NPM package ‘is’ with 2.8M weekly downloads infected devs with malware

stapp · Jul 23, 2025 at 12:59 PM

The popular NPM package 'is' has been compromised in a supply chain attack that injected backdoor malware, giving attackers full access to compromised devices.
This occurred after maintainer accounts were hijacked via phishing, followed by unauthorized owner changes that went unnoticed for several hours, potentially compromising many developers who downloaded the new releases.
Click to expand...

https://www.bleepingcomputer.com/ne...-weekly-downloads-infected-devs-with-malware/

Log in or Sign up

NPM package ‘is’ with 2.8M weekly downloads infected devs with malware

stapp Global Moderator

Log in or Sign up

NPM package ‘is’ with 2.8M weekly downloads infected devs with malware

stapp Global Moderator

Useful Searches