1
NPM debug and chalk packages compromised
The popular packages debug and chalk on npm have been compromised with malicious code
Aikido Security Blog
Continuous, autonomous security that gets developers back to building.
- Popular posts
- 4
- Total points
- 2,278
- HN comments
- 1,111
- Rank
- #536 company
Visit aikido.dev → RSS feedOn Hacker News Sep 2025 – Aug 2026
2
Shai Hulud launches second supply-chain attack
The threat actor behind “Shai Hulud 2.0” launched a new malware campaign compromising the supply chain of Zapier, ENS Domains and more — exposing secrets, injecting malicious code, and enabling widespread developer-environment takeover.
3
Glassworm is back: A new wave of invisible Unicode attacks hits repositories
The Glassworm supply chain attack is back. Researchers uncovered malware hidden in invisible Unicode characters across 150+ GitHub repositories, plus npm packages and VS Code extensions.
4
Keyv and friends compromised in active Shai-Hulud supply chain attack
Mini Shai-Hulud malware was injected into keyv and eight related npm packages on August 4, 2026 after an attacker compromised the maintainer's GitHub account