HomeAI · summaries
Storia in 6 fonti
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware
4 malicious npm packages with 3,006 downloads spread stealers and Phantom Bot, forcing removals and secret rotation.
Confronto fonti
6 prospettive sulla stessa storiaTimeline cronologica
- ·
news.bitcoin.com
822K Downloads at Risk: Malicious node-ipc Versions Spotted Stealing AWS and Private Keys
Slowmist confirmed three malicious node-ipc npm versions on May 14, 2026, stealing AWS keys, SSH secrets, and .env files via DNS tunneling.
- ·
thehackernews.com
Four Malicious npm Packages Deliver Infostealers and Phantom Bot DDoS Malware
4 malicious npm packages with 3,006 downloads spread stealers and Phantom Bot, forcing removals and secret rotation.
- ·
bleepingcomputer.com
Leaked Shai-Hulud malware fuels new npm infostealer campaign
The Shai-Hulud malware leaked last week is now used in new attacks on the Node Package Manager (npm) index, as infected packages emerged over the weekend.
- ·
infoworld.com
AntV data visualization tool the latest to be hit by ongoing npm supply chain attacks
The largest incident yet is a warning that developers should urgently check package security, say experts.
- ·
theregister.com
Shai-Hulud copycat worm infects yet another npm package
Plus three other stealers in three other packages, all from the same scumbag
- ·
Mini Shai-Hulud Pushes Malicious AntV npm Packages via Compromised Maintainer Account
Mini Shai-Hulud hits @antv and echarts-for-react via npm maintainer compromise, exposing 1.1M weekly downloads to credential theft.
- ·
Shai-Hulud keeps burrowing: 314 npm packages infected after another account compromise
Popular JavaScript modules including size-sensor and echarts-for-react hit as hijacked account closed GitHub warnings
- ·
New Shai-Hulud malware wave compromises 600 npm packages
Threat actors earlier today published more than 600 malicious packages to the Node Package Manager (npm) index as part of a new Shai-Hulud supply-chain campaign.
- ·
GitHub Worm Hits npm Packages With 16M Downloads
A self-replicating worm that hijacks GitHub Actions pipelines to publish malicious npm packages has struck again, compromising AntV, echarts-for-react,
- ·
securityweek.com
Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack
A fresh Mini Shai-Hulud supply chain attack has hit over 320 NPM packages, along with GitHub Actions and a VS Code extension.