North Korean Lazarus hackers have deployed six malicious npm packages, downloaded approximately 330 times, designed to steal credentials and cryptocurrency data. Using typosquatting techniques to mimic legitimate libraries, these packages systematically collect system information, extract ...
Recently discovered malicious packages in npm and PyPI repositories threaten developers with sophisticated attacks targeting cryptocurrency wallets, development environments, and Discord applications. The threats include Solana wallet exploits that steal private keys, typosquatted packages...
Security researchers uncovered malicious npm packages impersonating Hardhat, a popular Ethereum development tool, targeting developers' sensitive data. These packages, which gained over 1,000 downloads, harvest mnemonic phrases and private keys through compromised Hardhat runtime functions...
Twenty malicious npm packages impersonating Hardhat Ethereum development tools have been discovered, accumulating over 1,000 downloads. These packages use typosquatting to steal developers' private keys, configuration files, and sensitive blockchain data, potentially enabling cryptocurrenc...
Security researchers discovered malicious npm packages and VSCode extensions targeting developers through sophisticated supply chain attacks. The threats include typosquatted versions of popular packages like typescript-eslint and @types/node, which deploy trojans and malicious payloads. T...
