Mend.io Resources, Author at Mend

NPM Ecosystem Under Siege: Self-Propagating Malware Compromises 187 Packages in a Huge Supply Chain Attack

Tom Abai Sep 16, 2025

Malicious Packages

A major NPM breach exposed 187 packages.

NPM Supply Chain Attack: Sophisticated Multi-Chain Cryptocurrency Drainer Infiltrates Popular Packages

Tom Abai Sep 8, 2025

Malicious Packages

A sophisticated npm supply chain attack compromised popular packages

Fake VS Code Extension on npm Spreads Multi-Stage Malware

Tom Abai Feb 6, 2025

Malicious Packages

Learn about a fake VS-code extension on npm—truffelvscode—typosquatting the popular truffle for VS-code extension.

- CVE Critical race condition in Apache Tomcat blog

CVE-2024-50379: A Critical Race Condition in Apache Tomcat

Tom Abai Dec 19, 2024

Malicious Packages

An Apache Tomcat web server vulnerability has been published, exposing the platform to remote code execution through a race condition failure.

- Solana Supply Chain Security Blog graphic

The @Solana/web3.js Incident: Another Wake-Up Call for Supply Chain Security

Tom Abai Dec 5, 2024

Malicious Packages

This post covers the attack flow, how it happened, and the importance of supply chain security.

More than 100K sites impacted by Polyfill supply chain attack

Tom Abai Jul 1, 2024

Malicious Packages

The new Chinese owner tampers with the code of cdn.polyfill.io to inject malware targeting mobile devices.

- shrinking security debt with dependency management white paper

Critical Backdoor Found in XZ Utils (CVE-2024-3094) Enables SSH Compromise 1

Dor Hayun, Tom Abai Mar 31, 2024

Malicious Packages

Discover how CVE-2024-3094 affects XZ Utils and enables SSH compromise. Get insights on detection, mitigation, and system security.

Over 100 Malicious Packages Target Popular ML PyPi Libraries

Tom Abai Mar 28, 2024

Malicious Packages

Discover the latest security threat as over 100 malicious packages target popular ML PyPi libraries. Learn about the attack methods.

- 5 Tools for Managing Dependency Updates

What is LDAP Injection? Types, Examples and How to Prevent It

Tom Abai Mar 21, 2024

Developer

Learn what LDAP Injection is, its types, examples, and how to prevent it. Secure your applications against LDAP attacks.

There’s a New Stealer Variant in Town, and It’s Using Electron to Stay Fully Undetected

Tom Abai Aug 10, 2023

Malicious Packages

Discover the latest threat in town - a new info-stealer variant using Electron to remain undetected. Learn about its attack flow.

- unseen risks of open source dependencies case of an abandoned name e1685538190274

The Unseen Risks of Open Source Dependencies: The Case of an Abandoned Name

Tamir Ben Ari, Tom Abai May 31, 2023

Dependency Updates

Mend.io research discovered a threat actor takeover of the name ‘gemnasium-gitlab-service', a retired Ruby gem with two million+ downloads.

Deceptive ‘Vibranced’ npm Package Discovered Masquerading as Popular ‘Colors’ Package

Tom Abai Apr 17, 2023

Malicious Packages

Discover the threat of the 'Vibranced' npm package masquerading as 'Colors'. Learn about its stages of execution, obfuscation techniques.

Mend.io Resources

Subscribe to our Newsletter