Tsundere botnet spreads via MSI and PowerShell installers, using Ethereum-based C2 rotation and game-themed lures to target ...

The originators of the Contagious Interview cyberattack campaign are stitching GitHub, Vercel, and NPM together into a ...

Hundreds of trojanized versions of well-known packages such as Zapier, ENS Domains, PostHog, and Postman have been planted in ...

PostHog says the Shai-Hulud 2.0 npm worm compromise was "the largest and most impactful security incident" it's ever experienced after attackers slipped malicious releases into its JavaScript SDKs and ...

The latest version also executes malicious code during the preinstall phase, and is bigger and faster than the first wave, say researchers.

Sha1-Hulud malware is an aggressive npm supply-chain attack compromising CI/CD and developer environments. This blog addresses frequently asked questions and advises cloud security teams to ...

While the September 2025 Shai-Hulud attack focused primarily on credential harvesting and self-propagation, this new variant ...

"As a new and significantly more aggressive wave of npm supply chain malware, Shai-Hulud 2 combines stealthy execution, ...

Shai-Hulud malware infiltrates 490 NPM packages, stealing API keys and credentials from ENS and major crypto development ...

Rocky Linux 10.1 is officially available for general use, bringing key features like systemd soft reboots and a massive ...

Shai Hulud's automated and aggressive upgrade is spawning more than 1,000 malicious npm repositories every 30 minutes, ...