MAL-2026-10077: Malicious code in type-slint (npm)

AI-Generated npm Package Leaks Its Own GitHub Token, Exposing Malware Operator

Sloppy AI-generated npm infostealer leaked its own GitHub token, exposing the operator

Security Alert: Malicious Nx Packages Published to npm Containing Credential-Stealing Code

## Summary Malicious versions of the [`nx` package]( as well as some supporting plugin packages, were published to npm, containing code that

A post-mortem of the malicious event-stream backdoor

A look back at the chain of events that led to the use of the malicious npm package "flatmap-stream" and a reflection on what it means for t

Visibly invisible malicious Node.js packages: When configuration niche meets invisible characters

A focus on attacks in the Node.js ecosystem via the yarn and npm package managers, examining how configuration abuse and hidden characters c

Malicious npm package "Codex" stole developer credentials for a month before detection

The npm package had an active GitHub repository and about 29,000 weekly downloads while providing a remote web UI for OpenAI Codex. For abou

What is typosquatting and how typosquatting attacks are responsible for malicious modules in npm