Netcrook
#NPM package
108 Poisoned Builds, One Shared Trap: The New Cross-Ecosystem Supply-Chain Wave
A campaign tied to PolinRider has put malicious packages and browser extensions into npm, Packagist, Go, and Google Chrome, showing how one delivery pattern can travel across very different trust systems.
Trusted Release Keys Turned Into a Supply-Chain Weapon
A maintainer-account takeover can do more damage than a single malicious file, especially when one publish pipeline reaches several software ecosystems at once.
Malicious Packages Take the Editor Route: npm and Go Code Abuse VS Code Tasks for Stealth
A package-chain compromise can do more than slip in bad code - it can turn developer tooling itself into the execution path for a cross-platform Python infostealer.
Package Trust Under Siege: Miasma’s Latest Move Cuts Across npm, GitHub Actions, and Go
The latest Miasma-linked supply-chain activity shows how a single poisoned release can pressure multiple trust layers at once, from package registries to build automation.
Trusted npm Packages Become the Doorway in a Quiet Secret-Harvesting Campaign
A poisoned-package wave tied to Mini Shai-Hulud, Miasma, and Hades is pushing supply-chain risk into the heart of developer workstations and CI/CD pipelines.
Npm’s Hidden Trapdoor: How Malicious Packages Can Exploit node-gyp to Target Developer Secrets
A supply-chain lure inside package install and build steps can turn routine development work into an execution window for credential theft, especially when teams trust native-addon metadata too quickly.
npm Lookalikes Put PostCSS Trust Chains on the Hook for Chrome Passwords
A deceptive package name can be enough to turn a routine JavaScript install into a staged Windows malware chain with browser-credential risk.
Fake PostCSS Packages Turned a Routine npm Install into a Windows RAT Risk
Three lookalike npm packages aimed at frontend developers underscore how package-name trust and installer-time execution can collide on a developer workstation.
Lookalike npm Packages Turn a CSS Search into a Supply-Chain Trap
A small cluster of PostCSS-themed npm packages shows how name confusion and install-time trust can turn routine dependency work into a Windows malware risk.
A Lookalike npm Name, Then a Windows Script Chain: The Supply-Chain Trap Behind a RAT Drop
A typosquatted package in the npm ecosystem shows how a single confusing name can hand attackers a path from dependency install to Windows-native execution.
Mastra’s npm Trail Turns a Package Update Into a Crypto-Extension Risk
A malicious dependency found in more than 140 Mastra packages shows how a software supply-chain incident can move from build tools to browser-facing cryptocurrency surfaces.
A Lookalike npm Package Turned a Trusted CSS Name Into a Windows Malware Pipe
A deceptive package name in the PostCSS orbit shows how open-source trust can be abused before any code ever reaches production.
One Hijacked npm Identity Can Poison an Entire Dependency Chain
A maintainer-account takeover tied to poisoned Mastra packages shows how package registries can become malware delivery systems when publisher trust is broken.
A Trusted npm Namespace Became the Weak Link in an AI Build Chain
A hijacked contributor identity and a burst of package publishing turned the @mastra/* ecosystem into a supply-chain warning for anyone shipping JavaScript or TypeScript at scale.
Fake Fixes, Real Risk: How a 25-Package Supply Chain Trap Targeted Solana Developers
A package-based credential theft campaign shows how quickly trusted registries can become entry points when attackers dress malware up as a build fix or SDK helper.
When a Package Install Becomes the Breach: dbmux and the New Trust Problem
A malicious npm package found inside developer tooling shows how supply-chain abuse can begin before an app even launches, turning routine installs into high-risk execution events.
A Rogue npm Package Put Developer Machines in the Crosshairs
The dbmux case shows why a routine package install can become an execution event, not a passive download, with developer endpoints serving as a high-value entry point for broader supply-chain abuse.
Shai-Hulud Returns With a Bigger Blast Radius Across npm and PyPI
More than 100 packages were hit in a new supply-chain wave, with Miasma and Hades emerging as the latest names in a self-propagating campaign.
When a Package Becomes a Proxy: The Claude Code MCP Token Trap
A malicious npm package was used in a demonstrated attack path that rerouted Claude Code integrations and put OAuth bearer tokens in the crosshairs.
When a Package Install Turns Hostile: The IronWorm Lesson for Developers
A malicious npm campaign shows how routine dependency installs can become a secret-harvesting path into developer systems, with crypto and Web3 workflows carrying outsized risk.