Monday 25 May 2026 20:05:06 GMT+02:00
Netcrook
#npm worm
The Trust Chain Is Burning: What a Week of Mixed Attacks Reveals
A roundup of an Exchange 0-day, an npm worm, a fake AI page, and a Cisco exploit points to one recurring tactic: attackers keep going after systems people already trust.
When Package Trust Turns Toxic: The Shai-Hulud npm Worm and the Secret-Hunting Playbook
A reported self-propagating npm worm puts a spotlight on the fragile chain linking package installs, developer secrets, cloud access, and cluster control.
When an npm Worm Starts Copying Itself, the Trust Model Becomes the Target
A new wave of malicious package activity tied to the TanStack ecosystem shows how one infected release can become a propagation engine, turning normal JavaScript dependency behavior into a supply-chain risk.