Latest cybersecurity reporting from selected sources.

Shai-Hulud worm exploited exactly this. Better late than never, says everyone except the malware authors

As if there weren't enough package poisonings to worry about

Miasma worm shapeshifts, but cloud secret-scouting remains the goal

Shai-Hulud worm exploited GitHub Actions misconfiguration to poison shared cache, now project weighing nuclear option on unsolicited contributions

Where it’s been well and truly forked, seemingly without Microsoft’s code locker noticing

Trojanized npm packages spread new variant that executes in pre-install phase, hitting thousands within days A self-propagating malware targeting node package managers (npm) is back for a second round, according to Wiz researchers who say that more than 25,000 developers had their secrets compromised within three days.…