Another npm supply chain worm hits dev environments
· Source: theregister.com
In short
A new self-propagating npm supply-chain worm is compromising multiple packages tied to Namastex Labs, an agentic AI company, stealing credentials, tokens, and sensitive data from developer environments. The malware shares significant overlap with the CanisterWorm-style attacks attributed to TeamPCP, including the use of canister-backed infrastructure and install-time execution. The incident highlights the escalating threat to open source software supply chains, particularly targeting specialized developer workflows.
Read Original Article — Read the full article on the publisher’s site.
Tags: supply chain, malware, npm, cybersecurity, open source, credential theft