Snyk (3)
| Date (as written) | Incident | Country | Actors |
|---|---|---|---|
| published 4 Aug 2023 | Snyk Vulnerability Database: Malicious Package in eth-api-node (npm) | Lazarus Group | |
| published 4 Aug 2023 | Snyk Vulnerability Database: Malicious Package in xml2yaml (npm) | Lazarus Group | |
| 2026-06-17T00:00+03:00 | Axios npm compromise attributed by Microsoft to Sapphire Sleet (mentioned in "Mastra npm Scope Takeover"; Mastra attribution not confirmed) | Sapphire Sleet (BlueNoroff) |