Malicious NPM packages fetch infostealer for Windows, Linux, macOS

Ten malicious packages mimicking legitimate software projects in the npm registry download an information-stealing component ...

PhantomRaven attack floods npm with credential-stealing packages

An active campaign named 'PhantomRaven' is targeting developers with dozens of malicious npm packages that steal ...
Hackaday

PhantomRaven Attack Exploits NPM’s Unchecked HTTP URL Dependency Feature

Having another security threat emanating from Node.js’ Node Package Manager (NPM) feels like a weekly event at this point, ...
Arabian Post on MSN

Major Supply-Chain Breach Hits NPM Packages

A sophisticated phishing campaign has enabled attackers to compromise a maintainer account within the npm ecosystem, triggering one of the largest software-supply-chain breaches recorded. On 8 ...