Rogue NuGet Package Poses as Tracer.Fody, Steals Cryptocurrency Wallet Data
Dec 16, 2025Ravie LakshmananCybersecurity / Cryptocurrency Cybersecurity researchers have discovered a new malicious NuGet package that typosquats and impersonates the...
package
Brushing Scams: What They Are and How to Stay Safe From Unsolicited Packages
It’s an increasingly common surprise: a package shows up at your door with your name and your address…but you never ordered...
Critical React Native NPM Vulnerability Exposes Developer Systems to Remote Attacks
A severe vulnerability was discovered in the React Native Community CLI, a popular open-source package downloaded nearly two million...
Slopsquatting Attacks: How AI Phantom Dependencies Create Security Risks
TL;DR AI coding assistants can hallucinate package names, creating phantom dependencies that don’t exist in official repositories. Attackers exploit...
Alert: Malicious PyPI Package soopsocks Infects 2,653 Systems Before Takedown
Oct 02, 2025Ravie LakshmananPython / Malware Cybersecurity researchers have flagged a malicious package on the Python Package Index (PyPI) repository...
What We Know About the NPM Supply Chain Attack
Key takeaways Attackers reportedly launched a targeted phishing campaign to compromise Node Package Manager (NPM) maintainer accounts and inject malicious...
Malicious PyPI Package Posing as Solana Tool Stole Source Code in 761 Downloads
Cybersecurity researchers have discovered a malicious package on the Python Package Index (PyPI) repository that purports to be an application...
Mobile security matters: Protecting your phone from text scams
It all starts so innocently. You get a text saying “Your package couldn’t be delivered. Click here to reschedule.” Little do...
-Apr-29-2025-01-33-58-6552-PM.jpeg "Revived CryptoJS library is a crypto stealer in disguise")
Revived CryptoJS library is a crypto stealer in disguise
An illicit npm package called ‘crypto-encrypt-ts‘ may appear to revive the unmaintained but vastly popular CryptoJS library, but what it...
Deceptive Python Libraries on PyPI Downloaded Over 39,000 Times, Pilfer Confidential Data
A group of cybersecurity analysts have detected deceitful modules within the Python Package Index (PyPI) archive that have been created...
Deceptive PyPI Bundles Absconded Cloud Tokens—Exceeding 14,100 Installations Before Elimination
A group of cybersecurity analysts has alerted about a malevolent operation aimed at consumers of the Python Package Index (PyPI)...
An evil PyPI Package has stolen Ethereum Private Keys through Polygon RPC Transactions
Research experts in online security have found a harmful Python bundle within the Python Package Index (PyPI) archive that is...
Malicious PyPI Package “automslc” Enables 104K+ Unauthorized Deezer Music Downloads
Cybersecurity researchers have flagged a malicious Python library on the Python Package Index (PyPI) repository that facilitates unauthorized music downloads...
PyPI Adds Archiving Status to Notify Users Regarding Unmaintained Python Packages
The caretakers of the Python Package Index (PyPI) repository have revealed a fresh capability that empowers package creators to mark...
Unfixed PHP Voyager Vulnerabilities Expose Servers to One-Click Remote Code Execution Attacks
A trio of security vulnerabilities have been revealed in the freely available PHP software Voyager that may be leveraged by...
