An apparent "Dune" aficionado is responsible for the first self-propagating attack on the npm JavaScript repository in what one security company has ...

"Each published package becomes a new distribution vector: as soon as someone installs it, the worm executes, replicates, and ...

The bundle.js script is designed to steal npm, GitHub, AWS and GCP tokens. But it also installs TruffleHog – an open source ...

Dozens of npm libraries, including a color library with over 2 million downloads a week, have been replaced with novel ...