Microsoft says latest attack targets Leo Platform and RStreams packages, harvesting creds and going after more maintainers ...

Microsoft Threat Intelligence identified an active multi-stage intrusion campaign targeting hospitality organizations in ...

Microsoft says hotel phishing emails are using Calendly links and photo ZIP files to drop the TonRAT Node.js implant on front ...

Moving one folder quadrupled my build speeds without touching a single config.

The infostealer was delivered via CVE-2026-48558, a critical authentication bypass vulnerability in SimpleHelp.

Installing a piece of code from NPM will no longer auto-run malware on the system, and won’t quietly pull malicious code from external repos unless the developer explicitly allows it. But this won’t ...

Los Angeles, CA, June 29, 2026 (GLOBE NEWSWIRE) -- Beach Day API, a developer-first REST API powered by VersusMedia, today ...

Secure software supply chain solution provider Chainguard Inc. today expanded its Chainguard Repository product with malware ...

Vivani Medical, Inc. (Nasdaq: VANI) (“Vivani” or the “Company”), a clinical-stage biopharmaceutical company developing ...

Vivani Medical, Inc. (NASDAQ: VANI) (“Vivani” or the “Company”), a clinical-stage biopharmaceutical company developing miniature, ultra long-acting drug implants, today announced the ...

A new piece of malware is spreading through the popular tinycolor NPM library and more than 300 other packages, some of which belong to CrowdStrike. Recently, there were reports of the tinycolor npm ...

TL;DR The Shai-Hulud Miasma campaign has a fresh series of malicious packages following the compromise of the czirker ...