Cybersecurity articles tagged #NPM on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/hackers-abuse-npm-mirrors-to-host-phishing-redirectshttps://runtimerebel.com/blog/hackers-abuse-npm-mirrors-to-host-phishing-redirectsThreat actors exploit npm and its mirroring platforms like UNPKG to host malicious HTML pages, impersonating Cloudflare CAPTCHAs for phishing redirects.Wed, 26 Aug 2026 08:31:38 GMTNPMPhishingSupply Chain AttackUNPKGCloudflare Impersonationhttps://runtimerebel.com/blog/trojanized-npm-packages-deliver-ai-powered-redc2-4-0-linux-backdoorhttps://runtimerebel.com/blog/trojanized-npm-packages-deliver-ai-powered-redc2-4-0-linux-backdoorMalicious npm packages deliver RedC2 4.0 Linux backdoor, featuring AI-assisted command and control for advanced post-exploitation.Sat, 22 Aug 2026 00:39:04 GMTNPMLinux BackdoorSupply Chain AttackAIRedC2https://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromiseshttps://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromisesThe npm ecosystem faces escalating supply chain attacks like Shai-Hulud and Miasma RAT, leading to credential theft and widespread package compromise.Sat, 08 Aug 2026 16:26:28 GMTNPMSupply Chain AttackShai HuludTeamPCPCI CD Securityhttps://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealerhttps://runtimerebel.com/blog/critical-npm-supply-chain-attack-delivers-cross-platform-rat-infostealerCritical npm supply chain attack involving nearly 800 malicious packages delivers WEL1DROPPER RAT and infostealer to Windows, macOS, and Linux users.Sat, 08 Aug 2026 00:54:29 GMTNPMSupply Chain AttackInfostealerRATWEL1DROPPERhttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threathttps://runtimerebel.com/blog/chaindrop-npm-worm-self-propagating-software-supply-chain-threatAnalyze the ChainDrop self-propagating npm worm infecting major packages, harvesting credentials from memory, and compromising CI/CD pipelines.Fri, 07 Aug 2026 02:13:34 GMTSupply Chain AttackMalwareNPMGitHub ActionsCredential Thefthttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchhttps://runtimerebel.com/blog/keyv-npm-supply-chain-attack-worm-infection-and-dead-man-switchAnalyze the Keyv/cacheable npm supply-chain worm, its AI agent execution vectors, and why immediate credential revocation can trigger payloads.Thu, 06 Aug 2026 02:00:17 GMTSupply Chain AttackNPMCredential TheftZero-DayMalwarehttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialshttps://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentialsMassive ChainDrop npm supply chain attack compromises over 1,300 packages, stealing developer and cloud credentials through malicious preinstall scripts.Tue, 04 Aug 2026 17:30:58 GMTNPMSupply Chain AttackInfostealerJavaScriptChainDrophttps://runtimerebel.com/blog/malicious-npm-packages-deliver-cross-platform-rat-to-alibaba-usershttps://runtimerebel.com/blog/malicious-npm-packages-deliver-cross-platform-rat-to-alibaba-usersDiscover how 18 malicious npm packages target Alibaba developer tools with a cross-platform remote access trojan in a supply chain attack.Tue, 04 Aug 2026 01:27:44 GMTSupply Chain AttackMalwareNPMRemote Access Trojanhttps://runtimerebel.com/blog/north-korean-hackers-exploit-npm-supply-chain-debug-chalk-under-attackhttps://runtimerebel.com/blog/north-korean-hackers-exploit-npm-supply-chain-debug-chalk-under-attackAmazon links North Korean hackers to supply chain attacks on popular npm packages Debug and Chalk, highlighting nation-state threat to open-source ecosystems.Thu, 30 Jul 2026 