TLDR Tech / IT
New npm supply-chain attack self-spreads to steal auth tokens
Researchers identified a malicious npm supply-chain attack targeting Namastex Labs packages. The worm-like malware steals developer credentials, API keys, and cryptocurrency wallets, then self-propagates by injecting malicious code into new package versions. It also targets PyPI, requiring immediate secret rotation and removal of compromised dependencies from CI/CD pipelines.
Read the full story