Tagged “npm”
2 posts
The chalk/debug npm Compromise: Anatomy of a Package Hijack
One phished maintainer turned 18 ubiquitous npm packages into a crypto-stealing payload in about two hours. Here is how it worked and the build-pipeline controls that blunt it.
securitynpmsupplychaincicdidentity
Shai-Hulud Turns Your Own Laptop Into a GitHub Actions Runner
The Shai-Hulud npm worm backdoors developer machines by registering them as self-hosted GitHub Actions runners, then uses GitHub Discussions as its command channel.
securitygithubcicdsupplychainnpm