Security researchers uncovered malicious npm packages impersonating Hardhat, a popular Ethereum development tool, targeting developers' sensitive data. These packages, which gained over 1,000 downloads, harvest mnemonic phrases and private keys through compromised Hardhat runtime functions...
A malicious npm package masquerading as an Ethereum smart contract vulnerability detector was discovered deploying Quasar RAT malware. The package uses sophisticated obfuscation and sandbox detection techniques. Additionally, a related study revealed widespread GitHub star manipulation, wi...
Popular npm packages Rspack and Vant were compromised in a supply chain attack, affecting over 500,000 weekly downloads. Attackers injected malicious code that deployed XMRig cryptocurrency miners, limiting CPU usage to 75% to avoid detection. Users are advised to upgrade to secure version...
Security researchers discovered malicious npm packages and VSCode extensions targeting developers through sophisticated supply chain attacks. The threats include typosquatted versions of popular packages like typescript-eslint and @types/node, which deploy trojans and malicious payloads. T...
A sophisticated cyber attack campaign targeting security researchers and penetration testers has resulted in the theft of over 390,000 credentials through a fake WordPress publishing tool on GitHub. The operation, attributed to threat actor MUT-1244, used trojanized repositories and phishi...
