RubyGems Suspends New Signups After Hundreds of Malicious Packages Are Uploaded
Ravie LakshmananMay 12, 2026Supply Chain Attack / Software Security RubyGems, the standard package manager for the Ruby programming language, has...
package
Google Fixes CVSS 10 Gemini CLI CI RCE and Cursor Flaws Enable Code Execution
Google has addressed a maximum severity security flaw in Gemini CLI -- the "@google/gemini-cli" npm package and the "google-github-actions/run-gemini-cli" GitHub...
New Wave of DPRK Attacks Uses AI-Inserted npm Malware, Fake Firms, and RATs
Cybersecurity researchers have discovered malicious code in an npm package after a malicious package as a dependency to the project...
A Poisoned Xinference Package Targets AI Inference Servers
The post A Poisoned Xinference Package Targets AI Inference Servers appeared first on Mend. Part 4 of the TeamPCP Supply...
UNC1069 Social Engineering of Axios Maintainer Led to npm Supply Chain Attack
Ravie LakshmananApr 03, 2026Threat Intelligence / Malware The maintainer of the Axios npm package has confirmed that the supply chain compromise...
Frequently Asked Questions About the Axios npm Supply Chain Attack by North Korea-Nexus Threat Actor UNC1069
A North Korea-nexus threat actor compromised the widely used axios npm package, delivering a cross-platform remote access trojan to...
Google Attributes Axios npm Supply Chain Attack to North Korean Group UNC1069
Google has formally attributed the supply chain compromise of the popular Axios npm package to a financially motivated North Korean...
Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer
This morning, the widely used Python package litellm, a popular abstraction layer for interacting with large language models (LLMs),...
ENISA Technical Advisory on Secure Package Managers: Essential DevSecOps Guidance
ENISA Technical Advisory on Secure Package Managers: Essential DevSecOps Guidance Pierluigi Paganini March 12, 2026 ENISA’s first Technical Advisory on...
Slopsquatting: How Attackers Exploit AI-Generated Package Names
TL;DR AI coding assistants can hallucinate package names, creating phantom dependencies that don’t exist in official repositories. Attackers exploit...
Malicious npm Package Posing as OpenClaw Installer Deploys RAT, Steals macOS Credentials
Cybersecurity researchers have discovered a malicious npm package that masquerades as an OpenClaw installer to deploy a remote access trojan...
Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems
Cybersecurity researchers have discovered a fresh set of malicious packages across npm and the Python Package Index (PyPI) repository linked...
Power Secure Swift Development at Scale With Sonatype Nexus Repository
From its beginnings as a language for Apple platforms, Swift Package Manager has expanded its reach considerably. It now...
Malicious PyPI Package Impersonates SymPy, Deploys XMRig Miner on Linux Hosts
Ravie LakshmananJan 22, 2026Cryptojacking / Malware A new malicious package discovered in the Python Package Index (PyPI) has been found...
What Is Quishing? How QR Code Scams Work and How to Avoid Them
You thought you were scanning a menu. Or paying for parking. Or checking a package notice taped to your door....
