At least 187 code packages made available through the JavaScript repository NPM have been infected with a self-replicating worm that steals credentials from developers and publishes those secrets on ...

GitHub will enforce 2FA and deprecate legacy tokens to improve package publishing security Trusted Publishing will expand, and token-based publishing will be restricted by default Shai-Hulud worm ...

GitHub, which owns the npm registry for JavaScript packages, says it is tightening security in response to recent attacks.… September has been a bad month for npm with phishing attacks on package ...

Multiple official SAP npm packages were compromised in what is believed to be a TeamPCP supply-chain attack to steal ...

The Bitwarden CLI NPM package compromise is tied to a Checkmarx supply chain attack and references the Shai-Hulud worm.

Researchers discovered malicious activity impacting GitHub and popular WordPress and npm tools that could pose significant supply chain risks. In a new report, Armis Labs highlighted three recently ...

A surge in supply chain attacks has put open-source software risk, prompting GitHub to strengthen security across its npm ecosystem. The company, which operates the world’s largest code repository, is ...