The Hacker News

Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks

A Keyv-linked npm worm poisoned 353 versions across 79 package names, stealing developer and CI credentials while repository ...
Cybernews

Another massive NPM worm: 444 packages with 2 billion monthly downloads infected with malware

Hundreds of NPM packages have been hit in a massive supply chain attack. The Shai-Hulud worm variant is stealing developer ...
Developer Tech

npm supply-chain attack hits 400+ packages and steals developer credentials

A Mini Shai-Hulud worm spread through more than 400 npm packages, stealing npm, GitHub, cloud, and CI/CD credentials.
Microsoft

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...