DevHacker Noonabout 8 hours ago
Upwind First to Detect Deceptive npm Compromise
4 min read
Upwind Security first reported a deceptive npm compromise exploiting install scripts, not vulnerabilities. The keyv campaign drew about 154 million weekly downloads and scored 92 overall. Sixteen packages across two ecosystems were affected, targeting AWS credentials, GitHub tokens, npm registry credentials, and HashiCorp Vault tokens.
Level
Hype check
Tap to vote and see what everyone thinks.
Summary by ByteBrief