21:12:11 GMTNorth Korean HackersNPMSupply Chain AttackDebugChalkSoftware Supply Chain Securityhttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-rathttps://runtimerebel.com/blog/compromised-joyfill-npm-packages-deliver-dev-popper-ratBeta versions of @joyfill/layouts and @joyfill/components npm packages compromised to deliver a DEV#POPPER RAT upon import. Node.js users at risk.Wed, 29 Jul 2026 06:32:18 GMTJoyfillNPMSupply Chain AttackRATDEV POPPERNode Jshttps://runtimerebel.com/blog/malicious-vite-npm-packages-deliver-rat-via-blockchain-c2https://runtimerebel.com/blog/malicious-vite-npm-packages-deliver-rat-via-blockchain-c2Seven malicious npm packages target Vite frontend projects. Dubbed ViteVenom, this software supply chain attack uses a four-tier blockchain C2 to deploy a RAT.Fri, 17 Jul 2026 20:57:56 GMTViteVenomChainVeilNPMViteSoftware Supply Chain AttackRATBlockchain C2https://runtimerebel.com/blog/asyncapi-npm-packages-infected-with-credential-stealing-malwarehttps://runtimerebel.com/blog/asyncapi-npm-packages-infected-with-credential-stealing-malwareFive malicious versions of AsyncAPI npm packages deployed a credential-stealing remote access trojan via a supply chain attack. Learn detection and mitigation.Wed, 15 Jul 2026 17:20:00 GMTNPMAsyncapiSupply Chain AttackCredential StealingMalwareTrojanhttps://runtimerebel.com/blog/jscrambler-npm-packages-poisoned-in-supply-chain-attackhttps://runtimerebel.com/blog/jscrambler-npm-packages-poisoned-in-supply-chain-attackAttackers poisoned official Jscrambler NPM packages to distribute cross-platform credential stealers. Learn the impact and how to remediate the threat.Tue, 14 Jul 2026 10:01:24 GMTJscramblerNPMSupply Chain AttackMalwareCredential Stealerhttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwarehttps://runtimerebel.com/blog/jscrambler-npm-package-backdoored-with-infostealer-malwareA malicious version of the Jscrambler npm package, 5.0.0-beta-1, was backdoored with infostealer malware, affecting 1,500 downloads. Immediate action needed.Mon, 13 Jul 2026 20:59:06 GMTJscramblerNPMSupply Chain AttackInfostealerMalwareNode Jshttps://runtimerebel.com/blog/jscrambler-8-14-0-compromised-rust-infostealer-supply-chain-attackhttps://runtimerebel.com/blog/jscrambler-8-14-0-compromised-rust-infostealer-supply-chain-attackThe jscrambler 8.14.0 npm release was compromised with a malicious preinstall hook dropping a cross-platform Rust infostealer. Mitigate the threat now.Sat, 11 Jul 2026 20:50:45 GMTJscramblerNPMSupply Chain AttackRust MalwareInfostealerhttps://runtimerebel.com/blog/injective-labs-npm-package-compromise-steals-crypto-keyshttps://runtimerebel.com/blog/injective-labs-npm-package-compromise-steals-crypto-keysCritical supply chain attack compromises Injective Labs SDK on GitHub, distributing malicious npm package `@injectivelabs/sdk-ts@1.20.21` to steal crypto wallet keys.Fri, 10 Jul 2026 17:48:42 GMTInjective LabsNPMSupply Chain AttackCryptocurrencyWallet TheftMalicious PackageSDKhttps://runtimerebel.com/blog/injective-sdk-npm-compromise-crypto-wallet-stealer-detectedhttps://runtimerebel.com/blog/injective-sdk-npm-compromise-crypto-wallet-stealer-detectedA malicious version of the Injective SDK (injective-js) on npm was published via a GitHub compromise, deploying a crypto wallet stealer. Developers are at risk.Fri, 10 Jul 2026 03:32:02 GMTInjective SDKNPMCryptocurrencyWallet StealerSupply Chain AttackMalwareInjective