AIThe Hacker Newsabout 3 hours ago
npm Worm Poisons Hundreds of Packages
1 min read
A credential-stealing npm worm spread from [email protected] into hundreds of packages on August 4, 2026. SafeDep verified 353 poisoned versions across 79 package names; Aikido reported 868 packages across 1,381 versions. The malware harvests credentials and plants Claude Code and VS Code hooks.
Level
Hype check
Tap to vote and see what everyone thinks.
In this storyAnthropic
Summary by ByteBrief
