🧰 npm packages

The items that name it 23

• Evolution of Web3 in Cloud Supply Chain Attacks
  article2026-10-07It is written here as npm packages (over 400 infected by ChainDrop, including keyv and cacheable-request).

  over 400 infected by ChainDrop, including keyv and cacheable-request

• The OpenSourceMalware Show #22
  talk2026-09-25It is written here as npm packages (16 total).

  Packages found to contain the new WeaselBiscuit malware family.

• Shai-Hulud 2 Malware Campaign Targets GitHub and Cloud Credentials Using Bun Runtime | Blog | Endor Labs
  writeup2026-09-11

  Includes packages from Zapier, ENS Domains, Postman, and PostHog; see affected packages list for full breakdown

• Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes
  writeup2026-09-01It is written here as npm packages (related tenant).

  More than 50 npm packages across four publisher scopes used as a configuration dead-drop for a separate gambling operation riding the same FUNNULL infrastructure

• Awesome Cybersecurity Agentic AI
  repo2026-08-31

  pre-install verification against OSV and OpenSSF malicious-package advisories (Lazaretto)

• The State of Open Source Supply Chain Attacks
  article2026-08-23It is written here as npm packages (general).

  Biggest target ecosystem; 500+ packages compromised by Shai-Hulud alone.

• Why NPM Malware Keeps Reaching for Bun | Supply Chain Security | Blog | Endor Labs
  article2026-08-12It is written here as npm packages (796 packages / 1,092 versions compromised in Shai-Hulud 2.0).

  796 packages / 1,092 versions compromised in Shai-Hulud 2.0

• 77 "Evil Twin" Open VSX Extensions
  article2026-08-08It is written here as npm packages (450 unique, 2,244 artifacts).

  Compromised as part of ChainDrop supply chain attack, delivering an information stealer and trojanized package versions

• Socket: Suno Breached via Shai-Hulud Worm, Leaked Code Exposes AI Music Scraping
  article2026-07-17

  Shai-Hulud republished malicious versions of npm packages reachable via stolen accounts; first wave compromised dozens of packages in September 2025.

• GitHub Action Canaries
  repo2026-07-11It is written here as npm packages (dependency installs).

  dependency installs

• DataDog/guarddog
  repo2026-07-11
• Socket: PolinRider
  writeup2026-07-02

  Malicious release artifacts identified; campaign originated here

• New in the Threat Center: Compromised Components, Now Available via API
  article2026-06-09

  Open Source Software (OSS) components across ecosystems can be compromised; example given: package 'malicious-pkg' version 1.2.3 (npm) described as containing malicious code that exfiltrates credentials, severity critical, verified

• AWS Well-Architected: Software Supply Chain Security
  article2026-06-04

  Malicious versions of popular packages published via compromised maintainer credentials

• Dev Machine Guard Now Scans Extensions Across Every Modern IDE
  article2026-06-02

  500+ packages compromised in Shai-Hulud worm campaign, some as transitive dependencies of extensions

• What MDM can't protect on developer machines (and what to do about it)
  article2026-05-28It is written here as npm packages: Mistral, TanStack.

  Among 160+ packages compromised by the Mini Shai-Hulud worm

• Socket: OSV Withdraws 157 Malware Reports
  article2026-05-28It is written here as npm packages (long tail).

  Additional MCP servers, AI tools, CLI packages, framework forks, component libraries, and API clients flagged as false positives

• Socket: TrapDoor Crypto Stealer
  writeup2026-05-26It is written here as npm packages (21 listed).

  async-pipeline-builder, build-scripts-utils, chain-key-validator, crypto-credential-scanner, defi-env-auditor, defi-threat-scanner, deployment-key-auditor, dev-env-bootstrapper, eth-wallet-sentinel, llm-context-compressor, mnemonic-safety-check, model-switch-router, node-setup-helpers, project-init-

• Bumblebee
  repo2026-05-24
• The Evolving Linux Threat Landscape
  article2026-03-03

  Open-source packages compromised in the Shai Halud worm attack, targeting Linux and macOS endpoints

• shai-hulud-detect: multi-ecosystem npm/PyPI/Composer/Crates/Go/Hex/RubyGems supply-chain worm scanner
  repoIt is written here as npm packages (5,782 confirmed bad package versions across ecosystems).

  5,782 confirmed bad package versions across ecosystems

• Dev Machine Guard Now Supports Windows - StepSecurity
  articleIt is written here as npm packages (global and per-project).

  global and per-project

• Dev Machine Guard Now Supports Linux - StepSecurity
  article

  500+ packages compromised in Shai-Hulud campaign; TanStack and other widely used npm packages hit in Mini Shai-Hulud wave