Off-topic for aiqbench

This story was gathered from a source we follow but falls outside AI and quantum coverage, so there is no aiqbench take for it.

Popular npm Package With 150K+ Weekly Downloads Hit by Credential-Stealing Supply-Chain Worm

Cybersecurity NewsAugust 31, 20264 min read

A widely used npm package has become a credential-stealing delivery channel after attackers planted a self-spreading Shai-Hulud payload in its releases. The affected @7nohe/openapi-react-query-codegen package, which generates TanStack Query code, receives more than 150,000 weekly downloads. The malicious releases can run while a developer installs dependencies or when npm processes a specially crafted build configuration file. That […] The post Popular npm Package With 150K+ Weekly Downloads Hit by Credential-Stealing Supply-Chain Worm appeared first on Cyber Security News.

A widely used npm package has become a credential-stealing delivery channel after attackers planted a self-spreading Shai-Hulud payload in its releases. The affected @7nohe/openapi-react-query-codegen package, which generates TanStack Query code, receives more than 150,000 weekly downloads. The malicious releases can run while a developer installs dependencies or when npm processes a specially crafted build configuration file. That gives the malware an opening on workstations and automated build runners, where publishing, cloud, and source-code credentials are often available.…

Excerpt shown under the publisher's RSS terms · 77 words · full text and figures are on the publisher's site

Read at Cybersecurity News ↗Ask about this article