Recently, security researchers Socket found 10 packages on npm targeting software developers, specifically those who use the ...

Ten typosquatted npm packages (Jul 4, 2025) delivered a 24MB PyInstaller info stealer using 4 obfuscation layers; ~9,900 ...

Ten malicious packages mimicking legitimate software projects in the npm registry download an information-stealing component ...

An advanced malware campaign on the npm registry steals the very keys that control enterprise cloud infrastructure.