/
affected_products:npm × criticity:critical × limpar

Resultados

2 casos · pág. 1/1

safedep.io · critical

DirtyBlanket npm packages impersonating Express and React drop self-spreading Linux worm with CHAOS RAT backdoor

The npm account dirtyblanket published nine typosquatted packages on September 29, 2026 in 33 minutes, eight copying Express and one copying React. On Linux, a preinstall hook fetches node.js through the Internet Archive Wayback Machine, which pulls the worm linux.sh from Codeberg and runs it with bash. The worm installs CHAOS, an open-so…

dirtyblanket hellscripter technology software development
safedep.io · critical

npm worm poisons 2,234 versions across 444 packages, including keyv and cacheable, stealing cloud and CI credentials

On 4 August 2026, an npm worm published 2,234 poisoned versions across 444 package names, using credentials from twelve organisations. Affected scopes include @ornikar, @deliveroo, @onereach, @or-sdk, @servicetitan, @qlik, @picsart, and the keyv and cacheable families. The keyv, flat-cache, file-entry-cache and cacheable-request packages …

technology software_development