Jshttps://runtimerebel.com/blog/npm-12-enhances-supply-chain-security-by-disabling-install-scriptshttps://runtimerebel.com/blog/npm-12-enhances-supply-chain-security-by-disabling-install-scriptsnpm version 12 introduces critical security defaults, disabling install scripts and deprecating GATs, significantly mitigating JavaScript supply chain risks.Thu, 09 Jul 2026 17:57:40 GMTNPMSupply Chain SecurityInstall ScriptsSecurity DefaultsGATs2FAJavaScript Packageshttps://runtimerebel.com/blog/fake-paysafe-skrill-sdks-on-npm-pypi-steal-credentialshttps://runtimerebel.com/blog/fake-paysafe-skrill-sdks-on-npm-pypi-steal-credentialsMalicious packages impersonating Paysafe and Skrill SDKs on npm and PyPI platforms are stealing credentials from developers and users. Threat intelligence analysis.Wed, 08 Jul 2026 21:35:17 GMTNPMPyPISupply Chain AttackCredential TheftPaysafeSkrillNetellerMalwarehttps://runtimerebel.com/blog/polinrider-north-korean-hackers-push-108-malicious-packageshttps://runtimerebel.com/blog/polinrider-north-korean-hackers-push-108-malicious-packagesAnalysis of the PolinRider campaign where North Korean actors published 108 malicious packages and extensions across npm, Go, and Chrome ecosystems.Sat, 04 Jul 2026 13:37:02 GMTPolinRiderLazarus GroupNPMChrome Web StoreSupply Chain AttackNorth Koreahttps://runtimerebel.com/blog/n-korea-linked-npm-packages-mimic-rollup-polyfills-for-data-thefthttps://runtimerebel.com/blog/n-korea-linked-npm-packages-mimic-rollup-polyfills-for-data-theftNorth Korea-linked actors use malicious npm packages ('rollup-packages-polyfill-core', 'rollup-runtime-polyfill-core') to steal developer secrets, mimicking Rollup…Fri, 03 Jul 2026 17:27:44 GMTNPMRollupSupply Chain AttackNorth Korea LinkedDeveloper SecretsMalicious Packageshttps://runtimerebel.com/blog/malicious-npm-packages-impersonate-postcss-to-deliver-windows-rathttps://runtimerebel.com/blog/malicious-npm-packages-impersonate-postcss-to-deliver-windows-ratSecurity researchers uncover malicious npm packages such as postcss-minify-selector-parser delivering Windows RATs via supply chain attacks. Audit your builds.Tue, 23 Jun 2026 13:10:31 GMTNPMPostCSSTyposquattingRATJavaScripthttps://runtimerebel.com/blog/north-korean-sapphire-sleet-compromises-140-mastra-ai-npm-packageshttps://runtimerebel.com/blog/north-korean-sapphire-sleet-compromises-140-mastra-ai-npm-packagesMicrosoft attributes the Mastra AI supply chain attack to Sapphire Sleet (BlueNoroff), involving 140+ malicious npm packages targeting AI developers.Sat, 20 Jun 2026 16:38:13 GMTSapphire SleetBlueNoroffMastra AINPMSupply Chain AttackLazarus Grouphttps://runtimerebel.com/blog/nastyc2-npm-packages-ai-abuse-macos-threats-identifiedhttps://runtimerebel.com/blog/nastyc2-npm-packages-ai-abuse-macos-threats-identifiedAnalysis of NastyC2 npm supply chain attacks, Claude chat abuse for malware, memory-resident macOS threats, and device-code phishing.Thu, 18 Jun 2026 17:09:21 GMTNastyC2NPMSupply Chain AttackClaudeAI AbusemacOS MalwarePhishingCloud SecurityBrowser Add onhttps://runtimerebel.com/blog/npm-12-security-default-script-execution-changes-to-mitigate-supply-chain-attackshttps://runtimerebel.com/blog/npm-12-security-default-script-execution-changes-to-mitigate-supply-chain-attacksnpm 12 introduces a critical change: 'npm install' will no longer run dependency scripts by default, significantly reducing software supply chain risks.Sat, 13 Jun 2026 16:36:33 GMTNPMSupply Chain AttackNode JsDependency ScriptsSoftware SecurityPackage