Growing Threat of Malicious Attacks via Open-Source Packages
By
Daviey
Fresh out the oven, still warm. Top of the tray.
Summary
Malicious attacks using open-source packages are a growing threat, with cybercriminals exploiting repositories like PyPI and npm. Despite increased scrutiny, attackers continue to profit from these packages, as revealed in a recent cyberincident involving Cursor AI.
Key quotes
· 4 pulledAttacks that leverage malicious open-source packages are becoming a major and growing threat.
Increased scrutiny from researchers on repositories should have minimized profits for cybercriminals, but open-source packages remain an attractive way for attackers to make easy money.
Our investigation into a recent cyberincident confirmed that open-source packages are still exploited by attackers.
Kaspersky GReAT experts uncover malicious extensions for Cursor AI that download the Quasar backdoor and a crypto stealer.
You might also wanna read
September 2025 NPM supply-chain attack compromises popular JavaScript packages
In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack
Microsoft uncovers npm supply chain attack stealing cloud and CI/CD credentials via typosquatted packages
Microsoft identified an active supply chain attack (Mini Shai-Hulud campaign) targeting the npm package ecosystem. On May 28, 2026, a threat
Microsoft detects 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries
A threat actor using the alias vpmdhaj published 14 malicious npm packages within four hours, impersonating legitimate OpenSearch, Elasticse
theregister.com·1d ago
AI-Generated npm Package Leaks Its Own GitHub Token, Exposing Malware Operator
A malicious npm package named mouse5212-super-formatter, identified by OX Security, was caught leaking its own hardcoded GitHub token. This
infosecurity-magazine.com·2d ago
Microsoft uncovers supply chain attack: Compromised @antv npm packages steal CI/CD credentials via Mini Shai-Hulud malware
Microsoft has identified an active supply chain attack targeting the @antv npm package ecosystem. A threat actor compromised an @antv mainta
176 malicious npm packages used dependency confusion to target internal dependencies and steal credentials
Sonatype researchers uncovered a campaign involving 176 malicious npm packages using a dependency confusion attack strategy. Attackers publi
sonatype.com·3d ago