norden.social

3 posts3 participants0 posts today

Ryan Daws 🤓Masquerading payment npm package installs backdoor <a href="https://www.developer-tech.com/news/masquerading-payment-npm-package-installs-backdoor/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.developer-tech.com/news/masquerading-payment-npm-package-installs-backdoor/</a> <a href="https://techhub.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://techhub.social/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://techhub.social/tags/developers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#developers</a> <a href="https://techhub.social/tags/coding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#coding</a> <a href="https://techhub.social/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#programming</a> <a href="https://techhub.social/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a> <a href="https://techhub.social/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a> <a href="https://techhub.social/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a> <a href="https://techhub.social/tags/tech" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#tech</a> <a href="https://techhub.social/tags/news" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#news</a> <a href="https://techhub.social/tags/technology" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#technology</a>

OTX BotAtomic and Exodus crypto wallets targeted in malicious npm campaignA malicious npm package named pdf-to-office was discovered targeting cryptocurrency wallets. The package, posing as a PDF to Office converter, injects malicious code into locally installed Atomic and Exodus wallets. This attack modifies legitimate files to redirect crypto funds to the attacker's wallet. The campaign shows persistence, as removing the malicious package doesn't remove the injected code from the wallets. Multiple versions of both wallets were targeted, with the attackers adapting their code accordingly. This incident highlights the growing scope of software supply chain risks, particularly in the cryptocurrency industry, and emphasizes the need for improved monitoring of both source code repositories and locally deployed applications.Pulse ID: 67fd41f7af4b02a0fd75fb69 Pulse Link: <a href="https://otx.alienvault.com/pulse/67fd41f7af4b02a0fd75fb69" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://otx.alienvault.com/pulse/67fd41f7af4b02a0fd75fb69</a> Pulse Author: AlienVault Created: 2025-04-14 17:12:23Be advised, this data is unverified and should be considered preliminary. Always do further verification.<a href="https://social.raytec.co/tags/Atomic" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Atomic</a> <a href="https://social.raytec.co/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://social.raytec.co/tags/InfoSec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#InfoSec</a> <a href="https://social.raytec.co/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://social.raytec.co/tags/OTX" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OTX</a> <a href="https://social.raytec.co/tags/Office" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Office</a> <a href="https://social.raytec.co/tags/OpenThreatExchange" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenThreatExchange</a> <a href="https://social.raytec.co/tags/PDF" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PDF</a> <a href="https://social.raytec.co/tags/RCE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RCE</a> <a href="https://social.raytec.co/tags/SupplyChain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SupplyChain</a> <a href="https://social.raytec.co/tags/bot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#bot</a> <a href="https://social.raytec.co/tags/cryptocurrency" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cryptocurrency</a> <a href="https://social.raytec.co/tags/AlienVault" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AlienVault</a>

securityaffairsMalicious <a href="https://infosec.exchange/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> packages target <a href="https://infosec.exchange/tags/PayPal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PayPal</a> users <a href="https://securityaffairs.com/176530/security/malicious-npm-packages-to-steal-paypal-credentials.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://securityaffairs.com/176530/security/malicious-npm-packages-to-steal-paypal-credentials.html</a> <a href="https://infosec.exchange/tags/securityaffairs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#securityaffairs</a> <a href="https://infosec.exchange/tags/hacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#hacking</a>

Mike McCaffreyFYI: Absolutely do not use AI to generate any files that specify what packages to include in your project: <a href="https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.theregister.com/2025/04/12/ai_code_suggestions_sabotage_supply_chain/</a><a href="https://drupal.community/tags/GenerativeAI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GenerativeAI</a> <a href="https://drupal.community/tags/VibeCoding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#VibeCoding</a> <a href="https://drupal.community/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://drupal.community/tags/Drupal" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Drupal</a>

skry“slopsquatting, a new term for a surprisingly effective type of software supply chain attack that emerges when LLMs “hallucinate” package names that don’t actually exist. If you’ve ever seen an AI recommend a package and thought, “Wait, is that real?”—you’ve already encountered the foundation of the problem.And now attackers are catching on.”The Rise of Slopsquatting: How <a href="https://mastodon.social/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a> Hallucinations Are Fueling... <a href="https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://socket.dev/blog/slopsquatting-how-ai-hallucinations-are-fueling-a-new-class-of-supply-chain-attacks</a> <a href="https://mastodon.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://mastodon.social/tags/dev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dev</a> <a href="https://mastodon.social/tags/infosec" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#infosec</a>Edit: more info: <a href="https://www.bleepingcomputer.com/news/security/ai-hallucinated-code-dependencies-become-new-supply-chain-risk/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/ai-hallucinated-code-dependencies-become-new-supply-chain-risk/</a>

