The typosquatted “@acitons/artifact” package targeted GitHub’s CI/CD workflows, stealing tokens and publishing malicious artifacts under GitHub’s own name.

By Shweta Sharma

Nov 12, 2025 4 mins

CybercrimeDeveloperMalware

How GlassWorm wormed its way back into developers’ code — and what it says about open source security

Weeks after being declared eradicated, GlassWorm is again infesting open source extensions using the same invisible Unicode and blockchain C2 tricks.

By Taryn Plumb

Nov 10, 2025 6 mins

CybercrimeDevelopment ToolsMalware

Malicious npm packages contain Vidar infostealer

Researchers say the malware was in the repository for two weeks, advise precautions to defend against malicious packages.

By Howard Solomon

Nov 6, 2025 6 mins

CybercrimeDevelopment ToolsMalware

Self-propagating worm found in marketplaces for Visual Studio Code extensions

Treat this as an immediate security incident, CISOs advised; researchers say it’s one of the most sophisticated supply chain attacks they’ve seen, and it’s spreading.

By Howard Solomon

Oct 21, 2025 8 mins

CybercrimeDevelopment ToolsMalware

Threat actors are spreading malicious extensions via VS marketplaces

Report from Wiz also says developers are uploading extensions that include access tokens and other secrets.

By Howard Solomon

Oct 17, 2025 9 mins

CybercrimeDevelopment ToolsMalware

QR codes become the vehicle for malware in new technique

A newly-discovered malicious package with layers of obfuscation is disguised as a utility library, with malware essentially hiding in plain sight in embedded QR codes.

By Taryn Plumb

Sep 23, 2025 4 mins

Development ToolsMalwareVersion Control Systems

Google to add developer verification requirement for Android apps

Scheduled for rollout starting in September 2026, the program aims to restrict malware distribution by requiring developer verification for apps installed on Android devices.

By Paul Krill

Sep 2, 2025 2 mins

MalwareMobile DevelopmentMobile Security

Supply chain attack compromises NPM packages to spread backdoor malware

Phishing attacks on package maintainer accounts led to infected JavaScript type testing utilities.

By John E. Dunn

Jul 24, 2025 1 min

EngineerMalwareOpen Source

GitHub hit by a sophisticated malware campaign as ‘Banana Squad’ mimics popular repos

Attackers use typo-squatting, obfuscation, and fake accounts to slip Python-based malware into open-source projects, raising fresh alarms for OSS supply chain security.

By Shweta Sharma

Jun 20, 2025 1 min

EngineerMalwareSecurity

Malicious PyPI package targets Chimera users to steal AWS tokens, CI/CD secrets

“Chimera-sandbox-extensions” exploit highlights rising risks of open-source package abuse, prompting calls for stricter dependency controls and DGA malware detection.

By Shweta Sharma

Jun 17, 2025 1 min

EngineerMalwarePython