Supply Chain Attacks

Image with text at center "sonatype-2026-003926, Mastra AI framework compromise"

easy-day-js Targets Mastra, Dependency Attacks Grow

| | dependencies, malicious code npm, Malware, Malware Analysis, npm, Security Research, Supply Chain Attacks
TL;DR On June 17, 2026, security researchers identified a software supply chain attack involving the npm package easy-day-js, a malicious package designed to impersonate the popular JavaScript date library dayjs. Sonatype is ...
2024 Sonatype Blog
Image with text "281 malicious package versions, Miasma Returns"

New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages

| | malicious code npm, Malware, Malware Analysis, npm, Security Research, Sonatype Guide, Supply Chain Attacks
TL;DR Sonatype Security Research is tracking a new Shai-Hulud Miasma wave with 281 malicious npm package versions that move beyond obvious preinstall and postinstall scripts in package.json. This variant abuses binding.gyp to ...
2024 Sonatype Blog
Image with text "Lazarus Group, Trust Abuse on npm" at center and a label of "breaking news" in the upper right-hand corner.

Lazarus Group’s Latest: Brandjacking Campaign on npm

| | malicious code npm, Malware, Malware Analysis, npm, Security Research, Sonatype Guide, Supply Chain Attacks
TL;DR Sonatype Security Research is tracking a Lazarus Group npm campaign using dozens of malicious packages to abuse developer trust and deliver follow-on payloads. The campaign goes beyond typosquatting, relying on brandjacking ...
2024 Sonatype Blog
Red Hat Cloud Services npm Packages Hijacked

Red Hat Cloud Services npm Packages Hijacked

| | malicious code npm, Malware, npm, red hat, Security Research, Sonatype Guide, Supply Chain Attacks
A new wave of malicious npm activity has been reported involving multiple packages in the legitimate @redhat-cloud-services namespace ...
2024 Sonatype Blog
TeamPCP Takes Cover by Releasing Source Code on GitHub, Spurs Copycats 

TeamPCP Takes Cover by Releasing Source Code on GitHub, Spurs Copycats 

| | copycat, Cybersecurity, Defense, exposed credentials, GitHub, Shai-Hulud, Supply Chain Attacks
Just a brief exposure of source code on GitHub by Shai-Hulud is enough to give TeamPCP plausible deniability and spark copycat campaigns ...
Security Boulevard
Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target

Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target

| | Malware, Malware Analysis, open-source malware, Security Research, sonatype intelligence, Supply Chain Attacks
Why bother hunting for a CVE when you can just publish malicious code straight into the software supply chain? That’s the story behind the latest wave of Shai-Hulud-related npm compromises, which recently ...
2024 Sonatype Blog
The Evolution of Open Source Malware: From Volume to Trust Abuse

The Evolution of Open Source Malware: From Volume to Trust Abuse

| | dependencies, developers, Events and Webinars, malware prevention, open-source malware, secure software supply chain, Supply Chain Attacks, Webinars
Open source malware is no longer just a numbers game. What was once largely a volume problem — thousands of malicious packages flooding public registries through typosquatting, brandjacking, and low-effort deception — ...
2024 Sonatype Blog
Image with a skull icon alongside text "CanisterSprawl: Self-propagating malware on npm"

Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

| | Malware, Malware Analysis, npm, open-source malware, PyPI, Sonatype Guide, Supply Chain Attacks
TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised ...
2024 Sonatype Blog
IBM, data, breaches,

Breaches Up, Number of Victims Down, Impact Stronger 

| | , AI literacy, AI‑powered attacks, breach costs passed to consumers, breach disclosure decline, breach preparedness, breach remediation costs, breach transparency., consumer impact, cryptography risks, data breach notifications, data breaches 2025, deepfakes, financial services breaches, fourth‑party risk, Identity Theft Resource Center, incident response speed, ITRC report, legal risk, previously compromised data (PCD), privacy impact, professional services targeted, quantum computing threat, Ransomware Trends, small business cyber risk, Supply Chain Attacks, third‑party breaches
The number of data breach victims may have dropped last year, but that’s only because bad actors are getting better at what they do, prioritizing quality over quantity.  ...
Security Boulevard
vulnerabilities, root cause, Microsoft Storm-1152 fake accounts CaaS

The Seam in Cybersecurity Defenses That Nation-States Keep Exploiting

| | Behavioral Monitoring, Cybersecurity Best Practices, cybersecurity gaps, detection and response, enterprise security, Incident Response, Malware Detection, Notepad++ breach, runtime behavior, runtime telemetry, Security Strategies, software-vulnerabilities, state-sponsored attacks, Supply Chain Attacks, threat actors, Vulnerability Management
The Notepad++ supply chain compromise is the latest proof that sophisticated adversaries are deliberately targeting the gap between two disciplines: Vulnerability management and detection and response.  ...
Security Boulevard
Load more