Managerhttps://runtimerebel.com/blog/github-to-disable-npm-install-scripts-by-default-in-version-12https://runtimerebel.com/blog/github-to-disable-npm-install-scripts-by-default-in-version-12GitHub announces breaking changes for npm v12, disabling install scripts by default to prevent malicious code execution and enhance supply chain security.Thu, 11 Jun 2026 09:37:20 GMTNPMGitHubNpm V12Supply Chain SecurityMalware Preventionhttps://runtimerebel.com/blog/npm-supply-chain-attack-ironworm-and-miasma-malware-analysishttps://runtimerebel.com/blog/npm-supply-chain-attack-ironworm-and-miasma-malware-analysisThreat actors target npm developers with the IronWorm info stealer and Miasma worm, utilizing eBPF rootkits to exfiltrate secrets and ensure persistence.Fri, 05 Jun 2026 20:40:47 GMTNPMIronWormMiasmaSupply Chain AttackMalwareRusteBPFhttps://runtimerebel.com/blog/ironworm-rust-written-malware-hits-npm-supply-chain-developershttps://runtimerebel.com/blog/ironworm-rust-written-malware-hits-npm-supply-chain-developersAnalysis of the Rust-written IronWorm malware targeting npm supply chain developers.Fri, 05 Jun 2026 01:01:31 GMTIronWormRustNPMSupply Chain AttackCredential TheftDeveloper Securityhttps://runtimerebel.com/blog/ironworm-malware-36-npm-packages-identified-in-supply-chain-attackhttps://runtimerebel.com/blog/ironworm-malware-36-npm-packages-identified-in-supply-chain-attackSecurity researchers discover a campaign delivering IronWorm infostealer malware via 36 malicious npm packages using preinstall script execution hooks.Thu, 04 Jun 2026 17:09:30 GMTNPMIronWormInfostealerSupply Chain AttackJavaScripthttps://runtimerebel.com/blog/red-hat-npm-supply-chain-compromise-miasma-steals-dev-credentialshttps://runtimerebel.com/blog/red-hat-npm-supply-chain-compromise-miasma-steals-dev-credentialsOver 30 Red Hat npm packages under @redhat-cloud-services were compromised in a supply chain attack distributing Miasma malware to steal developer credentials.Tue, 02 Jun 2026 01:03:30 GMTRed HatNPMSupply Chain AttackMiasmaShai HuludDeveloper CredentialsCredential Thefthttps://runtimerebel.com/blog/miasma-supply-chain-attack-defending-red-hat-npm-environmentshttps://runtimerebel.com/blog/miasma-supply-chain-attack-defending-red-hat-npm-environmentsAnalysis of the Miasma supply chain attack targeting Red Hat npm packages with credential-stealing worms. Technical details and mitigation guide for SOC teams.Mon, 01 Jun 2026 21:14:46 GMTRed HatNPMMiasmaSupply Chain AttackCredential TheftMini Shai Huludhttps://runtimerebel.com/blog/malicious-npm-package-targets-claude-ai-user-data-technical-analysishttps://runtimerebel.com/blog/malicious-npm-package-targets-claude-ai-user-data-technical-analysisResearchers discover mouse5212-super-formatter, a malicious npm package designed to exfiltrate sensitive files from Claude AI user directories.Wed, 27 May 2026 17:12:05 GMTNPMClaude AISupply Chain AttackData ExfiltrationAnthropichttps://runtimerebel.com/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chainhttps://runtimerebel.com/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chainAnalysis of the Shai-Hulud campaign by TeamPCP, detailing their open-source supply chain attacks, TTPs, and critical mitigation strategies.Tue, 26 May 2026 20:47:57 GMTTeamPCPShai HuludSupply Chain AttackOpen Source SecurityNPMPyPIMalicious Packageshttps://runtimerebel.com/blog/teampcp-supply-chain-attack-targets-microsoft-sdks-and-githubhttps://runtimerebel.com/blog/teampcp-supply-chain-attack-targets-microsoft-sdks-and-githubTeamPCP expands its supply chain campaign to trojanize official Microsoft