Get all your news in one place.

100's of premium titles.
One app.

Get all your news in one place.

100's of premium titles. One news app.

THE TRUTH ABOUT: Npm - The Untold Story

Drug-dealing, makeshift weapons and a ‘culture of fear’ at Villawood detention centre, report warns

Prolonged detention of children, insufficient staffing and hazardous damage to buildings are among the ombudsman’s concerns

The Guardian - AU

OpenAI Codex tool with over 29,000 downloads linked to malicious npm supply chain attack stealing authentication tokens

A tool started benign and turned sour after a little while, stealing tokens and granting persistent access.

TechRadar

GitHub hit with another major attack — Megalodon hits over 5,000 repos with malware-laden commits

A TeamPCP copycat was just spotted hitting thousands of GitHub repos with an infostealer.

TechRadar

From analysis to the latest developments in health,
read the most diverse news in one place.

500 Poisoned Packages, Hundreds of Companies: TeamPCP's Worm Just Reached GitHub

A GitHub employee installed a routine VS Code extension update, handed cybercrime group TeamPCP enough access to exfiltrate approximately 3,800 of GitHub's internal source code repositories — everything from platform infrastructure to proprietary tooling built by the company that hosts more than 420 million repositories for over 180 million developers…

International Business Times

What is Mini Shai-Hulud npm supply chain attack, and was Microsoft and Socket hit by malware? Full explainer on npm malware spread

What is Mini Shai-Hulud npm supply chain attack, and was Microsoft and Socket hit by malware? A new npm supply chain attack hit hundreds of packages linked to the @antv ecosystem. Attackers used a compromised maintainer account to publish malicious versions that stole credentials and spread across repositories. Microsoft and…

The Economic Times

One of JavaScript's most popular libraries compromised by hackers — Axios npm package hit in supply chain attack that deployed a cross-platform RAT

An attacker compromised the npm account of a lead Axios maintainer on March 30, and used it to publish two malicious versions of the widely used JavaScript HTTP client library.

Tom’s Hardware

CanisterWorm malware wipes Iranian machines for no apparent reason — sophisticated attack spreads through npm packages and uses ICP canister as control surface

CanisterWorm malware wipes Iranian machines for no apparent reason

Tom’s Hardware

Read news from The Economist, FT, and more,
with one subscription

Kia Carnival escape one of 12 since US firm took control of Australian immigration detention, damning report finds

Staffing levels at centres ‘critical’ under Management and Training Corporation, prisons watchdog says

The Guardian - AU

Worrying WhatsApp attack can steal messages and even accounts - here's how to stay safe from "poisoned" attack

TechRadar

Thousands of fake packages flood npm registry in major attack - here's what we know

The campaign could be in preparation for a malicious attack, or it could be a way to earn crypto tokens.

TechRadar

GitHub is finally tightening up security around npm following multiple attacks

Github is looking to harden package publication with mandatory 2FA for local publishing, and more.

TechRadar

A terrifying, self-replicating malwaere has infected npm packages with over 2 million downloads per week - here's how to stay safe

Supply chain attacks against npm users continue with a new self-propagating worm.

TechRadar

Compromised files replace npm packages with a combined 2 billion weekly downloads

The "biggest supply chain attack" in the history of npm took place recently, affecting almost two dozen packages.

TechRadar

JavaScript packages with billions of downloads were injected with malicious code in world's largest supply chain hack, geared to steal crypto — a phishing email is all it took to undermine npm packages

JavaScript packages with billions of downloads were compromised by an unknown threat actor looking to steal cryptocurrency.

Tom’s Hardware

Get all your
news in one place.

100's of premium titles.
One news app.

Benzinga

Ledger CTO Warns Of Ongoing NPM Supply Chain Attack, Advises Users To Halt Onchain Transactions

Ledger Chief Technology Officer Charles Guillemet on Monday urged crypto users to take immediate precautions following what appears to be a large-scale supply chain cyberattack targeting the JavaScript ecosystem.

TechRadar

NPM packages from Nx targeted in latest worrying software supply chain attack

Hackers target popular open source build system and development toolkit, with relative success.

TechRadar

Are they brave or stupid? Malware targeting Russian crypto hackers found

Researchers found malware hiding in npm packages downloaded by Russian crypto developers.

TechRadar

Npm package with millions of downloads is at risk from malware hijacking

Hackers were deploying malware through a popular npm package for six hours.

Get all your
news in one place.

100's of premium titles.
One news app.

TechRadar

North Korean hackers release malware-ridden packages into npm registry

A second wave of tainted packages was spotted on npm, likely part of a larger campaign.

TechRadar

Researchers discovered 17 NPM packages laden with malware.

TechRadar

NPM users warned dozens of malicious packages aim to steal host and network data

A total of 60 packages were recently removed from NPM.

TechRadar

Ripple cryptocurrency software library hit by major security issue, wallets under threat

Malicious commits were uploaded to NPM but quickly removed.

Fortune

The Ledger hack could have been much worse. But it also could have been easily prevented

Standards that are commonplace in other industries, such as banking, could have easily prevented a major infrastructure compromise.

TechRadar

The EU’s Product Liability Directive could kill open source

Should all commercial activities indirectly resulting from open source really be held liable?

The Conversation

Why has a UN torture prevention subcommittee suspended its visit to Australia?

This week, a United Nations torture prevention subcommittee delegation suspended its visit to Australia. The delegation arrived on October 16 and was due to end its visit on October 27, but suspended the visit prematurely on Sunday October 23.

1 2

People

Thanos

267 stories

From analysis to the latest developments in health,
read the most diverse news in one place.

Organisations

the European Parliament

Australian Border Force

100 stories

MTC

78 stories

Read news from The Economist, FT, and more,
with one subscription

Topics

Places

Fourteen days free

Download the app

One app. One membership.
100+ trusted global sources.