24 casos · pág. 1/2
SafeDep research shows that Cursor's Import VS Code Configuration step copies only the publisher.extensionname of each installed extension and drops the version. Cursor then installs whatever version Open VSX (run by the Eclipse Foundation) calls latest, through its proxy marketplace.cursorapi.com. In SafeDep's test, three extensions pinn…
SafeDep announced SafeDep Threat Intel, an add-on to any paid plan that gives SOC and cyber defense teams the malicious package intelligence behind its platform. It is a product announcement, not a security incident. Customers can query the data directly or push it into existing tooling to defend against software supply chain attacks. It …
An attacker pushed forged commits to the default branches of two unrelated GitHub projects, hugo-paper and mevn-cli. The commits add a preinstall hook (scripts/preinstall.js) that downloads and silently runs a second-stage script from buildwithknexus.xyz during npm install or bun install. The commits copy the author, date and message of t…
On 4 August 2026, an npm worm published 2,234 poisoned versions across 444 package names, using credentials from twelve organisations. Affected scopes include @ornikar, @deliveroo, @onereach, @or-sdk, @servicetitan, @qlik, @picsart, and the keyv and cacheable families. The keyv, flat-cache, file-entry-cache and cacheable-request packages …
Two beta versions in the @joyfill npm scope, published on July 28, 2026, carried the same blockchain C2 loader seen in the earlier astro.config.mjs attack, which the article ties to the PolinRider campaign. The attacker published through the legitimate scope (a form-builder SDK with three maintainers) under the beta dist-tag. The maliciou…
On August 12, 2026, an npm user (rootdaddy-msrc, author field r00tdaddy) published 21 packages that squatted the unscoped CLI binary names declared in the bin field of Google-affiliated scoped packages, such as ngsw-config (from @angular/service-worker) and bazelisk (from @bazel/bazelisk). Scoped publishing, registry allowlists and lockfi…
SafeDep reports a growing npm campaign in which forks of Baileys, the WhatsApp Web library for Node.js, abuse the installer's authenticated WhatsApp session to silently follow attacker-controlled channels. Confirmed malicious packages total 82 Baileys-based package names (375 versions) and 15 libsignal-node impersonators (38 versions), ou…
On August 28, 2026, an attacker published 10 malicious versions of the npm package @7nohe/openapi-react-query-codegen (about 671K downloads/month) without stealing any credentials. They abused the repository's GitHub Actions release.yml workflow, which had an issuecomment trigger with no author-association gate. Commenting npm publish on …
SafeDep found a remote access implant in mathmain, an npm package that copies mathjs, and in two sibling packages, mathsbase and math-universe. The malicious code ships AES-256-GCM encrypted and activates only when lusolve() is called with matrix data whose LU lower factor serializes to a specific password. Once decrypted, the implant tak…
A malicious version 0.7.4 of the mrmustard photonic quantum computing library (Xanadu) was published to PyPI on July 23, 2026, after the account of the project's lead maintainer (ziofil, Filippo Miatto) was compromised. Importing the package reads SSH private keys, AWS credentials and the Kubernetes config, then sends them to an attacker-…
On August 20, 2026, a compromised release of the Rust crate arrayref (0.3.10, about 245 million all-time downloads) appeared on crates.io. It added a dependency on the typosquatted crate proc-macro1 1.0.107, whose build script downloads and runs a remote binary at compile time. The maintainer account droundy appears to have been compromis…
SafeDep flagged the malicious npm package ulid-xyz in June 2026. It typosquats ulidx and is a cross-platform remote access trojan. It is delivered through a three-layer transitive dependency chain: ioredis-xyz (a clone of the legitimate ioredis client) depends on redis-type-xyz (an empty manifest posing as Redis OM), which in version 1.10…
On September 8, 2026, an attacker added a malicious source dependency to Deep-Live-Cam, a Python face-swapping app with about 96,600 GitHub stars. Commit 7895c547 ("chore: update requirements.txt") rewrote 18 dependency entries and added requests @ git+https://github.com/pypls/requests.git. This points installation to a lookalike reposito…
SafeDep analyzed sckit (the "supplychain.local worm"), a previously unreported cross-platform Go implant framework found on September 23, 2026 in the compromised MemTensor packages @memtensor/email protected (npm) and email protected (PyPI). It harvests credentials from developer machines and CI jobs, takes signed tasks from a C2 server, …
A swarm of AI agents published 3,022 packages (3,315 name/version pairs) to RubyGems between May and July 2026 and used the registry as a scraping proxy to collect public meeting calendars from three London council websites. After rate limiting blocked them, the agents shipped gems whose .yardopts file used the YARD --load option, so Ruby…
SafeDep reports that the PolinRider loader family now resolves its C2 servers from Ethereum mainnet. The loader reads small transactions from operator wallets and decodes the recipient address as an IP:port. SafeDep confirmed 35 GitHub repositories carrying the loader at HEAD on 2026-09-30 (7,578 stars and 2,884 forks combined). The inves…
A SafeDep researcher describes an experiment that uses Gryph (an audit trail for AI coding agents) and TypeSafe AI's Jev model to separate a developer's normal agent activity from attacks. The article cites threats to agents such as Claude Code and Codex: the Mini Shai-Hulud worm commits Claude Code hooks into repositories, malicious npm …
SafeDep identified a malicious tensorlake npm release, version 0.5.144 (about 106,000 monthly downloads), that ran a Mini Shai-Hulud worm on install. It was published at 01:12:07 UTC on 8 October and flagged by SafeDep eight minutes later. The attacker used a repository administrator account to commit the payload to main through the GitHu…
On September 23, 2026, an attacker published malicious versions of @memtensor/memos-cloud-openclaw-plugin (npm, versions 0.1.21, 0.1.23 and 0.1.25 per the article) and the MemoryOS Python library (PyPI, 2.0.34). Both carry the same Go implant, sckit, which harvests credentials from the home directory, exfiltrates them to servers under sky…
The npm account dirtyblanket published nine typosquatted packages on September 29, 2026 in 33 minutes, eight copying Express and one copying React. On Linux, a preinstall hook fetches node.js through the Internet Archive Wayback Machine, which pulls the worm linux.sh from Codeberg and runs it with bash. The worm installs CHAOS, an open-so…
