Experimental News Clipping Site

Tag: Node Package Manager

  • The Register: Nx NPM packages poisoned in AI-assisted supply chain attack

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/27/nx_npm_supply_chain_attack/ Source: The Register Title: Nx NPM packages poisoned in AI-assisted supply chain attack Feedly Summary: Stolen dev credentials posted to GitHub as attackers abuse CLI tools for recon Nx is the latest target of a software supply chain attack in the NPM ecosystem, with multiple malicious versions being uploaded to the NPM…

  • The Register: Rampant emoji use suggests crypto-stealing NPM package was written by AI

    —

    by

    Kurt Seifried
    in

    Source URL: https://www.theregister.com/2025/08/01/emoji_use_ai_malware/ Source: The Register Title: Rampant emoji use suggests crypto-stealing NPM package was written by AI Feedly Summary: Kodane code was either machine-generated or done by a teenager An NPM package packed with cryptocurrency-stealing malware appears to have been largely AI-generated, as evidenced by its liberal use of emojis and other telltale signs.……

  • Simon Willison’s Weblog: Introducing OSS Rebuild: Open Source, Rebuilt to Last

    —

    by

    Kurt Seifried
    in

    Source URL: https://simonwillison.net/2025/Jul/23/oss-rebuild/ Source: Simon Willison’s Weblog Title: Introducing OSS Rebuild: Open Source, Rebuilt to Last Feedly Summary: Introducing OSS Rebuild: Open Source, Rebuilt to Last Major news on the Reproducible Builds front: the Google Security team have announced OSS Rebuild, their project to provide build attestations for open source packages released through the NPM,…

  • Slashdot: Destructive Malware Available In NPM Repo Went Unnoticed For 2 Years

    —

    by

    Kurt Seifried
    in

    Source URL: https://yro.slashdot.org/story/25/05/22/2012209/destructive-malware-available-in-npm-repo-went-unnoticed-for-2-years?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: Destructive Malware Available In NPM Repo Went Unnoticed For 2 Years Feedly Summary: AI Summary and Description: Yes Summary: The text highlights a significant security threat found in open-source software archives, where malicious packages imitating legitimate ones have been identified. This incident underscores the risks associated with software supply…

  • Slashdot: Over 3,200 Cursor Users Infected by Malicious Credential-Stealing npm Packages

    —

    by

    Kurt Seifried
    in

    Source URL: https://developers.slashdot.org/story/25/05/11/2222257/over-3200-cursor-users-infected-by-malicious-credential-stealing-npm-packages?utm_source=rss1.0mainlinkanon&utm_medium=feed Source: Slashdot Title: Over 3,200 Cursor Users Infected by Malicious Credential-Stealing npm Packages Feedly Summary: AI Summary and Description: Yes Summary: The text highlights a recent cybersecurity threat involving malicious npm (Node Package Manager) packages that target the AI-powered code-editing tool Cursor on macOS. The packages are designed to steal user credentials…

  • Hacker News: Snyk security researcher deploys malicious NPM packages targeting Cursor.com

    —

    by

    Kurt Seifried
    in

    Source URL: https://sourcecodered.com/snyk-malicious-npm-package/ Source: Hacker News Title: Snyk security researcher deploys malicious NPM packages targeting Cursor.com Feedly Summary: Comments AI Summary and Description: Yes Summary: The text describes a significant security incident involving potential dependency confusion attacks on NPM (Node Package Manager) packages. It underscores the importance of package analysis and highlights the actions taken…