Hulud-like Sandworm_Mode supply chain attack targets NPM developers to steal secrets and poison AI assistants.
The module targets Claude Code, Claude Desktop, Cursor, Microsoft Visual Studio Code (VS Code) Continue, and Windsurf. It also harvests API keys for nine large language models (LLM) providers: ...
A new malware is circulating in the npm ecosystem, stealing credentials and CI secrets and spreading autonomously.
While the AI itself wasn’t weaponized, the technique raises concerns about AI agents with broad system access.
Attackers are exploiting a major weakness that has allowed them access to the NPM code repository with more than 100 credential-stealing packages since August, mostly without detection. The finding, ...
Amazon researchers discovered more than 150,000 malicious packages in the NPM registry, in what they called "a defining moment in supply chain security." The packages were part of a token farming ...
Threat actors are finding new ways to insert invisible code or links into open source code to evade detection of software supply chain attacks. The latest example was found by researchers at ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results