Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying ...
Attackers stole a long-lived npm token from the lead axios maintainer and published two poisoned versions that drop a ...
Security teams are grappling with a major supply chain attack on Axios, a popular JavaScript library with over 100 million ...
Axios, a widely used JavaScript HTTP client, was briefly distributed through npm in two malicious versions after a maintainer ...
Researchers say they’ve discovered a supply-chain attack flooding repositories with malicious packages that contain invisible ...
Threat actors have started exploiting CVE-2025-59528, a critical Flowise vulnerability leading to remote code execution.
Maintainer Jordan Harband writes on Bluesky that attackers had taken over the account of another project manager. Versions 3.3.1 and 5.0.0 of the package are affected. Both versions were apparently ...
28d
ThreatDown Uncovers First Cyber Attack Abusing Deno JavaScript Runtime for Fileless Malware Delivery
ThreatDown, the corporate business unit of Malwarebytes, today published research documenting what researchers believe to be ...
Some results have been hidden because they may be inaccessible to you
Show inaccessible results