malware
Safeguard articles tagged "malware" — guides, analysis, and best practices for software supply chain and application security.
43 articles
"Fully Compromised": What 7,700 npm Malware Advisories Say, and What the Analysis Adds
GitHub's npm malware advisories tell you to treat the machine as fully compromised and rotate every secret. OSV's 2026 data: 7,700 npm records carry that paragraph, 2,018 carry nothing else, and 5,682 include an analysis of what the code did. Where they part ways, and a script to scope your response.
Malware Records List Versions, Not Packages: Why leakdeep 2.6.2 Scans Clean
Malware records usually list the exact versions someone analysed, and scanners match only those. 2026 OSV data for PyPI and npm, the leakdeep credential stealer whose version 2.6.2 isn't in its record, and a script that checks lockfiles by package name.
npm URL Dependencies: How Malware Keeps Its Payload Off the Registry, and the Settings That Stop It
Malicious npm packages hide payloads behind URL dependencies. How allow-remote and lockfiles stop them, which Node versions lack it, and a scanner.
Malicious Baileys Forks on npm: 240 Malware Records, and Why --ignore-scripts Doesn't Stop Them
Malicious Baileys forks use the bot's own WhatsApp session to follow channels. OSV data to 17 Oct, why npm defenses miss it, and a checker.
Fake Speech-AI Packages on PyPI: A Monero Miner That Prints Training Logs
19 PyPI packages posing as TTS and speech tools hid a Monero miner behind fake training logs and a Cloudflare tunnel. What they did and how to check.
Your Internal Package Registry Is the Only Control That Runs Before the Code Does
Most companies run one and treat it as a cache. It is the one place in the build that can refuse a package before an install script executes, which is the only point where prevention is still possible.
nullifAI: How Two Malicious Models Slipped Past Hugging Face's Scanner
ReversingLabs found two Hugging Face models that hid a reverse-shell payload from Picklescan by compressing pickle files with 7z instead of ZIP. Here's how the trick worked and why pickle-format models remain a code-execution risk.
Malicious npm packages targeting developers in 2025
A year-end look at 2025's npm supply chain attacks—chalk/debug phishing, the Shai-Hulud worm, and industrialized malware campaigns—and how to defend against them.
Malicious Code Detection: How to Catch Threats in Your Supply Chain
Malicious code detection is the practice of identifying deliberately harmful code in your dependencies, containers, and repositories before it runs. Here is how modern detection actually works.
Docker Hub malicious image report
Researchers estimate roughly 3% of public Docker Hub images carry malicious payloads. Here's what's inside them, how they spread, and how to defend your pipeline.
Docker Hub typosquatting of official images
Attackers are cloning popular Docker Official Images under lookalike names, tricking `docker pull` into fetching malware instead of trusted base images.
The Nx Attack Turned AI Coding Agents Into the Malware
In August 2025, attackers hijacked Nx's npm publish token and used Claude Code, Gemini CLI, and Amazon Q as the exfiltration engine — leaking 2,349 secrets.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.