Published: · Region: Global · Category: cyber

Malicious npm Packages and macOS ‘ClickFix’ Stealer Expose New Supply-Chain Risk for Crypto and Credentials

Nearly 800 malicious npm packages seeding a cross-platform infostealer and a new macOS ‘ClickFix’ attack that drains crypto wallets point to a dangerous convergence of software supply-chain abuse and targeted credential theft. Developers, crypto holders, and corporate IT teams face a threat that jumps from open-source code to personal devices with a single install or pasted command.

The open-source tools that power modern software—and the convenience shortcuts that many users rely on—are being turned into quiet entry points for credential theft and drained crypto wallets. Security researchers have identified nearly 800 malicious packages uploaded to the npm registry, the JavaScript ecosystem’s central repository, delivering a cross-platform remote access trojan (RAT) and infostealer. The campaign targets development environments on Windows, macOS, and Linux, using a loader dubbed WEL1DROPPER to fetch platform-specific payloads. If HTTPS connections fail, the malware can reportedly fall back to DNS TXT records to receive its instructions, a design that significantly complicates detection and blocking. In parallel, investigators have detailed a separate macOS-focused campaign dubbed…

Pro features include

  • 60+ analytical tools across markets and intelligence
  • Custom alerts, watchlists, and AOI monitoring
  • Daily Pro brief at 6 PM ET — 12 hours before free tier
  • Conflict deep dives and premium research products

Related Coverage

GLOBAL

U.S. Senate Sanctions Push Puts Global Energy Buyers Under New Russia–Iran Pressure

The U.S. Senate has overwhelmingly backed new powers to hit buyers of Russian and Iranian energy with tariffs of up to 100%, sending a clear warning to partners from India to Europe. The move raises the cost of hedging between Washington and Moscow or Tehran, and puts refiners, traders and governments on notice that energy is back at the center of U.S. coercive power.
GLOBAL

Directed-Energy Shift: U.S. Army’s $400 Million Locust Buy Targets Drone Swarm Threat

The U.S. Army plans to spend at least $400 million on AeroVironment’s Locust anti-drone laser systems, its first production contract for a directed-energy counter-UAS weapon beyond the prototype phase. For frontline units and base commanders, the shift promises cheaper, deeper magazines against swarming drones — and signals how quickly the battlefield is moving beyond traditional missiles.
GLOBAL

U.S. Senate Russia–Iran Sanctions Bill Puts Oil Buyers Under New Pressure

The U.S. Senate has overwhelmingly approved a sanctions bill targeting Russia and Iran that would let Washington slap tariffs of up to 100% on imports from the biggest buyers of Russian oil and gas. The measure, which also extends Iran sanctions, raises the cost of doing business with Moscow and Tehran for key energy importers while signaling a new phase of economic pressure. Readers will see how this bill could reshape trade decisions in Europe and Asia long before any tank stops rolling.
WARNING

Reports: Top US General Urges Iran War Off-Ramp As Key Europe Commander Ousted

Within minutes of each other on 7 Aug, ABC News reported the abrupt removal of Lt. Gen. Charles Costanza from command of U.S. V Corps in Europe around 22:00 UTC, while another report said Joint Chiefs Chair Gen. Dan Caine is privately pressing Trump officials to find an 'off-ramp' from the war with Iran. Together they point to a U.S. military leadership recalibration at two fronts that anchor NATO’s Russia deterrence and the security of Gulf oil flows.
WARNING

Colombia Swears In De La Espriella, Resetting Course for Key Latin Oil, Coal Exporter

Abelardo de la Espriella was sworn in as Colombia’s president for 2026–2030 in Cali around 21:40–22:00 UTC, completing a constitutional transfer of power under heavy security and political tension. The new government inherits a fragile security environment and a commodity-dependent economy, creating fresh uncertainty for investors in Colombian debt, the peso, and regional energy and agriculture supply chains.
WARNING

U.S. to Fund Domestic Battery, Critical Mineral Capacity

The Trump administration will provide over $2 billion to battery and critical‑mineral companies to cut U.S. dependence on China, per WSJ. This signals a medium‑term policy push to onshore parts of the EV and storage supply chain, with bullish implications for select critical minerals and related equities, while incrementally bearish for China‑linked processors.