Vulnerabilities & Threats

Subscribe to hear about critical security incidents

We'll send you updates on incidents as and when they happen

Featured

September 23, 2026

Novel supplychain.local Go worm appears

"supplychain.local": malicious code found in MemTensor's npm plugin (0.1.21, 0.1.23) and PyPI's MemoryOS (2.0.34).

#Malware

September 8, 2026

Compromised Flutter package on pub.dev contains XCSSET malware

We detected XCSSET malware inside a compromised Flutter package on pub.dev. Here is a full breakdown of the infection chain, propagation modules, and stealer logic we found inside.

#Malware

September 7, 2026

Shai-Hulud Rises From the Dead after 111 days

A known Shai-Hulud worm payload sat dormant for 111 days, then republished to npm, right past the malware scanning meant to catch it.

#intel

#Malware

#Vulnerabilities

Subscribe to our newsletter.
No spam, guaranteed.

June 9, 2026

Wait, binding.gyp Can Do What? Exploring npm's Weirdest Build System

Deep dive into binding.gyp, the often overlooked npm build file that can execute malicious code at install time through shell expansions, sandbox escapes, and compiler hijacking.

Tags/

#Malware

June 1, 2026

Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm

Multiple official @redhat-cloud-services npm packages were compromised with a credential-stealing worm derived from the open-sourced Mini Shai-Hulud malware, targeting cloud credentials, and developer tooling across CI/CD pipelines.

Tags/

#Malware

May 27, 2026

Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens

A polished Codex remote UI, the npm package codexui-android, has active development and thousands of weekly users. It has been quietly exfiltrating OpenAI auth tokens for the past month.

Tags/

#Vulnerabilities

#NPM

#Malware

May 23, 2026

Supply Chain Attack Targets Laravel-Lang Packages with Credential Stealer

Attackers injected a credential stealer into 200+ versions of popular Laravel-Lang packages, delivering a credential stealer targeting cloud keys, SSH keys, browsers, crypto wallets and more.

Tags/

#Malware

May 21, 2026

Google API keys keep working after you delete them

Deleting a Google API key doesn't revoke it immediately. Our testing found successful authentications up to 23 minutes after deletion, and Google has declined to fix it.

Tags/

#AppSec

#Vulnerabilities

May 20, 2026

The Wild West of VS Code extensions and how a poisoned extension breached GitHub

A poisoned VS Code extension breached GitHub yesterday, one day after Nx Console (2.2M installs) was compromised for 18 minutes on the Visual Studio Marketplace and reached every user with auto-update on.

Tags/

#VS Code

#Software Supply Chain Security

#Aikido Endpoint

May 20, 2026

GitHub breached via a malicious VS Code extension: why developer devices are the real target

GitHub confirmed a poisoned VS Code extension compromised an employee device, exposing 3,800 internal repos. Why developer workstations are now the top supply chain target.

Tags/

#Software Supply Chain Security

#Malware

May 19, 2026

Microsoft's durabletask package on PyPi Compromised. Mini Shai Hulud attacks again... again!

Three progressively compromised versions of a Microsoft-adjacent Python package deliver a full-featured infostealer that spreads through AWS and Kubernetes, exfiltrates every cloud credential it can find, and wipes disks on Israeli and Iranian systems

Tags/

#Malware

May 19, 2026

Mini Shai-Hulud strikes again: npm worm compromises hundreds of @antv packages

The Mini Shai-Hulud npm worm has hit Alibaba's @antv packages, echarts-for-react, and timeago.js. The payload steals CI/CD secrets, plants backdoors in VS Code and Claude Code, and spreads by republishing compromised packages. Here is what happened and how to protect your team.

Tags/

#Malware

May 12, 2026

Mini Shai-Hulud Is Back: npm Worm Hits over 160 Packages, including Mistral and Tanstack

Mini Shai-Hulud is back, compromising 169 npm packages across TanStack, UiPath, Squawk, and more to steal developer and CI/CD secrets, then spread through trusted publishing workflows.

Tags/

#Malware

April 30, 2026

Popular PyTorch Lightning Package Compromised by Mini Shai-Hulud

Malware found in popular PyTorch Lightning version 2.6.2 and 2.6.3, stealing credentials, crypto wallets, and VPN configs as part of the Mini Shai-Hulud campaign.

Tags/

#Malware

April 29, 2026

Mini Shai-Hulud Targets SAP npm Packages With a Bun-Based Secret Stealer

Compromised SAP npm packages use a Bun-based preinstall payload to steal GitHub, npm, cloud, and CI secrets, then spread via GitHub using OhNoWhatsGoingOnWithGitHub.

Tags/

#Malware

#NPM