The typosquatted packages auto-execute on installation, fingerprint victims by IP, and deploy a PyInstaller binary to harvest ...

Ten malicious packages mimicking legitimate software projects in the npm registry download an information-stealing component ...

An advanced malware campaign on the npm registry steals the very keys that control enterprise cloud infrastructure.

Recently, security researchers Socket found 10 packages on npm targeting software developers, specifically those who use the ...

Ten typosquatted npm packages (Jul 4, 2025) delivered a 24MB PyInstaller info stealer using 4 obfuscation layers; ~9,900 ...

Version 1.3 of the Bun JavaScript runtime and toolkit has landed, pushing forward the project's goal to consolidate fragmented JavaScript toolchains into a single solution. Yet the rapid expansion has ...

A React Native module for working with ZIP archives. This module allows you to list the contents of ZIP files, stream files from ZIP archives, create new ZIP files. Now supports password-protected ...

Steak 'n Shake plans to install the "tallest and biggest American flag" at all of its locations. The restaurant chain's owner, Sardar Biglari, has aligned the brand with conservative values and ...

Threat actors with suspected ties to China have turned a legitimate open-source monitoring tool called Nezha into an attack weapon, using it to deliver a known malware called Gh0st RAT to targets. The ...