#softwaresupplychainsecurity

· 3mo ago

#JScrambler shares a transparent postmortem on how attackers used a stolen #npm publishing token to ship #malware via its official npm package. A must-read for anyone serious about software supply chain security: #SoftwareSupplyChainSecurity 👇

jscrambler.com

Security Incident Postmortem

July 11, 2026: an attacker used a stolen npm token to publish malicious versions of the Jscrambler package. We caught the security incident.

Sam Stepanyan

🐘 @securestep9@infosec.exchange

· 3mo ago

#NPM: A compromised release of the popular #JScrambler npm package introduced hidden #malware binaries that execute automatically during npm install, exposing users to a supply chain attack before any application code runs: #SoftwareSupplyChainSecurity 👇

socket.dev

Sam Stepanyan

🐘 @securestep9@infosec.exchange

· 4mo ago

#NPM: two hijacked npm packages:

html-to-gutenberg
fetch-page-assets and a cluster of Go packages use VS Code Tasks to deploy #Python Infostealer #malware: #SoftwareSupplyChainSecurity 👇 https://thehackernews.com/2026/06/hijacked-npm-and-go-packages-use-vs.html

thehackernews.com

Hijacked npm and Go Packages Use VS Code Tasks to Deploy Python Infostealer

You've seen all posts