A threat actor has used 36 malicious NPM packages posing as Strapi plugins to distribute malware targeting Redis, Docker, and ...

North Korean hackers published backdoored versions of the Axios NPM package using a compromised long-lived access token.

Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying ...

Ethereum and Solana developers were targeted by five malicious npm packages that steal private keys and send them to the ...

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions. Evidence ...

Security teams are grappling with a major supply chain attack on Axios, a popular JavaScript library with over 100 million ...

A critical supply chain attack has compromised the popular JavaScript library axios, leading to developers unknowingly ...

And more useful than I thought.

Strapi plugins exploit Redis and PostgreSQL via postinstall scripts, enabling persistent access and data theft.

Anthropic's Claude Code CLI had its full TypeScript source exposed after a source map file was accidentally included in ...

A threat actor who stole credentials from a legitimate node package manager (npm) publisher has spread a persistent, worm-like malware across dozens of packages, security firms say. Named CanisterWorm ...

This beginner guide covers OpenClaw setup with a secure SSH tunnel and npm run scripts, plus tips for reconnecting after ...