Filtered by tag: npm × Clear
Hackers Hijack 10 npm Packages to Spread PolinRider Malware Using Ethereum Blockchain
Matched: health
Attackers hijacked 10 npm packages across 12 releases, injecting malware that uses the Ethereum blockchain as a dead drop to locate command servers. Tracked as sonatype-2026-010515 with a severity score of 8.7, the PolinRider malware reads server IP addresses from blockchain transactions, fetches XOR-encoded JavaScript, and runs it persistently even after the host app closes. Unlike typical npm malware, it triggers on import rather than install hooks, bypassing common defenses. Teams should audit lockfiles, check process and network logs for detached Node processes or port-443 HTTP requests to /0x/cls or /0x/ls, and rotate any exposed secrets.
Hackers Hijack 42 GitHub Repositories to Plant Malware Traps for Claude, Gemini, and Cursor Users
Matched: health
Hackers compromised 42 GitHub repositories belonging to 11 legitimate owners, planting malware that activates when developers open projects in Claude, Gemini, Cursor, or VS Code. Hidden in oversized files (.github/init.js, 12-13MB), the code exploits startup hooks in AI coding tools. JFrog researchers linked the campaign to a broader npm worm, with payloads designed to steal credentials and self-propagate. No confirmed victims were reported.