Simon Willison on javascript
755 posts tagged ‘javascript’.
Supply Chain Attack on Axios Pulls Malicious Dependency from...
socket.devA supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHu...
Supply chain attacks in the AI era: the state of open source in 2026
In 18 months, npm, PyPI, RubyGems, Maven and Crates have all shipped malware. AI is accelerating both sides of the playbook. A tour of what's happening, with the defensive baseline at the end.
Post Mortem: axios npm supply chain compromise · Issue #10636 · axios/axios
Post Mortem: axios npm supply chain compromise Date: March 31, 2026 Author: Jason Saayman Status: Remediation in progress On March 31, 2026, two malicious versions of axios (1.14.1 and 0.30.4) were...
Google links axios supply chain attack to North Korean group
Google Threat Intelligence Group (GTIG) joined several other researchers in attributing the attack to a North Korean threat actor they call UNC1069. SentinelOne found the same group using macOS-based malware in attacks dating back to 2023.
Axios Supply Chain Attack Pushes Cross-Platform RAT via Compromised npm Account
Axios 1.14.1 and 0.30.4 injected malicious plain-crypto-js@4.2.1 after npm compromise on March 31, 2026, deploying cross-platform RAT malware.
Cooldown periods for package updates
Personal site of Marek Šuppa — writing, teaching, and learning.
» north korean hacker group UNC1069 using social engineering to get access: axios npm for nodejs: software minimalism please and another javascript security problem (this time social engineered supply chain attack)
Why keep all your results to yourself? - Blog with howtos and public free software and hardware OpenSource searchable knowledgebase about Linux and OpenSource - with a touch security, politics and philosophy.
Why “Trusted Publishing” Can’t Save Us from Social Engineering
Unmasking the risky illusion of npm's "trusted publishing" amidst recent cyber attacks.
Simon Willison on security
602 posts tagged ‘security’.
[tl;dr sec] #322 - GitHub's Supply Chain Roadmap, Scaling Vulnerability Management with AI, Finding Vulnerabilities Across Repos
GitHub's plan to harden GitHub Actions and supply chain security, automating and scaling SAST and SCA vuln management, OSS tool that uses AI agents to reason about vulns across repos