Teddy / Domingo (🇨🇵/🇬🇧)<a href="https://framapiaf.org/tags/OpenSource" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#OpenSource</a> Poisoned <a href="https://framapiaf.org/tags/Patches" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Patches</a> Infect Local <a href="https://framapiaf.org/tags/Software" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Software</a>. Malicious packages lurking on open source repositories like <a href="https://framapiaf.org/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> have become less effective, so cyberattackers are using a new strategy: offering "patches" for locally installed programs. <a href="https://www.darkreading.com/cloud-security/open-source-poisoned-patches-infect-local-software" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.darkreading.com/cloud-security/open-source-poisoned-patches-infect-local-software</a>

Hackread.com🚨 Watch out as new npm malware targets Atomic and Exodus wallets to alter their addresses and hijack crypto transfer.Read: <a href="https://hackread.com/npm-malware-atomic-exodus-wallets-hijack-crypto/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://hackread.com/npm-malware-atomic-exodus-wallets-hijack-crypto/</a><a href="https://mstdn.social/tags/CyberSecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CyberSecurity</a> <a href="https://mstdn.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://mstdn.social/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> <a href="https://mstdn.social/tags/Crypto" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Crypto</a> <a href="https://mstdn.social/tags/Scam" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Scam</a>

Olivier Stuker (he/him)npm: 3 moderate severity vulnerabilitiesme: npm audit fix --forcenpm: 5 moderate severity vulnerabilitiesAAAAAAAAAAAAAAAAAAAAA<a href="https://toot.community/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://toot.community/tags/nodejs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nodejs</a> <a href="https://toot.community/tags/programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#programming</a>

Mike Taylor 🦕Hoo boy am I tired of seeing messages in my browser's JavaScript from some deep transitive dependency of the app I work on, saying "We're about to remove support for <feature that a slightly less nested transitive dependency uses>, sucks to be you."This whole developer ecosystem is a nightmare of endless compatibility problems, 90% of them trivially avoidable with a moment's thought.<a href="https://sauropods.win/tags/Node" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Node</a> <a href="https://sauropods.win/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://sauropods.win/tags/React" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#React</a> <a href="https://sauropods.win/tags/DependencyHell" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#DependencyHell</a>

Andrija PetrovicIt seems that while I was building my huge monorepo in good old JS5 <a href="https://lor.sh/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> I missed the <a href="https://lor.sh/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> workspaces concept that emerged somewhere along those years. Now that I hit the wall with <a href="https://lor.sh/tags/deno" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#deno</a> and a bunch of dependency-wise intertwined packages, I've learned about deno's workspace feature that is a reimplementation of npm's workspaces. Ok, let me see if I can organize my code using workspace(s)...

Teddy / Domingo (🇨🇵/🇬🇧)Une porte dérobée découverte dans des paquets <a href="https://framapiaf.org/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a>. L’écosystème npm fait souvent l’objet d’attaques par des cybercriminels et les chercheurs en <a href="https://framapiaf.org/tags/cybers%C3%A9curit%C3%A9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersécurité</a> (...) <a href="https://www.lemondeinformatique.fr/actualites/lire-une-porte-derobee-decouverte-dans-des-paquets-npm-96460.html" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.lemondeinformatique.fr/actualites/lire-une-porte-derobee-decouverte-dans-des-paquets-npm-96460.html</a> <a href="https://framapiaf.org/tags/s%C3%A9curit%C3%A9" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#sécurité</a>

Frontend DogmaMalware Found on npm Infecting Local Package With Reverse Shell, by @reversinglabs.com:<a href="https://www.reversinglabs.com/blog/malicious-npm-patch-delivers-reverse-shell" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.reversinglabs.com/blog/malicious-npm-patch-delivers-reverse-shell</a><a href="https://mas.to/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> <a href="https://mas.to/tags/dependencies" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dependencies</a> <a href="https://mas.to/tags/security" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#security</a>

Carsten Rieger IT-Services 🔒Unsere Anleitung <a href="https://digitalcourage.social/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> "Nginx Proxy Manager mit <a href="https://digitalcourage.social/tags/nextcloud" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nextcloud</a> :nextcloud:" wurde soeben um das Kapitel "Update" erweitert 👇 <a href="https://www.c-rieger.de/nginx-proxy-manager-mit-nextcloud/#update" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.c-rieger.de/nginx-proxy-manager-mit-nextcloud/#update</a> Wir wünschen Ihnen ein schönes Wochenende!

