Back to all articles
Topic

#npm

2 articles tagged “npm”.

MacBook Pro turned-onProgramming

Malware dev tries to steal Claude users' secrets and leaks own GitHub private token

A novice developer flooded npm with a sloppy infostealer targeting AI coding users, but embedded a hardcoded GitHub token that let researchers instantly map and dismantle the attack infrastructure.

May 28, 20264 min read
person standing near LED signDevSecOps

The TrapDoor Campaign Turns Three Registries Into a Unified Kill Chain

The TrapDoor campaign weaponized npm, PyPI, and Crates.io in a single coordinated push, extending into AI assistant config files via zero-width Unicode injection. The attack surface has moved from artifacts to runtime evaluation and prompt context—and defensive tooling is behind.

May 25, 20264 min read