SourceCodeRed

I’ve identified an NPM spam campaign that has published over 86,000 malicious packages to the NPM registry, affecting at least eleven NPM users.

I travelled to Berlin in April to give a talk at the FIRST CTI conference.

Over the last two years, I’ve seen a concerning trend emerging in the JavaScript ecosystem: developers inadvertently (or sometimes intentionally) publishing NPM packages that expose sensitive data on the public NPM registry.

On Saturday, July 19, 2025, security researchers detected a new software supply chain attack.

How do packages get identified as malicious in the first place?

The software supply chain attacks on crypto and web3 continue unabated.

I’ve identified an NPM package deploying a new malware strain targeting the Exodus Wallet application.

Over the years, I’ve talked with a lot of developers and engineering teams—first during my DevSecOps consulting work, then while building SecureStack.

I’ve identified a malicious NPM package named “web3-parser” that targets web3 and crypto developers.

Our research has identified a package masquerading as the popular NPM package “Prettier” library.