Signal
29 articles covering "malware"
The Hacker News reports bee-js 13.3.0 (npm) and Swarm Desktop 0.56.2 (GitHub) were published via Ethersphere's own automation on Nov 9, 2026; both run a loader for code built to steal Swarm node wallet keys. 0.56.3 replaces 0.56.2.
An attacker replaced download archives on five OVHcloud CLI releases on October 19; a customer's pinned SHA-256 caught it, and OVHcloud had not enabled GitHub's release immutability.
An account named marchos1as uploaded typosquatted yay and paru lookalikes to the AUR; their install scriptlets ran a downloaded script as root before maintainers banned the account.
Researchers say a lone operator published 12 npm packages since August 2023, eight malicious; Checkmarx found three still installable on September 29 with incomplete advisory coverage.
Socket reports two malicious VS Code themes in a GlassWorm-linked cluster, one hiding a Windows downloader and one a Solana-resolving loader, months after a coordinated takedown.
The indexed-btree npm package evades npm v12's install-script blocking by hiding its malware loader inside a runtime method instead, Checkmarx reports.
Socket found malicious code in dev branches of a 700,000-download Laravel Nova package on Packagist, tying the compromise to its ongoing PolinRider campaign.
TrendAI found 14 npm packages disguised as calendar utilities quietly installing RedShell, a Linux implant tied to the AI-assisted RedC2 4.0 command-and-control framework.
Researchers found one threat actor ran typosquatting campaigns on RubyGems and npm days apart, sharing an identical Rust loader and Go infostealer.
Yeeth Security found 'Solidity Pro' VS Code extensions that evolved from a delayed Cloudflare-Worker dropper into a Telegram-based wallet and credential stealer targeting web3 developers.
Sonatype is tracking sonatype-2026-005660, a campaign that has published 846 malicious npm packages across throwaway accounts, dropping cross-platform malware with DNS-based fallback delivery.
Kaspersky's GReAT team found a new Go-language RAT and toolkit hitting government and diplomatic targets in Southeast Asia, with a possible link to the TetrisPhantom espionage actor.