MAL-2026-10080: Malicious code in webrix-docs (npm)
The npm package webrix-docs version 20.2.11 contains malicious code that executes automatically during installation. It collects host system information such as hostname, user details, platform…
Read the full articleYou might also wanna read
Security Alert: Malicious Nx Packages Published to npm Containing Credential-Stealing Code
## Summary Malicious versions of the [`nx` package]( as well as some supporting plugin packages, were published to npm, containing code that
github.com·10mo ago
AI-Generated npm Package Leaks Its Own GitHub Token, Exposing Malware Operator
Sloppy AI-generated npm infostealer leaked its own GitHub token, exposing the operator
infosecurity-magazine.com·1mo ago
Malicious npm package "Codex" stole developer credentials for a month before detection
The npm package had an active GitHub repository and about 29,000 weekly downloads while providing a remote web UI for OpenAI Codex. For abou
briefly.co·1mo ago
Targeted npm dependency confusion attack caught red-handed
Once in a while we encounter a truly malicious package that has a purpose, means, and is production-ready — this is a story about one found
Typosquatted npm Package Delivers Windows RAT with Encrypted C2 and Registry Persistence
A newly discovered malware campaign is targeting Windows systems through a deceptive package on the npm registry. Disguised as a legitimate
cybersecuritynews.com·15d ago
npm malware targeting Claude users leaks own GitHub token, reaches 676 downloads
Script kiddies these days
theregister.com·1mo ago
Comments
Sign in to join the conversation.
No comments yet. Be the first.