23 Apr 2026
By Mary

InfoSec News Nuggets 04/23/2026

New npm supply-chain attack self-spreads to steal auth tokens Researchers say a new npm supply-chain campaign hit at least 16 packages tied to Namastex Labs, with malware designed to steal secrets like API keys, SSH keys, cloud and CI/CD credentials, browser-stored wallet data, and npm publishing tokens, then use those tokens to propagate into additional packages. The important wrinkle is that this isn’t just credential theft. It behaves like a supply-chain worm aimed at high-value…
Read More
03 Mar 2026
By Mary

InfoSec News Nuggets 03/03/2026

CISA Replaces Acting Director After a Bumbling Year on the Job The Trump administration has ousted Madhu Gottumukkala as acting director of the Cybersecurity and Infrastructure Security Agency, replacing him with Nick Andersen, the agency's former top cybersecurity official, after a turbulent tenure marked by reports of Gottumukkala uploading sensitive government documents to a public version of ChatGPT, failing a counterintelligence polygraph, and presiding over the departure of at least one-third of the agency's workforce…
Read More
28 May 2025
By Mary

InfoSec News Nuggets 5/28/2025

Dozens of malicious packages on NPM collect host and network data 60 packages have been discovered in the NPM index that attempt to collect sensitive host and network data and send it to a Discord webhook controlled by the threat actor. According to Socket’s Threat Research team, the packages were uploaded to the NPM repository starting May 12 from three publisher accounts. Each of the malicious packages contains a post-install script that automatically executes during ‘npm install’.…
Read More
21 Mar 2022
By Mary

InfoSec News Nuggets 03/21/2022

1 - The German BSI agency recommends replacing Kaspersky antivirus software The German Federal Office for Information Security agency, aka BSI, recommends consumers uninstall Kaspersky anti-virus software. The Agency warns the cybersecurity firm could be implicated in hacking attacks during the ongoing Russian invasion of Ukraine. According to §7 BSI law, the BSI warns against the use of Kaspersky Antivirus and recommends replacing it asap with defense solutions from other vendors. “The Federal Office for…
Read More
03 Feb 2022
By Mary

InfoSec News Nuggets 02/03/2022

Thousands of Malicious npm Packages Threaten Web Apps More than 1,300 malicious packages have been identified in the most oft-downloaded JavaScript package repository used by developers, npm, in the last six months — a rapid increase that showcases how npm has become a launchpad for a range of nefarious activities. New research from open-source security and management firm WhiteSource has discovered the disturbing increase in the delivery of malicious npm packages, which are used as building blocks for…
Read More
10 Jan 2022
By Mary

InfoSec News Nuggets 01/10/2022

GameStop reportedly has a whole unit working on NFTs and cryptocurrency Video game retailer and memestock darling GameStop is making a big bet on NFTs and cryptocurrency technology. According to a new report from The Wall Street Journal, the company has built up an over 20-person strong team working on an online marketplace for the virtual items, which could include cosmetic skins and in-game items. The company is said to be courting game developers and publishers to…
Read More