A fake npm package named pdf-to-office has been discovered injecting malicious code into Atomic and Exodus crypto wallets, redirecting funds and stealing data

Banana Squad has compromised over 60 GitHub repos with malicious Python files, using UI quirks to hide malware and steal data from developers via a sophisticated supply chain attack.

ReversingLabs exposes a supply chain compromise of the VS Code ETHcode extension via two lines of malicious code in a GitHub PR, leading to malware deployment.

A malicious update to the Ethcode VS Code extension compromised over 6,000 developers, highlighting a growing threat in open-source supply chain attacks.

A phishing attack compromised the maintainer of a popular npm package, eslint-config-prettier, leading to the spread of malware to thousands of projects.

Experts at ReversingLabs have uncovered a critical loophole in the VS Code Marketplace. The platform allows new extensions to be published under the same names previously used by other packages, provided those packages were...

A loophole in the VS Code Marketplace allows attackers to reuse names of removed extensions to spread malware, a flaw that creates a new supply chain attack vector.

A new report reveals that malicious npm packages are using Ethereum smart contracts as resilient command-and-control servers, a new tactic in open-source attacks.

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread

Follow us on Bluesky, Twitter (X), Mastodon and Facebook at @Hackread