News World That's Worth

Supply Chain Attack: 32 Red Hat npm Packages Infected with 'Shai-Hulud' Malware via GitHub Actions Exploit Cloud security firm Wiz has uncovered a sophisticated software supply chain attack targeting Red Hat . Investigators revealed that 32 malicious npm packages under Red Hat’s official @redhat-cloud-services scope had been compromised and injected with info-stealing malware. Red Hat’s security team has since moved swiftly to unpublish and remove nearly all affected packages from the public npm registry. The Payload: 'Shai-Hulud' Targets Cloud API Credentials The embedded malware family has been identified as Shai-Hulud , a notorious strain engineered specifically for credential harvesting. Once an infected npm package is bundled into a developer's project or an enterprise application, the malware activates to scan the local environment, targeting high-value cloud API keys, including access tokens for Google Cloud Platform (GCP) and Microsoft Azure . The Attack...

The Worm Returns: "Mini Shai-Hulud" Malware Targets Premier Tech Packages in Massive Supply Chain Attack Cybersecurity firm Socket has sounded the alarm after detecting a resurgence of the "Mini Shai-Hulud" malware across the npm and PyPI ecosystems. Named after the giant sandworms of Dune , this malware first gained notoriety in late 2025. Following a series of high-profile breaches in late April 2026 involving SAP, Intercom, and Lightning, the attackers have now set their sights on a new wave of essential developer tools. High-Profile Targets Identified The latest wave of infected packages includes critical software from several industry leaders: TanStack: Popular web development suite (npm) UiPath: Robotic Process Automation (npm) Mistral: Large Language Model (LLM) library (PyPI) Guardrails AI: AI safety framework (PyPI) OpenSearch: Search and analytics suite (npm) Squawk: Database linter (npm) Inside the Attack: Cache Poisoning on GitHub Actions This...

Axios Hit by Critical Supply Chain Attack: Malware Injected into 100M-Download Library Axios , one of the world's most popular HTTP clients with over 100 million weekly downloads , has fallen victim to a sophisticated supply chain attack. Threat actors successfully injected a Remote Access Trojan (RAT) into versions 1.14.1 and 0.30.4 . The malicious code remained active for approximately two and a half hours before being detected and removed. The Mechanism of Attack: Dependency Poisoning The attackers utilized a "Dependency Poisoning" technique. They first published a malicious package named plain-crypto-js and subsequently modified the Axios source code to include this package as a dependency. While Axios typically uses GitHub Actions for automated builds and publishing, these compromised versions were uploaded directly from a manual account associated with the email ifstap@proton.me . How the Malware Operates The primary Axios code did not contain the malware direct...