CRITICAL

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

The Hacker News • Jul 29, 2026

HIGH

Compromised jscrambler 8.14.0 npm Release Drops Rust Infostealer During Install

The Hacker News • Jul 11, 2026

MEDIUM

AI-Generated npm Malware Leaks Its Own GitHub Token

Infosecurity Magazine • May 29, 2026

HIGH

Shai-Hulud copycat worm infects yet another npm package

The Register Security • May 18, 2026

HIGH

[NEU] [hoch] Bitwarden CLI (npm): Kompromittiertes Paket ermöglicht den Diebstahl von Anmeldedaten und die Exfiltration von Informationen

BSI Germany • May 04, 2026

HIGH

Official SAP npm packages compromised to steal credentials

BleepingComputer • Apr 29, 2026

HIGH

Bitwarden CLI Compromised in Ongoing Checkmarx Supply Chain ...

Reddit r/netsec • Apr 23, 2026

MEDIUM

One Uppercase Letter Breaks Every Nuxt App

Reddit r/netsec • Apr 13, 2026

HIGH

Supply chain blast: Top npm package backdoored to drop dirty RAT on dev machines

The Register Security • Mar 31, 2026

HIGH

Devs looking for OpenClaw get served a GhostClaw RAT

CSO Online • Mar 10, 2026