Latest npm worm news

One North Korea-linked threat cluster now publishes malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist in parallel, reusing the same staging infrastructure and loader patterns. Socket has tracked more than 1,700 packages tied to the broader Contagious Interview …

Ten high-impact npm maintainers, including the engineers behind Fastify, Lodash, dotenv, and Express, were approached using the same playbook that compromised Axios. Tay attributes the campaign to UNC1069, the DPRK-nexus group that spent eight years perfecting fake interviews against crypto …

A 24-day supply chain campaign hit Aqua Security's Trivy scanner, 75 GitHub Actions tags, and 66+ npm packages. TeamPCP stole CI/CD secrets from 10,000+ workflows using memory scraping and spawned a self-propagating npm worm with decentralized C2. One payload wiped …