中文 English Français Русский Español العربية

Targeted npm dependency confusion attack caught red-handed

Snyk Blog2022-04-30 09:360 views

Once in a while we encounter a truly malicious package that has a purpose, means, and is production-ready — this is a story about one found in npm: gxm-reference-web-auth-server.

Source：https://snyk.io/blog/npm-dependency-confusion-attack-gxm-reference/

My favorites

PreviousSnyk and StackHawk form strategic alliance to equip app teams with modern, developer-first security testing NextC++ in the wild: Which industries use C++?

Copilot Fusion Takes Local Models, and the Offline Boundary Is Somewhere Else

GitHub published an experimental preview on October 28, 2026 that lets Copilot Fusion add eligible local models to its s

0dev.to AI

A CTO Checklist for Evaluating AI Features Before Production Release

An AI feature that works during a product demonstration is not necessarily ready for production. It may generate inaccur

0dev.to AI

Humanoid Robot Demo Makes the Case for Keeping the Human Form

Humanoid Robot Demo Makes the Case for Keeping the Human Form A new demonstration video of a humanoid robot has reignite

0dev.to AI

Supabase anon key vs service role key: what each one opens

TL;DR. The anon key, now called the publishable key, is meant to be public. It maps to the anon or authenticated role, a

0dev.to Security

After the eMudhra CA compromise: audit your own TLS stack in 30 minutes

On 17 October 2026 a researcher told the root programs that the private keys of eight eMudhra intermediate certificate a

0dev.to Security

Exposed Building Automation Services: Bavaria and DACH

On 02.11.2026 I used Shodan to measure how much building automation in Germany is directly reachable from the internet.

0dev.to Security

Targeted npm dependency confusion attack caught red-handed

Related posts

Copilot Fusion Takes Local Models, and the Offline Boundary Is Somewhere Else

A CTO Checklist for Evaluating AI Features Before Production Release

Humanoid Robot Demo Makes the Case for Keeping the Human Form

Supabase anon key vs service role key: what each one opens

After the eMudhra CA compromise: audit your own TLS stack in 30 minutes

Exposed Building Automation Services: Bavaria and DACH