Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions, ultimately delivering a 77…
Seven malicious npm packages impersonating Vite's official @vitejs/* namespace were published between June 29 and July 3, delivering a remote access trojan via blockchain-based command-and-control inf…
Major cryptocurrencies fell 7-10% over the week as investor capital rotated from crypto into AI-related equities, with Dogecoin and Hyperliquid's HYPE token leading losses. The selloff was exacerbated…
A supply chain attack targeting the open-source tool Understand-Anything (57,000+ GitHub stars) hid an obfuscated payload in `homepage/astro.config.mjs` via pull request #206, which executes automatic…