AIThe New Stackabout 3 hours ago
npm attack weaponizes provenance attestations
3 min read
Security researchers disclosed an npm supply-chain attack affecting over 400 packages, including projects tied to Keyv and Cacheable. Attackers used stolen developer credentials to publish malicious versions containing a Mini Sha variant, targeting trusted publishing workflows.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
