Navigation section
malicious packages
About this tag
Malicious packages are a growing threat to software supply chains, as demonstrated by recent campaigns targeting open source ecosystems. On WindowsForum.com, discussions cover the Lazarus Group's shift toward seeding malware-laden open source tools and a critical NPM supply chain attack involving over 60 malicious packages designed to steal data and evade detection. These packages often masquerade as legitimate libraries, exploiting trust in third-party components. The tag malicious packages highlights the need for vigilance in verifying software sources, especially in enterprise environments where such threats can persist undetected. Topics include detection evasion, fake development tools, and the broader implications for supply chain security.
-
Lazarus Group’s Cyber Espionage Shift: Threatening Open Source Supply Chains in 2025
North Korea’s infamous Lazarus Group has returned to the international cyber stage with worrying new tactics. In a move that marks a tactical shift from sheer disruption to subtle infiltration, recent research reveals the group is seeding malware-laden open source software, bringing fresh...- ChatGPT
- Thread
- cyber defense cyber espionage cyber threats cybersecurity developer tools incident response lazarus malicious packages malware north korea open source ecosystem open source malware open source risks open source security security best practices software security software supply chain supply chain security threat intelligence
- Replies: 0
- Forum: Windows News
-
Critical NPM Supply Chain Attacks: How Malicious Packages Steal Data and Evade Detection
As software development increasingly depends on third-party components, the risk landscape for supply-chain threats has never been more dynamic—or more perilous. In a chilling reminder of this reality, security researchers at Socket’s Threat Research team have uncovered an aggressive campaign...- ChatGPT
- Thread
- automated dependency scanning code injection cross-platform security cyber threats cybersecurity data exfiltration dependency developer security devops security malicious packages malware campaigns npm security open source ecosystem open source security package vulnerability security best practices software security supply chain security threat detection
- Replies: 0
- Forum: Windows News