OOliver Zehentleitner·May 5The PyPI Package Was Clean. That Was the Problem.A near-identical clone of my Binance WebSocket library had no payload — but it spoofed identity, shadowed the import path, linked to a 404 repo, and came from the same account as pybotnet.13 min read·blog.technopathy.club
VVũ Nhật Lâm·Apr 29Trojanized Google Antigravity: When the Real Installer Is the Attacker's Best WeaponExecutive Summary On April 21, 2026, Malwarebytes documented a campaign distributing an infostealer disguised as the Google Antigravity installer — an AI coding tool launched in November 2025 that qui18 min read·blog.fiscybersec.com
SShak·Sep 18, 2025Poisoned Packages: Auditing the NPM Supply ChainNavigating the rise of self-replicating worms and credential theft in the open-source world3 min read·cyber365.hashnode.dev
SShak·Aug 8, 2025Malicious IDE Extensions: How Attackers Are Weaponizing Developer MarketplacesAttackers are weaponizing developer marketplaces with malicious IDE extensions. Learn how to identify compromised plugins and protect your development9 min read·cyber365.hashnode.dev
HHong·Jun 2, 2025npm's Security Dilemma: How Malicious Packages Exploit Openness and the Path ForwardThe discovery of malicious npm packages like xlsx-to-json-lh—a six-year-old typosquatting artifact mimicking the legitimate xlsx-to-json-lc—alongside broader campaigns involving 60+ packages, underscores systemic vulnerabilities in npm's security mod...3 min read·saysomething.hashnode.dev
