Published on August 24, 2025

Learn how GitLab detected a supply chain attack targeting Go developers through fake MongoDB drivers that deploy persistent backdoor malware.

A new supply chain malware attack is targeting the npm and PyPI ecosystems, putting millions of users at risk. This attack aims to compromise software packages distributed through these platforms, potentially affecting millions of users who rely on these ecosystems for their development projects. The technical details of the attack are not specified, but the impact is significant due to the widespread use of npm and PyPI in the developer community.

The cryptocurrency and blockchain development ecosystem is facing an unprecedented surge in sophisticated malware campaigns targeting the open source supply

New research from Checkmarx Zero highlights a malicious software campaign targeting Python and NPM users on Windows and Linux. The campaign uses typosquatting techniques, mimicking legitimate software names to trick users into downloading harmful packages. This cross-ecosystem attack is a rare tactic, aiming to steal sensitive data and maintain long-term system access.

A malicious Python package targeting Discord developers with remote access trojan (RAT) malware was spotted on the Python Package Index (PyPI) after more than three years.

Published on April 11, 2025

Published on April 15, 2025