PyPI Ecosystems Archives

Researchers studying cybersecurity have found a new collection of harmful packages in npm and the Python Package Index (PyPI) repository that are connected to a phony recruitment effort that was planned by the Lazarus Group, which has ties to North Korea. In honor of the first package to be uploaded in the npm registry, the coordinated campaign has been nicknamed graphalgo. It is estimated to have been operational from May 2025. According to a report by Karlo Zanki, a researcher at ReversingLabs, developers are contacted through social media sites like Facebook and LinkedIn or through job postings on forums like Reddit. A well-planned narrative about a business engaged in blockchain and cryptocurrency exchanges is part of the campaign. Interestingly, bigmathutils, one of the dete...

Researchers studying cybersecurity have discovered a supply chain attack that uses more than a dozen GlueStack-related items to spread malware. According to Aikido Security, which told The Hacker News that these packages together account for about 1 million downloads every week, the virus was introduced by altering "lib/commonjs/index.js," which enables an attacker to execute shell commands, capture screenshots, and upload data to compromised computers. Numerous subsequent activities, such as mining bitcoin, stealing private data, and even stopping services, could be carried out using the unauthorized access. According to Aikido, the first package breach was discovered at 9:33 p.m. GMT on June 6, 2025. The affected versions and a list of the impacted packages read more about New ...

Tag: PyPI Ecosystems

Lazarus Campaign Plants Malicious Packages in npm and PyPI Ecosystems

New Supply Chain Malware Operation Hits npm and PyPI Ecosystems Targeting Millions Globally