The Provenance Was Valid. The Workflow Let Anyone Publish the Malware.
Ten malicious npm releases carried valid provenance because an outsider could drive the project’s trusted GitHub Actions publishing workflow.
npm
Two Arrests Put a Number on TeamPCP’s Supply-Chain Damage
Australian authorities charged two alleged TeamPCP participants and quantified the campaign's reach: more than 1,000 organisations, 500,000 credentials and 300 GB of data.
The Package Wasn’t the Payload. Its Trusted Mirror Was the Phishing Site.
Attackers used npm packages as storage for fake verification pages rendered through trusted mirrors, turning legitimate CDN domains into phishing infrastructure.
The Package Worked. A Single Import Started RedC2’s Linux Backdoor.
Fourteen functional npm utilities launched a native Linux backdoor when imported, bypassing install-hook defences and giving RedC2 an AI-assisted post-exploitation path.
ChainDrop Turned Trusted npm Publishing into a Self-Propagating Attack
A new Shai-Hulud descendant spread through npm packages with legitimate-looking provenance. The incident shows why a trusted build path is not necessarily a trustworthy one. Security researchers identified a fast-moving npm supply-chain campaign on 4 August and named it ChainDrop.…
Mini Shai-Hulud Turns Package Publishing into a Wormable Trust Path
A coordinated compromise of npm and PyPI packages shows how trusted publishing, CI caches and maintainer identities can combine into an automated supply-chain attack. Security researchers reported a new “Mini Shai-Hulud” campaign on 11 May involving trojanised packages in the…