Fake Roblox Xeno script launcher pushes infostealer, RAT malware

Fake Xeno Executor installers are infecting unsuspecting Roblox players with malware that provides remote access and steals ...
The Next Web

Upwind first to report malicious Keyv release that threatened thousands of JavaScript projects

Upwind identified a malicious release of keyv@6.0.0 that harvested AWS, GitHub, and npm credentials via a hidden preinstall script. With 154 million weekly downloads, the compromise had ecosystem-wide ...
CSOonline

NPM ecosystem hit with two new supply chain compromises

Attacks targeting developer ecosystems are increasing in frequency and sophistication, with Node.js developers firmly in this week’s crosshairs, as multiple npm packages belonging to the open-source ...
Dark Reading

Attackers Combo Up Evasion Tactics for BEC Phishing

Attackers are impersonating well-known companies to drop various remote access Trojans (RATs) and infostealers in a wide-scale phishing campaign designed for maximum evasion. The campaign highlights ...