SafeDep (open-source supply-chain research)
safedep · B · candidate
Added 2026-10-29 (S3): first-hand analysis of npm, PyPI and RubyGems worms and malicious packages with dated living updates; primary of the testmetest worm entry of this run. The feed returns dated items on the direct transport and `extract` reads each post. Candidate: promote to active after 3 contributing runs.
Cited in 3 entries
Citation cadence
Citation days per ISO week (24 weeks of coverage span, total 3).
- testmetest: an npm worm in the Miasma and Shai-Hulud family now starts when an application imports the package, so install with --ignore-scripts no longer protects, and JFrog finds 42 third-party GitHub repositories already armed with its publisher2026-10-29
- AsyncAPI npm packages backdoored via a GitHub Actions pull_request_target token theft, delivering a multi-stage IPFS implant (M-RED-TEAM)2026-07-14
- Megalodon mass-poisons 5,561 GitHub repos in a 6-hour window; SysDiag + Optimize-Build workflows exfiltrate cloud credentials and OIDC tokens2026-05-23