Malicious Packages Blog: Threats & Research

NPM User Flooding Registry with Fake Font Packages

Tom Abai Dec 16, 2025

Malicious Packages

Analysis of an npm account flooding the registry with malformed font packages.

NPM User Flooding Registry with Fake Font Packages - Blog Zero day Shai hulud V2

Shai-Hulud: The Second Coming

Tom Abai Nov 24, 2025

Malicious Packages

See how the latest Shai-Hulud attack works.

NPM User Flooding Registry with Fake Font Packages - Blog cover Mend Main Blues 1

NPM Ecosystem Under Siege: Self-Propagating Malware Compromises 187 Packages in a Huge Supply Chain Attack

Tom Abai Sep 16, 2025

Malicious Packages

A major NPM breach exposed 187 packages.

NPM User Flooding Registry with Fake Font Packages - npm supply chain attack blog

NPM Supply Chain Attack: Sophisticated Multi-Chain Cryptocurrency Drainer Infiltrates Popular Packages

Tom Abai Sep 8, 2025

Malicious Packages

A sophisticated npm supply chain attack compromised popular packages

NPM User Flooding Registry with Fake Font Packages - truffelvscode blog post

Fake VS Code Extension on npm Spreads Multi-Stage Malware

Tom Abai Feb 6, 2025

Malicious Packages

Learn about a fake VS-code extension on npm—truffelvscode—typosquatting the popular truffle for VS-code extension.

NPM User Flooding Registry with Fake Font Packages - CVE Critical race condition in Apache Tomcat blog

CVE-2024-50379: A Critical Race Condition in Apache Tomcat

Tom Abai Dec 19, 2024

Malicious Packages

An Apache Tomcat web server vulnerability has been published, exposing the platform to remote code execution through a race condition failure.

NPM User Flooding Registry with Fake Font Packages - Solana Supply Chain Security Blog graphic

The @Solana/web3.js Incident: Another Wake-Up Call for Supply Chain Security

Tom Abai Dec 5, 2024

Malicious Packages

This post covers the attack flow, how it happened, and the importance of supply chain security.

NPM User Flooding Registry with Fake Font Packages - polyfill supply chain attack post

More than 100K sites impacted by Polyfill supply chain attack

Tom Abai Jul 1, 2024

Malicious Packages

The new Chinese owner tampers with the code of cdn.polyfill.io to inject malware targeting mobile devices.

NPM User Flooding Registry with Fake Font Packages - shrinking security debt with dependency management white paper

Critical Backdoor Found in XZ Utils (CVE-2024-3094) Enables SSH Compromise 1

Dor Hayun, Tom Abai Mar 31, 2024

Malicious Packages

Discover how CVE-2024-3094 affects XZ Utils and enables SSH compromise. Get insights on detection, mitigation, and system security.

NPM User Flooding Registry with Fake Font Packages - blog 2 1

Over 100 Malicious Packages Target Popular ML PyPi Libraries

Tom Abai Mar 28, 2024

Malicious Packages

Discover the latest security threat as over 100 malicious packages target popular ML PyPi libraries. Learn about the attack methods.

NPM User Flooding Registry with Fake Font Packages - eight considerations for thwarting malicious packages

8 Considerations for Thwarting Malicious Packages

Rhys Arkins Aug 29, 2023

Malicious Packages

Learn how to protect your code from malicious packages with these eight considerations. Stay ahead of supply chain security threats.

There’s a New Stealer Variant in Town, and It’s Using Electron to Stay Fully Undetected

Tom Abai Aug 10, 2023

Malicious Packages

Discover the latest threat in town - a new info-stealer variant using Electron to remain undetected. Learn about its attack flow.

NPM User Flooding Registry with Fake Font Packages - brandjacking

What Risks Do You Run from Brandjacking, and How Do You Overcome Them?

Tiffany Jennings Aug 1, 2023

Malicious Packages

Learn about the risks of brandjacking & how to overcome them with application security tools & practices. Protect your org from cyber threats.

NPM User Flooding Registry with Fake Font Packages - cybersecurity risks posed by typosquatting and how you can beat them

What Cybersecurity Risks Does Typosquatting Pose, and How Can You Beat Them?

Tiffany Jennings Jul 27, 2023

Malicious Packages

Find out what typosquatting is, why it is such a threat, and what you can do to stop it.

Understanding the Anatomy of a Malicious Package Attack

Jeff Martin Jun 13, 2023

Malicious Packages

Learn to protect your applications from malicious packages with our guide. Understand the anatomy of attacks and how to prevent them.

NPM User Flooding Registry with Fake Font Packages - unseen risks of open source dependencies case of an abandoned name e1685538190274

The Unseen Risks of Open Source Dependencies: The Case of an Abandoned Name

Tamir Ben Ari, Tom Abai May 31, 2023

Malicious Packages

Mend.io research discovered a threat actor takeover of the name ‘gemnasium-gitlab-service', a retired Ruby gem with two million+ downloads.

Mend.io Malicious Packages