The malicious JavaScript code ("bundle.js") injected into each of the trojanized package is designed to download and run TruffleHog, a legitimate secret scanning tool, using it to scan the host for ...

“While widespread exploitation has not yet been reported,” Germany-based SecurityBridge said in a blog on Thursday, it has ...