CurrentThreat

wafer-template

JFrog discovers 25 open-source npm malicious packages, including one that targets malware authors to hijack stolen Discord tokens.

wafer-text

JFrog discovers 25 open-source npm malicious packages, including one that targets malware authors to hijack stolen Discord tokens.

warbeast2000

Did you download Warbeast2000 or Kodiak2k from npm? If so, your SSH keys might be compromised! These packages steal keys & upload them to GitHub.

Phylum excels at detecting and blocking software supply-chain attacks on developers and their organizations. In June, we were the first to identify North Korean state actors conducting campaigns against npm developers. Today, we unveil another targeted campaign with similar behaviors, again targeting npm.

ynf-core-loader

ynf-core-renderer

ynf-dx-scripts

ynf-dx-webpack-plugins

ython-json-logger

More than 200 malicious packages have flooded npm and PyPI registries to install cryptominers on Linux hosts.

zure-mgmt-authorization

More than 200 malicious packages have flooded npm and PyPI registries to install cryptominers on Linux hosts.

zure-mgmt-containerregistry

More than 200 malicious packages have flooded npm and PyPI registries to install cryptominers on Linux hosts.

casino.web

Added At1692853200000

binarium-crm

Added At1691125200000

ethereum-cryptograph

Added At1691125200000

On Aug 3, 2023 Phylum’s automated risk detection platform alerted us to a series of suspicious publications on npm. The attacker eventually published final versions of two packages: a typosquat of a popular cryptocurrency library and a dependency that contained the malicious code buried deep in a large file

@jackshanyeshuzi/curvess

Added At1691125200000

On Aug 3, 2023 Phylum’s automated risk detection platform alerted us to a series of suspicious publications on npm. The attacker eventually published final versions of two packages: a typosquat of a popular cryptocurrency library and a dependency that contained the malicious code buried deep in a large file

ethereum-cryptographyy

Added At1691038800000

On Aug 3, 2023 Phylum’s automated risk detection platform alerted us to a series of suspicious publications on npm. The attacker eventually published final versions of two packages: a typosquat of a popular cryptocurrency library and a dependency that contained the malicious code buried deep in a large file

ethereum-cryptographyyy

Added At1691038800000

On Aug 3, 2023 Phylum’s automated risk detection platform alerted us to a series of suspicious publications on npm. The attacker eventually published final versions of two packages: a typosquat of a popular cryptocurrency library and a dependency that contained the malicious code buried deep in a large file