Fake LinkedIn recruiters hide a backdoor that fires on npm install
A recruiter messages a software developer on LinkedIn about a lead-engineer job. She sends a GitHub project and asks him to look at a bug.
A bad code download steals every password the moment you install it. Red Hat tools are the target.
Hackers hid malware inside a batch of Red Hat npm packages, and it steals your logins the moment you install them.
Why you should never run an 'npx' command from a social post
A developer tool posted on X this week asks you to paste one line into your terminal, and that line uploads your private AI chats to a company's servers.