Koi Security Blog
koi.ai · Company blog · on HN since 2025
Koi Security's blog reports on malware in npm packages, VS Code extensions and browser extensions, including self-propagating worms.
What HN saysHN links it for reports on npm supply chain compromises such as SHA1-Hulud, with commenters using it to discuss install-time scripts.
16HN people shared it
3linked it in comments
15stories submitted
1.4Kstory points
6 months agolast shared
2025people per year2026
Most-shared posts
- 1PhantomRaven: NPM Malware Hidden in Invisible Dependencies3 people · 14 points · first shared 2025 · 1 comments on HN
- 28M users' AI conversations sold for profit by "privacy" extensions2 people · 831 points · first shared 2025 · 245 comments on HN
- 3First Self-Propagating Worm Using Invisible Code Hits OpenVSX and VS Code2 people · 90 points · first shared 2025 · 59 comments on HN
- 4Lotusbail npm package found to be harvesting WhatsApp messages and contacts1 people · 318 points · first shared 2025 · 210 comments on HN
- 54.3M Browsers Infected: Inside ShadyPanda's 7-Year Malware Campaign1 people · 100 points · first shared 2025 · 26 comments on HN
- 6SHA1-Hulud – The Second Coming: Over 1k NPM Packages Compromised1 people · 4 points · first shared 2025 · 1 comments on HN
- 7GlassWorm, Self-Propagating Worm Using Invisible Code Hits OpenVSX and VSCode1 people · 3 points · first shared 2025 · 4 comments on HN
- 8DarkSpectre: 8.8M users infected via malicious browser extensions over 7 years1 people · 3 points · first shared 2025 · 1 comments on HN
- 9PackageGate: Zero-Days in JavaScript Package Managers but NPM Won't Act1 people · 2 points · first shared 2026 · discussion on HN
- 10We Prevented Cursor, Windsurf and Google Antigravity from Recommending Malware1 people · 1 points · first shared 2026 · discussion on HN
- 11ClawHavoc: Malicious Clawed Skills Found by the Bot They Were Targeting1 people · 1 points · first shared 2026 · discussion on HN
- 12MaliciousCorgi: AI Extensions send your code to China1 people · 1 points · first shared 2026 · discussion on HN
- 13GlassWorm Goes Native: Same Infrastructure, Hardened Delivery1 people · 1 points · first shared 2025 · discussion on HN
What HN people wrote when they linked it
bilalq · 2026-05-19
Using a VPN shifts your risk. Your local ISP can't see as much of your activity, but another company that probably has a business model of reselling your data to governments, intelligence agencies, and ad companies now can. If your concern is masking piracy, maybe that shift of risk is worthwhile, but you still want to avoid some of the more obvious bad actors[0]. You certainly should not have all your internet traffic going over a VPN all the time.
If you're at all worried about being targeted for political speech or you're part of a targeted group, then you need to be more careful. This map is a bit outdated, but it does give some insight on who to avoid [1].
Ironically, Mullvad is one of the more trustworthy VPNs out there and still the one I'd recommend.
[0]: https://www.koi.ai/blog/urban-vpn-browser-extension-ai-conversations-d…
[1]: https://windscribe.com/blog/the-vpn-relationship-map/
amitassaraf · 2025-11-24
There are actually hundreds more NPM packages infected, see here: https://www.koi.ai/incident/live-updates-sha1-hulud-the-second-coming-…
crtasm · 2025-10-30
>When you run npm install, npm doesn't just download packages. It executes code. Specifically, it runs lifecycle scripts defined in package.json - preinstall, install, and postinstall hooks.
What's the legitimate use case for a package install being allowed to run arbitrary commands on your computer?
Quote is from the researchers report https://www.koi.ai/blog/phantomraven-npm-malware-hidden-in-invisible-d…
edit: I was thinking of this other case that spawned terminals, but the question stands: https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential…