Blog · 3 posts
#nhi
- News · Aug 21, 2026Poisoned Rust crates turned routine builds into credential theft for about 90 minutes each
Malicious versions of arrayref, internment, and append-only-vec shipped an infostealer targeting browser profiles and crypto wallets. crates.io pulled them within two hours, but lockfiles and registry caches keep them around.
- News · Aug 7, 2026Over 1,000 AI-named npm typosquats deliver a cross-platform dropper
OpenSourceMalware and Sonatype tracked Flooding Dropper, a campaign of AI-generated typosquat package names carrying WEL1DROPPER, which fetches Sliver on Linux and encrypted payloads on Windows and macOS.
- News · Aug 5, 2026GitGuardian found 4,576 leaked n8n tokens, and a third of reachable instances accepted them
Exposed n8n API tokens in public GitHub commits gave researchers read access to workflows, stored credentials, and data tables, plus a path to exfiltrate the raw secrets of every connected service.