Nearly 90% of companies report they have detected a security issue in their software supply chain in the last 12 months.

Three newly discovered malicious Python packages posted to the Python Package Index (PyPI) are now believed to be part of the VMConnect campaign and have also been tied to the North Korean Lazarus Group.

North Korean state-sponsored hackers have uploaded malicious packages to the PyPI (Python Package Index) repository

Roblox gaming developers are lured in by a package that claims to create useful scripts to interact with the Roblox website

Malicious npm packages target Roblox devs

The campaign, discovered by researchers at ReversingLabs, uses typo-squatting and a number of sophisticated obfuscation tactics to entice users into downloading fake versions of commonly used software on npm, a popular open source software library.