PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Widespread npm Supply Chain Attack: Breaking Down Impact & Scope Across Debug, Chalk, and Beyond

wiz.io | incident | #supply-chain | #cryptocurrency | #npm | #social-engineering | #wiz-research | #debug | #chalk
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Wiz dissects the npm debug/chalk incident: releases live ~2 hours carried a wallet-hijacking browser interceptor into affected builds; telemetry quantifies ~99% prevalence and ~10% malware presence.
Published
Collected

Related coverage

incident · wiz.io
Shai-Hulud 2.0 Aftermath: Trends, Victimology and Impact
Wiz Research's Shai-Hulud 2.0 aftermath: infection trends including a December 1 spike of 200+ new repos in 12 hours, victimology, leaked-secret distribution and the community containment response.
incident · wiz.io
Shai-Hulud 2.0 Supply Chain Attack: 25K+ Repos Exposing Secrets
Wiz Research's first Shai-Hulud 2.0 report: ~700 trojanized npm packages (Zapier, ENS, PostHog, Postman), 25,000+ repos leaking stolen secrets, and a preinstall variant widening the blast radius.
incident · wiz.io
s1ngularity: supply chain attack leaks secrets on GitHub: everything you need to know
Wiz's initial analysis of s1ngularity: malicious Nx npm versions harvested wallets, tokens and SSH keys and abused local AI CLIs for recon; a second phase exposed 5,500+ private repositories.
blog · wiz.io
Snipping the Long Tail of Shai-Hulud 2.0
Wiz Research on Shai-Hulud 2.0's long tail: infections ran 100-200 repos/day, 90%+ via a zombie OpenVSX extension; a clean release cut it to a handful, while leaked secrets remain unrotated.
blog · wiz.io
Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware
Wiz details the Shai-Hulud npm worm — malicious releases harvested secrets with TruffleHog, dumped them to public GitHub repos and self-propagated via stolen npm tokens across 100+ packages.
research · projectdiscovery.io
Pwning AI labs and the model supply chain through their own employees
# Pwning AI labs and the model supply chain through their own employees Oct 14, 2026 · Dhiyaneshwaran, Roberto Nunes & Prince Chaddha In our last blog we backdoored an open model for under fifty...
Back