Packages
Every advisory and malicious release affecting an open source package on npm, PyPI, Go, Maven, crates.io, NuGet, RubyGems, Packagist or Hex, newest first. See the worst packages this week, or check your lockfile.
- SZB-5ab74d9eedEthersphere's bee-js and Swarm Desktop releases reported to carry wallet-stealing malwarenpm · @ethersphere/bee-js
- SZB-9fb3d806b5CERT-In flags backdoored ARTEX exposing 62 consoles to root accessARTEX Docker images
- SZB-f4b7ff866cPlerdy SEO Tracker reportedly used in APT29-linked iOS and Android watering hole campaignPlerdy SEO Tracker
- SZB-61849a44e4OPSSHIELD says attacker hijacked cPGuard update channel to backdoor Linux serversOPSSHIELD · cPGuard
- SZB-7a8b5fe3b6Google says Videostrong backdoored Android TV boxes in 1.3M-device botnetVideostrong · Android TV set-top boxes
- SZB-7b2beadb7bMalicious Claude Code extension distributed in Cursor supply chain attackCursor · Claude Code-branded extension