4 casos · pág. 1/1
SafeDep flagged the malicious npm package ulid-xyz in June 2026. It typosquats ulidx and is a cross-platform remote access trojan. It is delivered through a three-layer transitive dependency chain: ioredis-xyz (a clone of the legitimate ioredis client) depends on redis-type-xyz (an empty manifest posing as Redis OM), which in version 1.10…
SafeDep identified a malicious tensorlake npm release, version 0.5.144 (about 106,000 monthly downloads), that ran a Mini Shai-Hulud worm on install. It was published at 01:12:07 UTC on 8 October and flagged by SafeDep eight minutes later. The attacker used a repository administrator account to commit the payload to main through the GitHu…
Between 19 and 22 October 2026, an operator published 15 npm packages whose names end in testmetest, carrying a Miasma-family self-propagating worm. The malicious versions steal credentials, spread to other packages and repositories, and install a wiper that deletes the victim's home directory when the stolen GitHub token is revoked. Safe…
Kaspersky researchers describe a new MacSync macOS infostealer variant, first seen in the wild in September 2026, that replaces the earlier AppleScript-based droppers with FAT Mach-O binaries written in Objective-C and Swift. MacSync is sold as malware-as-a-service, so delivery varies by operator. In this campaign it spread through malici…
