Back
Tool
Npm
Related CVEs
Recent activity
Active Exploitation of GitLab CVE-2026-19478 and Microsoft Entra ID FlawGitLab's CVE-2026-19478, a critical code injection vulnerability with a CVSS score of 9.4, is currently under active exploitation just days after its public disclosure on August 17…Malware Spread via Fake Polymarket Trading Bot Targets DeFi DevelopersOn July 1, 2026, security firm SlowMist identified a fake trading bot on GitHub designed to spread malware targeting Polymarket users and DeFi developers. The bot, named 'polymarke…North Korean Hackers Target Open Source Software Supply Chain via npm PackagesAmazon's threat intelligence has linked a series of compromises of popular npm packages—axios, debug, chalk, and typo-crypto—to a North Korean hacking group known as Sapphire Sleet…NPM Packages Distribute PylangGhost RAT in Supply Chain AttackMalicious npm packages have been identified as vehicles for the PylangGhost remote access trojan (RAT), linked to North Korean state-sponsored group FAMOUS CHOLLIMA. The attack beg…North Korean Hackers Utilize EtherHiding for Cryptocurrency TheftThe Google Threat Intelligence Group (GTIG) reports that North Korean threat actor UNC5342 has adopted a new technique called EtherHiding to deliver malware and facilitate cryptocu…Go Malware Campaign Targets Terraform Providers and Go ModulesCybersecurity researchers have identified a Go-based malware campaign utilizing malicious Terraform providers and Go Modules. The campaign marks the first known instance of malware…Supply Chain Attack: GHAPPIER Loader Exploits npm Trusted PublishingOn September 9, 2026, an attacker compromised the maintainer account of the npm package @dforge-core/dforge-mcp for 105 minutes, releasing a malicious loader named GHAPPIER. The at…North Korean Malware Targets Crypto Developers via NPM PackagesA malicious npm package named @validate-sdk/v2, introduced through Anthropic’s Claude Opus AI model, has been linked to a breach in the open-source crypto trading project openpaw-g…LiteLLM Supply Chain Attack Exposes Critical CredentialsOn March 24, 2026, two versions of the LiteLLM Python package (1.82.7 and 1.82.8) were compromised on PyPI, embedding credential-stealing payloads. The attack, linked to the TeamPC…