Browse public community intelligence reports, source analysis, and threat research.
88 intel reports
Adversaries such as TeamPCP exploit Python package installation mechanisms including setup.py hooks, .pth files, and entry points to compromise developer environments and CI/CD pipelines.
A North Korean-linked operation targeted the npm registry using the GHAPPIER loader to establish persistence and remote access via compromised developer credentials.
An ongoing malicious npm campaign involving 'indexed-btree' and other packages bypasses lifecycle script defenses by burying loaders in runtime prototype methods and using Ethereum smart contracts for C2.
Mini Shai-Hulud threat actors exploited re-enabled GitHub Actions repositories to resume credential harvesting via compromised mutable tags.
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
The North Korean threat actor Jade Sleet (TraderTraitor) is targeting DevOps engineers at IT services firms using weaponized Terraform coding projects and macOS backdoors FLATROOF and ROOFDECK.
An unidentified threat actor published malicious npm packages posing as Twilio security research tools to exfiltrate sensitive API credentials and system metadata.
Threat actor Bratteam88 is distributing the Rust-based KRSID ransomware and Quasar RAT by compromising and updating fraudulent Home Trading System (HTS) applications.
A flaw in major AI coding agents allows attackers to bypass SHA-pinning and execute zero-click remote code by swapping trusted plugins with malicious code via branch-name manipulation.
The TeamPCP threat group utilized backdoored TanStack npm packages to harvest credentials from a former CrowdSec employee, leading to the theft of 170 private GitHub repositories.
