A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script.

Worker move goods for despatch in a redistribution centre of US online retail giant Amazon in Horn-Bad Meinberg, western Germany, on December 9, 2024. INA FASSBENDER/AFP via Getty Images Cloudflare's ...

AdBlock blocks known crypto miners by default, but c/side found 3,500+ sites running stealth WebSocket miners in 2025. What each extension still misses.

JSCeal hides crypto-stealing malware in V8 bytecode, but researchers built a tool to decompile it and expose its advanced theft capabilities.

JSCeal can steal browser credentials, replay Google sessions using stolen cookies, and modify traffic for cryptocurrency services.

Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry. Infected packages include ...

A new Remote Access Trojan known as DesckVB has been targeting systems in 2026, using obfuscated JavaScript and a fileless .NET loader to stay hidden from traditional security tools. The malware gives ...

在开发 JavaScript 应用程序时，保护源代码免受未经授权的访问和修改是一个重要的考虑因素。这就是 JavaScript Obfuscator 发挥作用的地方。本文将深入探讨 JavaScript Obfuscator 的原理和使用方法 ...

After a six-month hiatus, Gootloader is back to its old tricks - but it has gone through a few changes too.

Mojang Studios announced Tuesday it will eliminate code obfuscation in Minecraft: Java Edition, marking a significant shift in how the company distributes the game to its modding community. The change ...

作为前端开发者，你是否遇到过这样的尴尬：辛苦开发的商业项目上线后，打开浏览器控制台就能轻松看到完整源代码，核心逻辑甚至 API 地址暴露无遗？前端代码的 “透明性” 虽然方便调试 ...