npm supply chain attack

New npm Supply Chain Attack: Keyv & Mini Shai-Hulud Malware IoCs (Fix Guide)

If your software engineering or DevSecOps teams rely on automated continuous integration (CI/CD) pipelines to build NodeJS software, freeze your dependency deployment scripts immediately. Security threat analysts from Microsoft Security Intelligence and Socket Security have uncovered a devastating new npm supply chain attack that turns trusted software dependencies into automated credential execution pipelines. Here is ... Read more