Phylum Research

Update to November’s Crypto-Themed npm Attack

Phylum Research

Back in November, we published a write-up about a collection of npm packages involved in a complex attack chain. These packages, once installed, would download a remote file, decrypt it, execute an exported function from it,

Phylum Research Team Jan 5, 2024 7 min read

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

SCA or public databases

82%

of Phylum’s findings are not found by
SCA or reported to public databases

Other curation tools

70%

of Phylum’s findings are not found by
other curation tools

Other software supply chain companies

60%

of Phylum’s findings are not found by
other software supply chain companies

Ledger npm Repo Breached in Spear Phishing Attack

Background Today’s security breach at Ledger, a leader in cryptocurrency hardware wallets, has raised significant alarms in the digital assets community. The breach was...

Phylum Research Team Dec 14, 2023 2 min read

Encrypted npm Packages Found Targeting Major Financial Institution

Determining the intent behind a package publication is notoriously difficult. Is it a legitimate threat actor or a security researcher? We can rarely make this...

Phylum Research Team Dec 6, 2023 11 min read

Crypto-Themed npm Packages Found Delivering Stealthy Malware

On October 30, 2023 Phylum’s automated risk detection platform alerted us to a strange publication to npm called puma-com. Upon investigation, we found a...

Phylum Research Team Nov 4, 2023 9 min read

Dozens of npm Packages Caught Attempting to Deploy Reverse Shell

On October 27, Phylum’s automated risk detection platform began alerting us to a series of suspicious publications on npm. Over the course of the...

Phylum Research Team Nov 2, 2023 8 min read

Phylum Research

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

Subscribe to our research