Python SDKs and infiltrate GitHub, requiring immediate dependency audits.Mon, 25 May 2026 16:52:00 GMTTeamPCPSupply Chain AttackPython SDKGitHubPyPINPMhttps://runtimerebel.com/blog/trapdoor-campaign-detecting-cross-ecosystem-supply-chain-attackshttps://runtimerebel.com/blog/trapdoor-campaign-detecting-cross-ecosystem-supply-chain-attacksThe TrapDoor campaign targets npm, PyPI, and Crates.io with over 384 malicious versions designed to exfiltrate developer credentials and sensitive data.Mon, 25 May 2026 09:28:16 GMTTrapdoorNPMPyPICrates IoCredential TheftSoftware Supply Chainhttps://runtimerebel.com/blog/npm-staged-publishing-new-2fa-controls-prevent-supply-chain-attackshttps://runtimerebel.com/blog/npm-staged-publishing-new-2fa-controls-prevent-supply-chain-attacksGitHub introduces staged publishing for npm, requiring manual 2FA approval for package releases to mitigate malicious automated updates and account takeovers.Sat, 23 May 2026 20:21:54 GMTNPMGitHubSupply Chain SecurityTwo Factor AuthenticationStaged PublishingApplication Securityhttps://runtimerebel.com/blog/analysis-of-cross-platform-npm-stealer-using-discord-webhookshttps://runtimerebel.com/blog/analysis-of-cross-platform-npm-stealer-using-discord-webhooksTechnical teardown of an obfuscated Node.js infostealer targeting Discord tokens, crypto wallets, and browser credentials via cross-platform scripts.Fri, 22 May 2026 09:17:57 GMTNPMNode JsInfostealerDiscord WebhookObfuscationhttps://runtimerebel.com/blog/github-repository-breach-linked-to-tanstack-supply-chain-attackhttps://runtimerebel.com/blog/github-repository-breach-linked-to-tanstack-supply-chain-attackGitHub confirms the breach of 3,800 internal repositories via a compromised VS Code extension linked to the TanStack npm supply chain attack.Thu, 21 May 2026 09:15:44 GMTGitHubTanStackNPMSupply Chain AttackVS Codehttps://runtimerebel.com/blog/grafana-breach-after-tanstack-attack-token-rotation-failurehttps://runtimerebel.com/blog/grafana-breach-after-tanstack-attack-token-rotation-failureGrafana suffered a data breach due to a GitHub workflow token not rotated after the TanStack npm supply-chain attack, impacting user data. Learn the details.Wed, 20 May 2026 17:12:03 GMTGrafanaTanStackNPMSupply Chain AttackGitHub ActionsToken RotationData Breachhttps://runtimerebel.com/blog/320-antv-npm-packages-compromised-in-mini-shai-hulud-attackhttps://runtimerebel.com/blog/320-antv-npm-packages-compromised-in-mini-shai-hulud-attackA maintainer account compromise has led to a major supply chain attack against Alibaba’s @antv NPM namespace, impacting over 320 visualization packages.Wed, 20 May 2026 13:06:33 GMTNPMMini Shai HuludAntvSupply Chain SecurityJavaScripthttps://runtimerebel.com/blog/teampcp-jenkins-plugin-compromise-and-mini-shai-hulud-worm-analysishttps://runtimerebel.com/blog/teampcp-jenkins-plugin-compromise-and-mini-shai-hulud-worm-analysisTeamPCP escalates its supply chain campaign with a confirmed Jenkins plugin compromise and a self-spreading worm targeting the npm and PyPI ecosystems.Mon, 18 May 2026 20:38:04 GMTTeamPCPJenkinsNPMPyPIMini Shai HuludSupply Chain Attackhttps://runtimerebel.com/blog/shai-hulud-infostealer-surfaces-in-malicious-npm-package-campaignhttps://runtimerebel.com/blog/shai-hulud-infostealer-surfaces-in-malicious-npm-package-campaignLeaked Shai-Hulud malware is targeting Node.js developers via malicious npm packages, exfiltrating sensitive data and credentials to Telegram-based C2.Mon, 18 May 2026 20:37:20 GMTNPMShai HuludInfostealerSupply