Axios Compromise on npm Introduces Hidden Malicious Package
A newly discovered software supply chain attack targeting the npm ecosystem briefly compromised one of the most widely used...
npm
Attackers hijack Axios npm account to spread RAT malware
Attackers hijack Axios npm account to spread RAT malware Pierluigi Paganini March 31, 2026 Threat actors hijacked the npm account...
Sonatype Discovers Two Malicious npm Packages
Sonatype Security Research has identified a potential compromise of a trusted npm maintainer account that has now published two...
Hijacked npm Packages Deliver Malware via Solana, Linked to Glassworm
Sonatype Security Research has identified two hijacked npm packages in the React Native ecosystem that receive more than 30,000...
ENISA Technical Advisory on Secure Package Managers: Essential DevSecOps Guidance
ENISA Technical Advisory on Secure Package Managers: Essential DevSecOps Guidance Pierluigi Paganini March 12, 2026 ENISA’s first Technical Advisory on...
Malicious npm and PyPI packages linked to Lazarus APT fake recruiter campaign
Malicious npm and PyPI packages Llinked to Lazarus APT fake recruiter campaign Pierluigi Paganini February 15, 2026 Researchers found malicious...
PackageGate bugs let attackers bypass protections in NPM, PNPM, VLT, and Bun
PackageGate bugs let attackers bypass protections in NPM, PNPM, VLT, and Bun Pierluigi Paganini January 28, 2026 Koi researchers found...
