MAL-2026-10039: Malicious code in chai-as-align (npm)

Typosquatted npm Package Delivers Windows RAT with Encrypted C2 and Registry Persistence

A newly discovered malware campaign is targeting Windows systems through a deceptive package on the npm registry. Disguised as a legitimate

Popular npm packages debug and chalk compromised with crypto-intercepting malware

The popular packages debug and chalk on npm have been compromised with malicious code

AI-Generated npm Package Leaks Its Own GitHub Token, Exposing Malware Operator

Sloppy AI-generated npm infostealer leaked its own GitHub token, exposing the operator

What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm

Microsoft detects 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries

And then Microsoft busted them all

Microsoft detects 14 malicious npm packages impersonating OpenSearch and Elasticsearch libraries

And then Microsoft busted them all

Malicious npm package "Codex" stole developer credentials for a month before detection

The npm package had an active GitHub repository and about 29,000 weekly downloads while providing a remote web UI for OpenAI Codex. For abou