Chain AttackMalicious Packageshttps://runtimerebel.com/blog/microsoft-exchange-zero-day-and-npm-supply-chain-worm-under-active-usehttps://runtimerebel.com/blog/microsoft-exchange-zero-day-and-npm-supply-chain-worm-under-active-useCritical security briefing on the active exploitation of an Exchange Server zero-day, npm supply chain worms, and Cisco network control vulnerabilities.Mon, 18 May 2026 17:03:13 GMTExchange ServerNPMSupply Chain AttackCiscoZero-Dayhttps://runtimerebel.com/blog/developer-workstations-the-new-front-in-software-supply-chain-attackshttps://runtimerebel.com/blog/developer-workstations-the-new-front-in-software-supply-chain-attacksA surge in attacks targeting npm, PyPI, and Docker Hub highlights a shift toward stealing developer credentials and API keys from workstations and CI/CD pipelines.Mon, 18 May 2026 13:23:15 GMTNPMPyPIDocker HubCI CD SecurityCredential TheftDeveloper Securityhttps://runtimerebel.com/blog/openai-breach-tanstack-supply-chain-attack-impacts-employee-deviceshttps://runtimerebel.com/blog/openai-breach-tanstack-supply-chain-attack-impacts-employee-devicesOpenAI confirms two employee devices compromised in a TanStack supply chain attack affecting npm and PyPI packages, prompting certificate rotation.Thu, 14 May 2026 20:37:10 GMTOpenAITanStackSupply Chain AttackNPMPyPICertificate Rotationhttps://runtimerebel.com/blog/malicious-node-ipc-versions-compromise-developer-secrets-via-supply-chainhttps://runtimerebel.com/blog/malicious-node-ipc-versions-compromise-developer-secrets-via-supply-chainThree versions of the node-ipc npm package (9.1.6, 9.2.3, 12.0.1) contain stealer/backdoor functionality targeting developer secrets. Urgent update advised.Thu, 14 May 2026 20:36:23 GMTNode IpcNPMSupply Chain AttackDeveloper SecretsBackdoorStealerhttps://runtimerebel.com/blog/shai-hulud-supply-chain-attack-malicious-npm-and-mistral-packageshttps://runtimerebel.com/blog/shai-hulud-supply-chain-attack-malicious-npm-and-mistral-packagesThe Shai-Hulud campaign targets developers with over 300 signed npm and PyPI packages impersonating TanStack and Mistral to steal sensitive credentials.Tue, 12 May 2026 12:48:53 GMTShai HuludNPMPyPISupply Chain AttackMistral AITanStackCredential Stealerhttps://runtimerebel.com/blog/mini-shai-hulud-worm-compromises-tanstack-and-mistral-ai-packageshttps://runtimerebel.com/blog/mini-shai-hulud-worm-compromises-tanstack-and-mistral-ai-packagesTeamPCP actor compromises major npm and PyPI packages including TanStack and Mistral AI via the Mini Shai-Hulud worm, deploying profiling malware.Tue, 12 May 2026 09:04:37 GMTTeamPCPMini Shai HuludNPMPyPISupply Chain Attackhttps://runtimerebel.com/blog/teampcp-targets-sap-npm-packages-mini-shai-hulud-supply-chain-attackhttps://runtimerebel.com/blog/teampcp-targets-sap-npm-packages-mini-shai-hulud-supply-chain-attackTeamPCP broadens supply chain attacks, compromising npm packages in SAP's cloud development ecosystem with the 'Mini Shai-Hulud' malicious code injection.Fri, 01 May 2026 00:54:59 GMTTeamPCPSAPNPMSupply Chain AttackMini Shai HuludCloud Securityhttps://runtimerebel.com/blog/official-sap-npm-packages-compromised-in-teampcp-supply-chain-attackhttps://runtimerebel.com/blog/official-sap-npm-packages-compromised-in-teampcp-supply-chain-attackAttackers compromised official SAP npm packages to exfiltrate developer credentials and tokens. Learn how to detect and remediate this supply chain threat.Thu, 30 Apr 2026 00:50:55 GMTSAPNPMTeamPCPCredential TheftMalicious Packages