Malicious Packages

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install

Tom Abai Mar 31, 2026

Malicious Packages

See how the attack works, what to look for, and how to remediate.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - Blog cover TEAM PCP part 3

Famous Telnyx Pypi Package compromised by TeamPCP

Tom Abai Mar 27, 2026

Malicious Packages

See how the attack works, what to look for, and how to remediate.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - Blog cover TEAM PCP attack V2

TeamPCP Supply Chain Attack Part 2: LiteLLM PyPI Credential Stealer

Tom Abai Mar 24, 2026

Malicious Packages

Check and fix your install for the new LiteLLM PyPI compromise.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - Blog cover CanisterWorm

CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive

Tom Abai Mar 21, 2026

Malicious Packages

Deep dive into the self-spreading CanisterWorm.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - Blog cover Mend Main Blues 1

NPM Ecosystem Under Siege: Self-Propagating Malware Compromises 187 Packages in a Huge Supply Chain Attack

Tom Abai Sep 16, 2025

Malicious Packages

A major NPM breach exposed 187 packages.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - npm supply chain attack blog

NPM Supply Chain Attack: Sophisticated Multi-Chain Cryptocurrency Drainer Infiltrates Popular Packages

Tom Abai Sep 8, 2025

Malicious Packages

A sophisticated npm supply chain attack compromised popular packages

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - truffelvscode blog post

Fake VS Code Extension on npm Spreads Multi-Stage Malware

Tom Abai Feb 6, 2025

Malicious Packages

Learn about a fake VS-code extension on npm—truffelvscode—typosquatting the popular truffle for VS-code extension.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - CVE Critical race condition in Apache Tomcat blog

CVE-2024-50379: A Critical Race Condition in Apache Tomcat

Tom Abai Dec 19, 2024

Malicious Packages

An Apache Tomcat web server vulnerability has been published, exposing the platform to remote code execution through a race condition failure.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - Solana Supply Chain Security Blog graphic

The @Solana/web3.js Incident: Another Wake-Up Call for Supply Chain Security

Tom Abai Dec 5, 2024

Malicious Packages

This post covers the attack flow, how it happened, and the importance of supply chain security.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - polyfill supply chain attack post

More than 100K sites impacted by Polyfill supply chain attack

Tom Abai Jul 1, 2024

Malicious Packages

The new Chinese owner tampers with the code of cdn.polyfill.io to inject malware targeting mobile devices.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - blog 2 1

Over 100 Malicious Packages Target Popular ML PyPi Libraries

Tom Abai Mar 28, 2024

Malicious Packages

Discover the latest security threat as over 100 malicious packages target popular ML PyPi libraries. Learn about the attack methods.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - what new security threats arise from the boom in ai and llms

What New Security Threats Arise from The Boom in AI and LLMs?

Maciej Mensfeld Nov 15, 2023

AI Models Risk

Explore the security threats arising from the boom in AI and LLMs, including data privacy, misinformation, and resource exhaustion.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - what role should dependency management play as the regulation of the software supply chain escalates

What Role Should Dependency Management Play as the Regulation of the Software Supply Chain Escalates?

Tiffany Jennings Sep 26, 2023

Dependency Updates

Discover the importance of dependency management in securing the software supply chain as regulations escalate.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - eight considerations for thwarting malicious packages

8 Considerations for Thwarting Malicious Packages

Rhys Arkins Aug 29, 2023

Malicious Packages

Learn how to protect your code from malicious packages with these eight considerations. Stay ahead of supply chain security threats.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - what you can do to stop software supply chain attacks post

What You Can Do to Stop Software Supply Chain Attacks

Jeff Martin Aug 24, 2023

Software Supply Chain

Learn how to stop software supply chain attacks with SBOMs, best practices, and prioritizing known vulnerabilities. Protect your software.

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install - theres a new stealer variant in town and its using electron to stay fully undetected

There’s a New Stealer Variant in Town, and It’s Using Electron to Stay Fully Undetected

Tom Abai Aug 10, 2023

Malicious Packages

Discover the latest threat in town - a new info-stealer variant using Electron to remain undetected. Learn about its attack flow.

Mend.io Malicious Packages

Products

Solutions

Resources

Company

Compare

Developer Tools

AI Security & Compliance Assessment