Phylum Research

Large Typosquat Campaign Targeting React and Angular

Phylum Research

Phylum is tracking a large typosquat campaign targeting the npm ecosystem. A user is currently publishing many typosquat packages masquerading as react and angular. As of this writing, 125 packages have been released in what appears

Phylum Research Team Sep 26, 2023 9 min read

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

SCA or public databases

82%

of Phylum’s findings are not found by
SCA or reported to public databases

Other curation tools

70%

of Phylum’s findings are not found by
other curation tools

Other software supply chain companies

60%

of Phylum’s findings are not found by
other software supply chain companies

Nascent Malware Campaign Targets npm, PyPI, and RubyGems Developers

⚠️September 5, 2023: This appears to be an ongoing campaign with additional packages published. The package timeline table has been updated to reflect this. Phylum...

Phylum Research Team Sep 4, 2023 7 min read

Dormant npm Package Update Targets Ethereum Private Keys

On the afternoon of September 1, 2023 Phylum's automated risk detection platform flagged two new publications of the https://app.phylum.io/package/...

Phylum Research Team Sep 2, 2023 4 min read

Cryptocurrency Miner Masquerading as GCC Compiler Found in NPM Package

The Phylum Research Team has identified several packages shipping cryptominers masquerading as legitimate compilers....

Phylum Research Team Aug 30, 2023 4 min read

NPM Package Masquerading as Email Validator Contains C2 and Sophisticated Data Exfiltration

On the morning of August 24, Phylum's automated risk detection system identified a suspicious package published to npm called “emails-helper." A deeper...

Phylum Research Team Aug 25, 2023 13 min read

Phylum Research

Phylum Blocks Software Supply Chain Security Attacks

Phylum identifies malicious or risky open-source packages before they enter the software supply chain.

Subscribe to our research