.:\dGh/:.AnimeJS v4 has landed. Boy oh boy, it’s probably the sickest JavaScript library for animations.<a href="https://animejs.com/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://animejs.com/</a><a href="https://mastodon.social/tags/animejs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#animejs</a> <a href="https://mastodon.social/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JavaScript</a> <a href="https://mastodon.social/tags/Programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Programming</a> <a href="https://mastodon.social/tags/Web" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Web</a> <a href="https://mastodon.social/tags/WebDevelopment" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WebDevelopment</a> <a href="https://mastodon.social/tags/Development" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Development</a> <a href="https://mastodon.social/tags/Coding" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Coding</a> <a href="https://mastodon.social/tags/Animation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Animation</a> <a href="https://mastodon.social/tags/Internet" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Internet</a> <a href="https://mastodon.social/tags/Library" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Library</a> <a href="https://mastodon.social/tags/Package" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Package</a> <a href="https://mastodon.social/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a>

Jonathan MatthewsAnyone else seeing <a href="https://fosstodon.org/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> package installation failures? I can see <a href="https://status.npmjs.org/incidents/hdtkrsqp134s" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://status.npmjs.org/incidents/hdtkrsqp134s</a>, but the "scoped to certain keywords" is both weasel-wording and confusing ... <a href="https://fosstodon.org/tags/npmjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npmjs</a> <a href="https://fosstodon.org/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a> <a href="https://fosstodon.org/tags/devops" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#devops</a>

It's RichiePackage Manager for MarkdownI'm working on a project that is intended to encourage folk to make markdown text files which can be bundled together in different bundles of text files using a package manager. Question for coders; Which package manager would you suggest I use?Main criterias (in order) are:1. Easy for someone with basic command line skills to edit the file and update version numbers and add additional packages.2. All being equal, more commonly and easy to setup is preferred.<a href="https://hachyderm.io/tags/Markdown" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Markdown</a> <a href="https://hachyderm.io/tags/CommonMark" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CommonMark</a> <a href="https://hachyderm.io/tags/PackageManager" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PackageManager</a> <a href="https://hachyderm.io/tags/Programming" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Programming</a> <a href="https://hachyderm.io/tags/Dev" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Dev</a> <a href="https://hachyderm.io/tags/NPM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPM</a> <a href="https://hachyderm.io/tags/RubyGems" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#RubyGems</a> <a href="https://hachyderm.io/tags/Cargo" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cargo</a> <a href="https://hachyderm.io/tags/PickingAMastodonInstance" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PickingAMastodonInstance</a> <a href="https://hachyderm.io/tags/Ruby" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Ruby</a> <a href="https://hachyderm.io/tags/Python" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Python</a> <a href="https://hachyderm.io/tags/Rust" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Rust</a> <a href="https://hachyderm.io/tags/Javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Javascript</a> <a href="https://hachyderm.io/tags/NodeJs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NodeJs</a> <a href="https://hachyderm.io/tags/Lisp" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Lisp</a> <a href="https://hachyderm.io/tags/CommonGuide" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CommonGuide</a>

StéphaneWell... <a href="https://fosstodon.org/tags/yarn" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#yarn</a> 1.22 is obsolete and 4.x is "PNP", thus incompatible with <a href="https://fosstodon.org/tags/nextjs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#nextjs</a> . Gonna stick with classic <a href="https://fosstodon.org/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a>. <a href="https://fosstodon.org/tags/JavaScript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#JavaScript</a> <a href="https://fosstodon.org/tags/Node" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Node</a> <a href="https://fosstodon.org/tags/NodeJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NodeJS</a>

BillIn today's Supply Chain News ...Eleven oooold npm packages were hijacked to steal API keys. Wonder how many of them jise are just sitting on n someone's built pipeline with "latest" as the version parameter?<a href="https://www.sonatype.com/blog/multiple-crypto-packages-hijacked-turned-into-info-stealers" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.sonatype.com/blog/multiple-crypto-packages-hijacked-turned-into-info-stealers</a>h/t to SonaType for the top notch research.<a href="https://infosec.exchange/tags/supplychain" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#supplychain</a> <a href="https://infosec.exchange/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a>

The New Oil<a href="https://mastodon.thenewoil.org/tags/Infostealer" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Infostealer</a> campaign compromises 10 <a href="https://mastodon.thenewoil.org/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> packages, targets devs<a href="https://www.bleepingcomputer.com/news/security/infostealer-campaign-compromises-10-npm-packages-targets-devs/" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://www.bleepingcomputer.com/news/security/infostealer-campaign-compromises-10-npm-packages-targets-devs/</a><a href="https://mastodon.thenewoil.org/tags/cybersecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#cybersecurity</a>

Andrija Petrovic<a href="https://dindon.one/@henry" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@henry</a> Having (almost fully) switched to <a href="https://lor.sh/tags/NodeJS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NodeJS</a> in 2012, I quickly recognized the danger of relying to _anything_ (<a href="https://lor.sh/tags/npm" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#npm</a> included, this one gave me a lot of pain for several times over the years). Ended up with a monstrous monorepo. Forked (and improved) just 2 other people's repos, one abandoned and one that took months to finally get it right regarding garbage collection, but I had no time to wait. Thereby I never got to a situation to hate a programming language because of the hype around it, but it surely got me coding a ton of <a href="https://lor.sh/tags/javascript" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#javascript</a>. The experience helped me a lot in JS5=>ECMAScript and ECMAScript=>TypeScript switching in the last year or so.

Recent searches

Search options

Administered by:

Server stats:

#npm