A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft, and ...

Packagist packages hid malicious package.json scripts, enabling Linux binary execution during installs and workflows.

A malicious version of the PyTorch Lightning package published on the Python Package Index (PyPI) delivers a credential-stealing payload targeting browsers, environment files, and cloud services. The ...

BUCHAREST, Romania — MegaConvert.io is a free online file converter that supports 500+ format pairs in 47 languages — convert PDF, images, video, audio, ebooks, and more from any browser in seconds, ...

The world’s largest open-source registry, node package manager (npm), has been hit by another fast-moving malware attack, ...