Stolen and leaked credentials lead to Node.js packages from AsyncAPI and Jscrambler Code Integrity being poisoned with ...

Upwind traces multiple compromised AsyncAPI npm packages to a coordinated supply chain attack targeting software release pipelines and publishing identities.

Malicious packages on the Node Package Manager (npm) and the Python Package Index (PyPI) delivered stealer malware to ...

Socket found a compromised Injective npm package stealing wallet keys amid rising crypto supply chain attacks.

JFrog finds 148 npm proxy packages turned student browsers into a DDoS botnet, while a mutable loader lets operators re-arm ...

Hackers compromised the Injective Labs SDK project's GitHub repository and used it to publish a malicious package on the Node ...

Threat actors compromised AsyncAPI packages and weaponized trusted CI/CD workflows to distribute malware through npm. This ...

Injective says the npm supply chain issue was resolved before downloads, with zero user funds at risk or compromised.

Join Microsoft Security at Black Hat USA 2026 for supply chain research, hands-on security experiences, expert conversations, ...

Injective has dismissed concerns that user funds were compromised after attackers planted wallet-key-stealing code in 18 of ...

According to Socket, malicious payment SDK packages on npm and PyPI are harvesting developer credentials and CI/CD ...

Lazarus Group concealed a four-module remote access toolkit inside six fake npm Rollup polyfill packages that fired at import time — not install time — evading npm v12’s script-blocking defaults and ...