Attackers Are Hunting High-Impact Node.js Maintainers in a C...

Since we published our initial analysis of the axios compromise, a deep dive into its hidden blast radius, and a report on the maintainer confirming it was social engineering, maintainers across the Node.js ecosystem have come out of the woodwork to report that they were targeted by the same social engineering campaign. The accounts now span some of the most widely depended-upon packages in the np

[efcl]

Node.jsの主要なnpmパッケージメンテナを標的としたソーシャルエンジニアリング攻撃キャンペーンについて。 Axiosの侵害と同じ攻撃グループが、Lodash/Fastify/dotenvなどのメンテナに対して、偽のミーティング招待を使って攻撃