Lookalike Packages, Real Risk: Why npm’s Trust Model Keeps Getting Targeted

A reported Lazarus-linked brandjacking campaign against npm developers shows how package identity, install-time behavior, and secret-rich workstations can turn routine dependency work into a security event.

Shadow Code: How a Fake npm Package Hijacked Developer Secrets in Minutes

A bogus “tanstack” npm package silently stole sensitive credentials from unsuspecting developers, exposing the dangers of brandjacking in open-source supply chains.

Fake Prettier Extension on VSCode Marketplace Dropped Anivia Stealer