PostHog says the Shai-Hulud 2.0 npm worm compromise was "the largest and most impactful security incident" it's ever experienced after attackers slipped malicious releases into its JavaScript SDKs and ...

North Korean actors deployed 197 new npm packages delivering evolved OtterCookie and GolangGhost malware through fake ...

A popular JavaScript cryptography library is vulnerable in a way which could allow threat actors to break into user accounts.

This week, a recently fixed Oracle flaw is being actively exploited, Shelly tackled Pro 4PM DoS bug, "Shai-Hulud 2.0" hit npm ...

"As a new and significantly more aggressive wave of npm supply chain malware, Shai-Hulud 2 combines stealthy execution, ...

A vulnerability in the 'node-forge' package, a popular JavaScript cryptography library, could be exploited to bypass ...

Shai Hulud v2 infected 500+ npm packages (700+ versions) and spilled into Java/Maven — yikes. Compromised packages run a ...

A new iteration of the Shai-Hulud malware that ran through npm repositories in September is faster, more dangerous, and more destructive, creating huge numbers of malicious repositories, compromised ...

A second wave of the Shai-Hulud supply-chain attack has struck the npm software ecosystem, affecting more than 25,000 ...

Each infected version has the ability to automatically spread itself to thousands of other repositories without any human ...

Shai Hulud's automated and aggressive upgrade is spawning more than 1,000 malicious npm repositories every 30 minutes, ...

A large-scale cyberattack has once again hit the NPM ecosystem. Following the first Shai-Hulud worm in September, more than 1 ...