Explore

Rapid Read Rapid Read
ChainDrop npm Worm Exploits Ethereum Blockchain for Command and Control

ChainDrop npm Worm Exploits Ethereum Blockchain for Command and Control

A new self-propagating supply chain worm, named ChainDrop, has been identified in the npm ecosystem. The worm has compromised 444 packages and 2,212 versions across multiple organizations. It uses a preinstall script to download the Bun JavaScript runtime and execute a second-stage payload that steals credentials and publishes more malicious packages. The worm's command and control infrastructure is based on the Ethereum blockchain, allowing it to dynamically update its list of control domains. This attack is a sophisticated evolution of previous supply chain attacks, leveraging blockchain technology for resilience against takedown efforts.
Trendline Trendline
Supply Chain Compromise: Popular npm Packages Keyv and Cacheable Affected

Supply Chain Compromise: Popular npm Packages Keyv and Cacheable Affected

Supply Chain Compromise: Popular npm Packages Keyv and Cacheable Affected
Rapid Read Rapid Read
Worm Attack Compromises Hundreds of Popular npm Packages

Worm Attack Compromises Hundreds of Popular npm Packages

A significant security breach has occurred in the npm ecosystem, with a worm compromising hundreds of popular npm packages. The attack involved injecting a backdoor into packages such as 'keyv', 'file-entry-cache', and 'flat-cache', which collectively have over 150 million monthly downloads. The malicious payload is capable of spreading to adjacent npm packages, posing a widespread threat to software supply chains. The attack was identified on August 4, 2026, and is being actively investigated by security researchers.
Rapid Read Rapid Read
Supply Chain Compromise: Malicious Code Found in Popular npm Packages Keyv and Cacheable

Supply Chain Compromise: Malicious Code Found in Popular npm Packages Keyv and Cacheable

A significant supply chain compromise has been identified in the npm ecosystem, affecting the widely used keyv and cacheable packages. On August 4, 2026, malicious preinstall hooks were discovered in at least ten packages within these namespaces. The compromised packages, which include keyv@6.0.0, were found to contain a setup.mjs script that downloads a standalone Bun runtime, executes a second stage, and harvests cloud and CI credentials. The attack has led to the republishing of trojanized versions of other packages using stolen npm tokens. The maintainer account, identified as Jaredwray, was compromised, allowing the threat actor to publish across multiple package families. The attack has resulted in the theft of credentials from cloud services like AWS, GCP, and Azure, as well as GitHub and npm tokens. The malicious packages have been downloaded millions of times, posing a significant risk to developers and organizations relying on these dependencies.
Rapid Read Rapid Read
GitHub Account Compromise Leads to Major npm Supply Chain Attack

GitHub Account Compromise Leads to Major npm Supply Chain Attack

On August 4, 2026, a significant security breach occurred when attackers compromised the GitHub account of the maintainer behind 'keyv', a key-value storage library with approximately 127 million weekly npm downloads. This breach allowed the attackers to inject credential-stealing malware across the entire package family, affecting other widely-used caching utilities such as 'cacheable', 'flat-cache', and 'file-entry-cache'. The attack was executed by pushing malicious files directly to the main branch and immediately releasing a new version, which was then published to npm with valid provenance signed by GitHub Actions. The malware, a heavily obfuscated JavaScript file, was designed to steal credentials from various secret stores on victim machines and exfiltrate them to a public GitHub repository.
Rapid Read Rapid Read
Shai-Hulud Malware Campaign Targets npm Packages, Affecting Millions

Shai-Hulud Malware Campaign Targets npm Packages, Affecting Millions

A new malware campaign, dubbed Shai-Hulud, has compromised over 440 npm packages, affecting more than 2 billion monthly downloads. The malware, which spreads through npm's preinstall scripts, targets popular packages like Keyv and Cacheable. It exfiltrates data using stolen GitHub tokens and contains a dead man's switch to delete data if the token is revoked. The campaign highlights vulnerabilities in npm's security, as the malware persists through local AI agents and IDEs. Developers are advised to rotate keys, enable two-factor authentication, and downgrade affected packages.
Trendline Trendline
Keyv-Linked npm Worm Compromises Hundreds of Software Packages

Keyv-Linked npm Worm Compromises Hundreds of Software Packages

Keyv-Linked npm Worm Compromises Hundreds of Software Packages
Rapid Read Rapid Read
Arch Linux Suspends Package Adoptions Amid Malware Concerns

Arch Linux Suspends Package Adoptions Amid Malware Concerns

Arch Linux has temporarily halted package adoptions on its Arch User Repository (AUR) following a wave of malicious code insertions by attackers. The decision comes after the discovery that attackers exploited the package adoption feature to introduce harmful code into widely used software packages. This incident marks the third security breach involving the AUR since June. The Australian Cyber Security Centre (ACSC) has issued warnings about the increasing threat of supply-chain attacks on online code repositories. The compromised packages, which include names like 'archutil' and 'boringssl-git', contained malicious ELF binaries disguised under generic names. Arch Linux, known for its minimalist and open-source distribution, has urged its community to report any suspicious activities and remain vigilant.
Trendline Trendline
Coldcard Wallet Attacks Continue, Threatening 449 Bitcoin

Coldcard Wallet Attacks Continue, Threatening 449 Bitcoin

Coldcard Wallet Attacks Continue, Threatening 449 Bitcoin
Rapid Read Rapid Read
Russian State APT Targets Public Wi-Fi Networks for Credential Theft

Russian State APT Targets Public Wi-Fi Networks for Credential Theft

A Russian state-sponsored advanced persistent threat (APT) group, identified as Storm-2945, has been linked to a recent campaign targeting public Wi-Fi networks to steal Microsoft 365 credentials. The attackers used compromised routers to redirect users to malicious infrastructure, employing an adversary-in-the-middle technique. This campaign, dubbed CaptiveCrunch, primarily targeted sectors such as financial services, healthcare, and retail. The operation involved serving malware disguised as browser updates, enabling the attackers to conduct reconnaissance and steal credentials.
Rapid Read Rapid Read
Malware Campaign Targets Roblox and Minecraft Users with Sophisticated Stealer

Malware Campaign Targets Roblox and Minecraft Users with Sophisticated Stealer

A new malware campaign is targeting players of popular games like Roblox and Minecraft by disguising itself as an 'undetected' version of the Xeno Roblox script executor. Promoted through gaming forums and Discord communities, the malware launches a multi-stage Java infection chain that mimics legitimate files and directories. The final payload is a sophisticated stealer and remote access trojan capable of stealing browser cookies, Discord, Roblox, and Minecraft accounts, as well as cryptocurrency-wallet data and payment information. The malware can also record keystrokes, access webcams, stream desktops, manipulate files, and execute commands, giving attackers interactive control over infected computers. This campaign, previously documented as Powercat, remains under active development with newly identified command-and-control infrastructure and expanded functionality.
Trendline Trendline
Adform Script Compromise Leads to Cryptocurrency Wallet Address Manipulation

Adform Script Compromise Leads to Cryptocurrency Wallet Address Manipulation

Adform Script Compromise Leads to Cryptocurrency Wallet Address Manipulation