Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
A cluster of 77 malicious extensions on the Open VSX marketplace has been discovered impersonating legitimate developer tools while exfiltrating sensitive information…
Tag: Shai-Hulud
Keyv-Linked npm Worm Poisons Hundreds of Packages, Plants Claude Code and VS Code Hooks
A credential-stealing npm worm that first appeared in keyv@6.0.0 has spread beyond the Keyv and Cacheable namespaces into hundreds of packages across…
AI in the Build Pipeline: How Software Supply Chain Security Must Evolve
Software supply chain security was already complex, but the integration of AI into the build pipeline has introduced new risks that traditional…
Shai-Hulud: Historical npm Worm Activity
Shai-Hulud is a known npm worm family that has been active in past supply chain attacks. The recent ChainDrop campaign shows tradecraft…