Hosted on MSN

Keyv npm supply chain attack hides malware in AI agent files scanners never read

On August 4, 2026, the Shai-Hulud npm worm returned for its sixth major campaign since September 2025 — and for the first time, it introduced three capabilities that no prior wave had shipped: ...
Microsoft

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

Microsoft Threat Intelligence identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, including packages associated with major ...
theregister

Speedier type checks in TypeScript 7.0 as first stable Go release ships

The Microsoft-led TypeScript 7.0 features an order-of-magnitude speed boost, a victory not only for TypeScript itself but also for Go, the programming language used to completely rewrite the web ...
cybersecuritynews

1-Click GitHub Token Vulnerability Lets Attackers Steal Users’ OAuth Tokens

A critical security vulnerability in Visual Studio Code’s webview implementation allows attackers to steal GitHub OAuth tokens, including read/write access to private repositories, simply by tricking ...
Security Boulevard

Mini Shai-Hulud: Frequently asked questions about the TeamPCP npm and PyPI supply chain campaign

The post Mini Shai-Hulud: Frequently asked questions about the TeamPCP npm and PyPI supply chain campaign appeared first on Tenable Blog. A self-propagating worm has compromised more than 170 npm and ...
stepsecurity.io

Microsoft's durabletask PyPI Package Compromised in Supply Chain Attack

Three malicious versions of Microsoft's official durabletask Python SDK were published to PyPI on May 19, 2026. The compromised package silently downloads and executes a 28 KB payload that steals ...
stepsecurity.io

Nx Console VS Code Extension Compromised

Version 18.95.0 of the popular Nx Console extension (2.2M+ installs) was published with malicious code targeting developer credentials, cloud infrastructure tokens, and CI/CD secrets.
VentureBeat

Protect your enterprise now from the Shai-Hulud worm and npm vulnerability in 6 actionable steps

Any development environment that installed or imported one of the 172 compromised npm or PyPI packages published since May 11 should be treated as potentially compromised. On affected developer ...
The Hacker News

SAP-Related npm Packages Compromised in Credential-Stealing Supply Chain Attack

Cybersecurity researchers are sounding the alarm about a new supply chain attack campaign targeting SAP-related npm Packages with credential-stealing malware. mbt@1.2.48 @cap-js/db-service@2.10.1 @cap ...
InfoQ

CodeGuardian: a Model Context Protocol Server for AI-Assisted Code Quality Analysis and Security Scanning

A monthly overview of things you need to know as an architect or aspiring architect. Unlock the full InfoQ experience by logging in! Stay updated with your favorite authors and topics, engage with ...
Bleeping Computer

GlassWorm malware hits 400+ code repos on GitHub, npm, VSCode, OpenVSX

The GlassWorm supply-chain campaign has returned with a new, coordinated attack that targeted hundreds of packages, repositories, and extensions on GitHub, npm, and VSCode/OpenVSX extensions. Evidence ...