CRITICAL: n8n-nodes-moonlet-helpers (npm, v1.0.0/1.0.4) installs attacker code via postinstall script. Remove package, scan for /tmp/.np, and avoid affected versions. https://radar.offseq.com/threat/malicious-code-in-n8n-nodes-moonlet-helpers-npm-12fed58075d25a88 #OffSeq #npm #Security

📢 Attaque supply chain : implant Go sckit infecte des packages npm et PyPI de MemTensor

Le 23 septembre 2026, SafeDep publie une analyse technique détaillée d'une attaque de type supply chain ciblant deux packages open source du projet…

🟡 vérification factuelle moyenne
#PyPI #npm #Cyberveille

Malicious npm package '[email protected]' (CRITICAL) enables arbitrary code execution. Remove immediately, check for typosquatting, and verify dependencies. https://radar.offseq.com/threat/malicious-code-in-pino-testkit-npm-da4f2d1960e5a45d #OffSeq #npm #SupplyChain

⏱ Before the advisory: our scan flagged npm [email protected] 74 days ahead of MAL-2026-16446.

#flaggedfirst #npm #malware #supplychainsecurity

A malicious NPM package 'indexed-btree' got ~2M weekly downloads by hiding its payload in runtime code, bypassing security scans. It used Ethereum for C2 & earned its creator over €230k. #SupplyChainAttack #NPM #Malware #CyberSecurity

🌐 cyber[.]netsecops[.]io

GHAPPIER Supply Chain Attack Compromises 65 GitHub Repositories and Poisons npm Package

https://commons.now/link/ghappier-supply-chain-attack-compromises-65-github-repositories-and-poisons-npm

#Github #Malware #Npm

iT4iNT SERVER Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI VDS VPS Cloud #CyberSecurity #Malware #DataBreach #Npm #PyPI

📣 npm's min-release-age-exclude doesn't reach npx yet.

`npx my-pkg@latest` won't error: it quietly runs the newest version older than the window, so your own fresh release stays invisible for days.

Workaround: npx --min-release-age=0

github.com/npm/cli/issu...

#npm #nodejs

Deceptive Probes: Analyzing the tw-pkgprobe-7731 Malicious npm Campaign

An expert analysis of tw-pkgprobe-7731, a malicious npm package that impersonated Twilio bug bounty tools to steal developer credentials.

#npm #SupplyChainAttack

Read more →

If you're using #TypeScript or #JavaScript or #NPM, where do people hang out and talk about projects/issues these days (other than on Reddit, Discord), i.e. where are the communities/exchanges, since the topics obviously aren't popular on Mastdon. For a while now, any of my posts and […]

A fake Twilio bug-bounty npm package stole dev credentials under disguise. Audit dependencies carefully. #SecurityNews #npm #SupplyChain #Twilio #Malware #DeveloperSecurity https://thedailytechfeed.com/malicious-npm-package-masquerades-as-twilio-probe-steals-credentials/

Malicious npm package tw-pkgprobe-7731 impersonated a Twilio bug-bounty probe, targeting developer env data, Twilio SIDs, Auth Tokens, and AWS metadata. #Twilio #npm #HackerOne

⏱ Before the advisory: our scan flagged npm @tesla-insurance/[email protected] 5 hours ahead of MAL-2026-16378.

#flaggedfirst #npm #malware #supplychainsecurity

The director of a psycho-neurological facility in the #TernopilOblast, #Ukraine, faces trial for #humantrafficking after allegedly forcing vulnerable residents to work at construction sites and cemeteries.
zmina.info/en/news-en/d...
#NPM #ForcedLabour #MentalHealth

GHAPPIER Loader exploited trusted npm publishing via GitHub Actions; PolinRider linked attack spawns self-deleting loader and blockchain-based C2. #SupplyChain #Security #npm #TrustedPublishing https://thedailytechfeed.com/ghappier-loader-npm-supply-chain-breach-linked-to-polinrider/

Google si infiltra in TeamPCP: la talpa di Mandiant che ha smontato dall’interno la gang del supply chain
il blog: insicurezzadigitale.com/google-si-in...

#cybersecurity #cybercrime #google #infosec #mandiant #npm #pypi #supplychain #teampcp
💬 Il forum: internet-forum.it/t/stanza-sec...

CVE-2015-9235 - jsonwebtoken
The jsonwebtoken code used in Node.js applications may let a maliciously crafted token bypass security checks. This affects any project that uses the…

Too many irrelevant or confusing CVEs? Use stackflag.com

#jsonwebtoken #julienwollscheid #npm #CVE #infosec

⏱ Caught early: npm [email protected] was on our radar 1 day before MAL-2026-16332 went public.

#flaggedfirst #npm #malware #supplychainsecurity

The npm package “indexed-btree” hides malware at runtime, bypassing install checks and weaponizing BTree.prototype.set. #SupplyChain #npm #Malware #NodeJS #RuntimeThreat #Security thedailytechfeed.com/npm-supply-c...