HomeAI · summaries
Storia in 5 fonti
The Shai-Hulud npm worm didn't fake its security check — it earned a legitimate one
A hijacked GitHub account let the Shai-Hulud worm pass npm's trust check, spreading through packages with 2 billion monthly installs and stealing CI secrets.
Confronto fonti
5 prospettive sulla stessa storiaTimeline cronologica
- ·
thehackernews.com
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
A Keyv-linked npm worm poisoned 353 versions across 79 package names, stealing developer and CI credentials while repository hooks remained present.
- ·
thenextweb.com
Upwind first to report malicious Keyv release that threatened thousands of JavaScript projects
Upwind identified a malicious release of keyv@6.0.0 that harvested AWS, GitHub, and npm credentials via a hidden preinstall script. With 154 million weekly downloads, the…
