npm Supply Chain Attack via Open Source maintainer compromise

NPM Package Author "qix" Compromised in Ongoing Supply Chain Phishing Attack

This article discusses the ongoing issue of phishing attacks targeting NPM package authors, specifically focusing on a compromised author na

DuckDB npm Account Breached in Ongoing Supply Chain Attack with Wallet-Drainer Malware

The ongoing npm supply chain attack that previously compromised prolific author Qix has now spread to the DuckDB npm account (duckdb_admin).

September 2025 NPM supply-chain attack compromises popular JavaScript packages

In September 2025, a coordinated software supply-chain attack targeted multiple popular NPM packages in the JavaScript ecosystem. The attack

Supply Chain Attacks on Open-Source Software: Case Study of Malicious Pull Request Attempts

The article discusses recent supply chain attacks on open-source software projects like LiteLLM and axios, with a specific case study of att

North Korean Hackers Target Open Source Developers in Supply Chain Attacks

Microsoft uncovers npm supply chain attack stealing cloud and CI/CD credentials via typosquatted packages

Microsoft identified an active supply chain attack (Mini Shai-Hulud campaign) targeting the npm package ecosystem. On May 28, 2026, a threat