Researchers flagged a typosquatting campaign, tracked as StubMaker, that planted sixteen malicious packages on RubyGems to deliver a Windows information stealer. The packages imitate popular Ruby dependencies with clumsy misspellings, betting that a developer will mistype a name during installation. Once installed, the malware harvests browser credentials, cryptocurrency wallets and seed phrases, and Telegram data from the developer's machine. The campaign's name refers to its trick of faking a build toolchain so a malicious install looks like a routine one. It is the latest reminder that open-source package registries remain an easy delivery route for stealers aimed at developers.
Researchers at Wordfence found that attackers compromised the upstream infrastructure of BdThemes, a popular WordPress plugin vendor, and poisoned a remote JSON feed that its plugins fetch to show promotional banners in the admin dashboard. Because the malicious code lives in that feed rather than in the plugin source, no plugin update was needed and nothing changed on disk. The injected script runs in every logged-in administrator's browser, creates hidden rogue admin accounts through the site's own interface, and installs a fake plugin containing a web shell for persistence. Seven plugins including Element Pack and Prime Slider were affected, and the flaw sat unnoticed for about five months.
Manifold Security found 77 malicious extensions on Open VSX, the open marketplace that editors like VSCodium, Cursor, and Windsurf pull extensions from, impersonating legitimate developer tools. Detected between July 26 and August 1, all 77 were linked through a shared exfiltration domain and common code. Fifty-eight sent only basic system information, while the other 19 performed deeper reconnaissance, exfiltrating developer, Git repository, and continuous integration metadata. Manifold found no access to source code, credentials, tokens, or SSH material and did not determine the campaign's goal. The extensions were pulled from Open VSX by August 3, but must still be removed manually from affected machines.
Researchers at Socket found 18 malicious npm packages that deliver a cross-platform remote access trojan to users of Alibaba developer tools, splitting the attack across many packages so each looks harmless on its own. Ten lure packages with no real function depend on a bridge package, which pulls in loaders that fetch a rule-engine configuration from GitHub and use it to run OS-specific payloads from a server disguised as Alibaba infrastructure. On Windows it even replaces a legitimate Alibaba security app with a trojanized copy. The final trojan can steal data, run commands, and move laterally, and the campaign stayed hidden for about three months.
Attackers compromised a widely used tracking script from advertising firm Adform, turning it into a browser-side tool that rewrites cryptocurrency wallet addresses. The malicious code was appended in obfuscated form to Adform's trackpoint-async.js library, served from the company's own infrastructure, so any site loading it ran the altered script in visitors' browsers. It swapped Bitcoin, Ethereum, and Tron addresses both in the clipboard and in form fields, redirecting transfers to the attacker. Adform detected and removed the code on July 27 and says it did not install software or persist after a page closed, but cached copies may linger. It has not said how many page loads were affected.
The Arch Linux project temporarily disabled adoption of packages in its user repository, the AUR, after a wave of malicious takeovers of existing packages. Attackers seized packages through compromised maintainer accounts or by adopting orphaned ones, then shipped a Rust-based infostealer that grabs browser credentials, cryptocurrency wallets, password manager data, cloud and developer secrets, AI service API keys, and SSH keys. It also opens remote command execution over an encrypted Tor channel and spreads to other machines using stolen SSH keys. A researcher tracking the campaign claims more than 200 packages were hit, including some popular ones, though that list is not independently confirmed.
Amazon's threat intelligence team linked several major npm supply chain attacks to a North Korean group tracked as Sapphire Sleet, also known as BlueNoroff. The group compromised the small typo-crypto package in March 2025 as a test, then hijacked the hugely popular debug and chalk packages in September 2025, and axios in March 2026. The debug and chalk incident, which pushed a wallet-draining script into packages with billions of weekly downloads, reached roughly one in ten cloud environments within two hours. The attackers gained access by phishing package maintainers through lookalike npm domains, then published malicious versions that auto-installing projects pulled in.
Attackers published malicious versions of the @joyfill/components and @joyfill/layouts npm packages that run a remote access trojan as soon as the package is imported, not merely installed. Because the payload executes at import time, defenses that block install scripts, such as installing with scripts disabled, do not stop it. The malicious code sat only in the published tarballs with no matching source change, pointing to a registry or publishing pipeline compromise. Once loaded, it profiles the host, opens a remote-control channel, and can run shell commands, upload files, read the clipboard, and tamper with developer tools, using blockchain networks to resolve its next payload for resilience.
New research shows that application security scanners embedded in the software pipeline can themselves be attacked, because analyzing a repository is not always a read-only action. Many scanners execute code or process files in ways that can be forced to run attacker content when it is handled without isolation. For example, a tool that scans cloud configuration files against a folder of custom rules can be fed a rule that is actually a malicious program, which the scanner runs when it loads it. Since scanners often hold broad access to source, secrets, and build systems, a compromised one is a strong pivot point into the wider environment.
GitHub is adding a default three-day cooldown before Dependabot opens pull requests for new package versions, aimed at supply chain attacks where a poisoned release spreads through automated updates before anyone catches it. Security updates that answer a known advisory still ship immediately; only routine version updates wait. GitHub points to the September 2025 compromise of chalk, debug, and other packages, whose crypto-stealing versions were live for roughly two hours, and notes its advisory database logged more than 6,500 npm malware advisories in the year to May 2026, around eighteen a day. Most malicious releases are caught within hours, so a short delay filters out the majority.
TrustStrike Labs