This Week in Malware — npm malware exfiltrates Windows SAM, Amazon EC2 credentials
4 minute read time
Malicious packages caught this week exfiltrate Amazon EC2, Windows SAM credentials, and launch malicious executables.
Read More...
This Week in Malware — Malicious Rust crate, 'colors' typosquats
5 minute read time
From a malcious Rust typosquat found in the crates[.
Read More...
Malicious npm 'colors' typosquats pack Discord malware
5 minute read time
Sonatype has caught newer typosquats of the popular 'colors' npm library that contain Discord info-stealing malware.
Read More...
Fixing a vulnerability? Make sure your GitHub isn't showing too much
5 minute read time
February's $326 million crypto hack at Wormhole and this month's findings by Sonatype shed light on the importance of secrets management for open source.
Read More...
This Week in Malware — A 'fix-crash' info-stealer and 500+ malicious npm packages
6 minute read time
This week in malware—Dive Deep into this week's findings from Sonatype's automated malware detection system.
Read More...
86 malicious npm packages named after popular NodeJS functions
3 minute read time
Sonatype has now discovered 83 packages on the npm open source repository named after popular NodeJS & JavaScript functions that exfiltrate system information.
Read More...
Remember npm library 'colors'? There's no such thing as 'colors-2.0'
5 minute read time
Alongside the popular 'colors' library on npm come unwanted malicious typosquats called 'colors-2.0', 'colors-3.0, 'colorsss', and so on.
Read More...
What's in your jQuery app? Not the fishy 'jquery-lh' we hope!
3 minute read time
The mysterious 'jquery-lh' npm package installs real jQuery code while doing something fishy behind the scenes.
Read More...
PyPI, NuGet, npm flooded with Roblox and Fortnite spam: What draws OSS attackers to gamers?
7 minute read time
Spammers flood PyPI, NuGet and npm with bogus Roblox and Fortnite spam, as open source attacks leveraging gaming platforms continue to increase.
Read More...