Threatline

Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry. [...]

chaindrop npm supply-chain attack self-propagating malware 1,300 packages

6 more topics

2 billion monthly downloads npm registry packages malware infects hundreds

The Hacker News

1 month ago

Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm

The npm package known as "tensorlake," a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack. The malicious version 0.5.144 "contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code," Socket said

tensorlake npm package compromised shai-hulud chaindrop

7 more topics

supply chain attack credential-stealing malware exfiltration persistence remote code execution obfuscated malware