SleeperGem: RubyGems Supply Chain Attack
SleeperGem is a software supply chain attack targeting the Ruby ecosystem through three malicious RubyGems packages. The malware acts as a loader,…
Tag: supply chain attack
Fake Coding Tests Deliver OtterCookie Malware Hidden in SVG Flag Images
North Korean threat actors linked to the Contagious Interview campaign have been observed using steganography in SVG image files to conceal malicious…
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps
A malware framework called OkoBot has been targeting Windows machines since April 2025, with a module named SeedHunter designed to steal cryptocurrency…
Compromised AsyncAPI npm Packages Deliver Multi-Stage Botnet Malware
Four compromised npm packages in the @asyncapi namespace have been observed distributing a multi-stage botnet loader, according to findings from OX Security,…
148 npm Packages Disguised as Student Proxies Turn Browsers Into a DDoS Botnet
A campaign of 148 npm packages disguised as student web proxies turned visitors' browsers into a distributed denial-of-service (DDoS) botnet for roughly…
Shai-Hulud Worm: Self-Replicating npm Malware
A self-replicating worm that hit more than 500 npm packages in September 2025, harvesting developer secrets and republishing itself with stolen tokens.
Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install
Version 8.14.0 of the jscrambler npm package, published on July 11, 2026, shipped with a malicious preinstall hook that silently drops and…
Rust Infostealer Targets Developer Secrets via Compromised npm Package
A Rust-based infostealer was distributed through a compromised version of the jscrambler npm package. It steals cloud credentials, cryptocurrency wallets, password manager…
tj-actions/changed-files: GitHub Action for Changed Files
tj-actions/changed-files is a GitHub Action used to detect file changes in pull requests. It was compromised in a 2025 tag hijack attack,…
trivy-action: GitHub Action for Vulnerability Scanning
trivy-action is a GitHub Action for running Trivy vulnerability scans. It was compromised in a 2026 tag hijack attack, which this research…