api.npmjs.org

• Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages

  Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages A supply chain worm dubbed Miasma has been found in dozens of @redhat-cloud-services npm releases. The malicious preinstall hook steals credentials, probes cloud identities, and can republish

• Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp

  Node-gyp Supply Chain Compromise: A Self-Propagating npm Worm That Hides in binding.gyp A new npm worm is abusing binding.gyp to trigger node-gyp during install, letting malicious packages run code without lifecycle scripts. It steals credentials, persists in GitHub, and self-pr

All reports →