Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
Adversaries compromised the LiteLLM supply chain to distribute a credential stealer and remote code loader targeting cloud, AI, and developer secrets.
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
An unidentified attacker compromised cPGuard's update infrastructure to distribute a malicious script that backdoors Linux servers and exfiltrates password hashes and SSH keys.
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
The GlassWorm threat actor distributed a trojanized version of the Claude Code extension via the Cursor Marketplace to plant a persistent SSH backdoor.
An unknown attacker exploited a leaked LiteLLM master key to steal GitHub OAuth tokens, hijack the release pipeline, and publish a malicious version of the LiteLLM package to PyPI.
Threat actors compromised LiteLLM's CI/CD pipeline by exploiting leaked GitHub CLI tokens in logs to distribute a malicious Python package containing the privcollect stealer and a RAT.
UNC7017 targeted AOMEI Technology update infrastructure using brief configuration tampering windows to deliver CROSSROAD and SHINYROAD malware.
Glassworm threat actors compromised a contributor's GitHub account to replace official OVHcloud CLI release binaries with secret-stealing malware using a Solana-based dead drop for command and control.
The NEBULA campaign utilizes seven malicious npm packages disguised as NebulaAI SDKs to deliver a customized KNTRAT remote-access trojan using stealthy syscall-based execution.
