package with 100 Million Weekly Downloads

Axios npm Package compromised in a supply chain attack, exposing developers to malware, data theft, and full system takeover risks worldwide.

·

Axios, Cyber Attack, cybersecurity, Malware, npm, Security, Supply Chain

¶¶¶¶¶

New Ghost Campaign Uses Fake npm Progress Bars to Phish Sudo Passwords

ReversingLabs researchers identify a new Ghost campaign using fake npm install logs and progress bars to phish for sudo passwords and steal crypto wallets from developers.

·

Cyber Attack, cybersecurity, Developers, Malware, npm, Phishing, Phishing Scam, SCAM, Security, Sudo

¶¶¶¶¶

Suspected Hijacked Developer Accounts Spread npm Malware

Sonatype uncovers a sophisticated malware campaign using hijacked npm developer accounts to steal API keys and passwords. Is your dev environment at risk?

·

Cyber Attack, cybersecurity, Developer, Malware, npm, Security, Sonatype

¶¶¶¶¶

Hackers Hide Pulsar RAT Inside PNG Images in New NPM Supply Chain Attack

Cybersecurity researchers at Veracode reveal a typosquatting attack that disguises Pulsar RAT as images to bypass Windows security and antivirus programs.

·

Cyber Attack, Cyber-Attacks, cybersecurity, Developers, Images, Malware, npm, PNG, Pulsar RAT, Security, steganography, typosquatting, Windows

¶¶¶¶¶

1010.cx

1010.cx

Category: npm