Researchers outline how the PhantomRaven campaign exploits hole in npm to enable software supply chain attacks.
The typosquatted packages auto-execute on installation, fingerprint victims by IP, and deploy a PyInstaller binary to harvest ...
An active campaign named 'PhantomRaven' is targeting developers with dozens of malicious npm packages that steal ...
Attackers are exploiting a major weakness that has allowed them access to the NPM code repository with more than 100 credential-stealing packages since August, mostly without detection.
Ten malicious packages mimicking legitimate software projects in the npm registry download an information-stealing component ...
The ongoing ‘PhantomRaven’ malicious campaign has infected 126 npm packages to date, representing 86,000 downloads ...
Almost a dozen malicious npm packages, delivering dangerous infostealing malware, were downloaded roughly 10,000 times before ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results
Feedback