company
Security company that, with Socket, reported the April compromise of official SAP npm packages.
No evidence-backed relationships are recorded.
Three versions of MemTensor's MemOS Cloud plugin on npm and MemoryOS 2.0.34 on PyPI launch a Go stealer called sckit that reads the host environment and the user's prompt text, and the npm versions are still installable.
Reality
Aikido found the Graphalgo implant inside two Terraform providers and two Go modules. The Go build polls a hard-coded testnet contract every three seconds and keeps a Slack bot channel open as its second route.
Reality
Aikido spent 11.7 billion tokens rediscovering 32 fresh CVEs with ten models, three attempts each. The number that should move a scanning budget is the marginal cost of the second and third pass.
Reality
Compiling any project that resolved the poisoned crate on August 20 was enough to run a credential stealer. Wiz links the infrastructure to DPRK-attributed campaigns.
Reality
A dev.to post scanned the domains behind the top 5,000 npm packages and found 18 with registration or email-security anomalies. The aggregate numbers matter more than the 18, and the headline overstates both.
Reality