Breaking News: SSRF in Harbor Webhooks - Any User Can Reach the Server’s Cloud Credentials

Rethink cloud security in an AI-driven era. Watch our webinar with James Berthoty and Chris Lindsey

npm

PhantomSub Malicious campaign secretly adds users to WhatsApp spam channels (3)

September 28, 2026

PhantomSub: Malicious npm Campaign Secretly Adds Users to WhatsApp Spam Channels

Nir Zadok, Moshe Siman Tov Bustan, Vitalii Chepurko

Keyv and Cacheable A major new supply chain attack hits npm

August 4, 2026

A Massive Shai-Hulud Campaign Hits npm: +440 Packages Compromised, Over 2B Monthly Downloads

Moshe Siman Tov Bustan

July 14, 2026

AsyncAPI npm organization compromised, 2M weekly downloads affected

Moshe Siman Tov Bustan

Malware Slop npm’s polymarket kit Leaked Its Own Creator's Keys

July 12, 2026

Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials

Moshe Siman Tov Bustan

Injectivelabs npm Package Hijacked

July 9, 2026

Injectivelabs npm Package Hijacked, Impacting 87 Dependent Packages

Moshe Siman Tov Bustan

npm Is Fighting the Right War With the Wrong Weapons

June 30, 2026

npm Is Fighting the Right War With the Wrong Weapons

Moshe Siman Tov Bustan

easy day js Crypto Stealing Supply Chain Attack Hits npm

June 17, 2026

easy-day-js Supply Chain Attack Hits Mastra AI in npm

Moshe Siman Tov Bustan

Malware Slop 2 Malicious npm package leaks Its own bot’s Telegram key (3)

June 4, 2026

Malware-Slop 2: Malicious npm Package Leaks Its Own Bot’s Telegram Private Token

Moshe Siman Tov Bustan, Nir Zadok

Miasma Supply Chain Attack Is Back on npm, over ~600,000 Monthly Downloads Affected

June 4, 2026

600,000 Monthly Downloads Affected: Miasma Supply Chain Attack Is Back on npm

Moshe Siman Tov Bustan, Nir Zadok

IronWorm Supply Chain Malware Hits npm

June 3, 2026

IronWorm Supply Chain Malware Hits npm

Moshe Siman Tov Bustan

Subscribe to Our Newsletter

Stay updated with the latest SaaS insights, tips, and news delivered straight to your inbox.