Skip to content
Threat Feed
Subscribe

Product

Npm Packages

2 briefs RSS
critical advisory

Compromised OpenSearch Pre-Release npm Packages in Supply Chain Attack

Multiple npm and PyPi packages, including OpenSearch pre-release packages, were compromised in a supply chain attack, potentially leading to arbitrary code execution on developer or user systems.

OpenSearch +2 supply-chain-compromise npm pypi
2r 1t
high advisory

CanisterSprawl: Self-Propagating npm Malware Campaign

The CanisterSprawl malware campaign targets npm packages, using a self-propagating approach to steal sensitive data from developer machines, including tokens and API keys, and attempting to publish malicious packages using hijacked credentials.

npm packages supply-chain malware npm
2r 6t