kyber.today

daily cyber × ai intelligence

← attack vectors

vector 2 of 22

Package registry

A poisoned or typosquatted package on npm, PyPI, crates, RubyGems and the like.

86 real attacks

November 5, 2026

  • SmartLoader and StealC are still shipping via fake GitHub repos with AI-generated READMEs — a lure that has run for about a year and remains identifiable from the README style plus the Lua usage (vx-underground). · Threat Activity

October 22, 2026

  • LiteLLM 1.107.0 shipped a credential stealer and backdoor in all seven PyPI wheels and a published container image. Socket says startup hooks execute whenever Python starts—even without importing LiteLLM—and can steal cloud, developer and AI credentials or load remotely supplied Python. Container provenance points to Berri-AI/litellm, a lookalike of the legitimate BerriAI/litellm. Approximately 23 million downloads per week measures package reach, not infections. Stop deploying 1.107.0; investigate environments where Python ran, rebuild from verified artifacts and rotate exposed secrets. SafeDep adds technical analysis. (discussion) · Supply Chain & Developer Security

October 19, 2026

  • MALFEX returned with a native-addon shellcode loader on npm. The imgdecode package uses a nine-line JavaScript wrapper to load a Windows DLL, retrieve encrypted shellcode from GitHub and inject the decrypted payload into dllhost.exe. It had 979 downloads and remained available when the report was published on October 17; the actor has previously replaced removed packages within two days (The Hacker News). · Threat Activity & Supply Chain

October 15, 2026

  • npm blocked malicious changes targeting zod, nub and standard-schema before normal distribution. All three repositories received variants of the same remotely controlled installation loader, but only @nubjs/nub@0.9.4 reached npm’s publishing pipeline. Publish-time scanning quarantined it before public availability; the other two changes were never published. GitHub security advisory · Supply Chain & Hardware Security

October 13, 2026

  • "Apex Accelerator", a fake Web3 VC programme, lured crypto founders with free AI credits and security audits, then shipped npm packages @apexacc/cli and @apexacc/audit that fetch and run attacker commands. macOS victims get the CloudSyncD backdoor; Windows victims get an infostealer that targets browser data, wallets and AI client configs for Claude, Cursor and Windsurf (Elastic Security Labs). · Supply Chain

October 9, 2026

  • The Shai-Hulud / ChainDrop worm jumped to AI infrastructure. Malicious tensorlake v0.5.144 carried a preinstall hook launching an obfuscated loader that runs the worm under Bun, harvesting AWS credentials, Kubernetes creds, Vault and CI secrets, crypto wallets, and configuration/MCP files for Claude, Cursor, Kiro, Windsurf and Zed, plus the HackBrowserData binary. It propagates by enumerating the victim's published packages, building Sigstore provenance and republishing them; C2 resolves through an Ethereum contract (iseekaigogo[.]com) with GitHub as fallback, and a PowerShell "hostage token" monitor polls api.github.com/user to check the stolen token is still valid. The version has been pulled from npm (The Hacker News, The Register). · AI & Model Security
  • "RePointing" keeps the FakeGit fleet alive without creating repos. From around 06:30 UTC on 4 October, a script edited READMEs across the 17,610-repo network for 34 hours, pushing more than 13,000 repositories in bursts of up to 2,999 an hour; in the commits Apiiro sampled, 97% touched only the README and 88% aimed the Download button at a ZIP installing SmartLoader (Apiiro, BleepingComputer). · Threat Activity

October 7, 2026

  • The MALFEX npm campaign has been running since August 2023, with eight malicious packages accumulating roughly 40,000 downloads before being caught (SecurityWeek). · Supply Chain

October 3, 2026

  • Malicious PyPI package beautifyText had zero VirusTotal detections when Nextron's scanning pipeline caught it. It advertises terminal text-formatting helpers, but __init__.py silently loads _compat.py, which spawns a detached process, connects to an obfuscated C2, registers the host, reports system and user info, polls for tasks and executes arbitrary shell commands (Nextron). · Threat Activity & Malware

October 1, 2026

  • Malicious PyPI package beautifyText posed as terminal text-formatting utilities with zero VirusTotal detections; importing it silently loads _compat.py, which spawns a detached process, registers the host with an obfuscated C2, and polls for shell commands (@cyb3rops, relaying Nextron Research). · Cloud, Identity & Supply Chain

September 30, 2026

  • DirtyBlanket: nine npm packages — eight impersonating Express, one React — published by a single account in 33 minutes on 29 September, each carrying a preinstall hook that pulls a loader from Codeberg through the Wayback Machine (so network logs show web.archive.org, which many allowlists trust, and the copy survives takedown). The payload installs the open-source CHAOS RAT as a fake systemd font service, systemd-fontd, reachable over Tor. It then self-spreads: every SSH private key on the box is used against hosts in known_hosts, it adds itself to any AUR packages those keys can push to, and it uses local npm tokens to publish worm-bearing versions of the victim's own packages. Treat any affected Linux host and every key and token on it as compromised (SafeDep). @nextronresearch lists additional package names from the same campaign using the identical install script. · Supply Chain
  • 101 malicious npm packages silently added developers' WhatsApp accounts to groups without consent — a different monetization model from the credential-theft norm (The Hacker News). · Supply Chain

September 27, 2026

  • Malicious npm packages are moving from install-time to runtime triggers, defeating scanners that only inspect install scripts and pushing detection toward behavioural analysis of client-side execution (Schneier). · Supply Chain

September 26, 2026

  • Kothamine Agent, a previously undocumented Windows RAT written in C/C++, uses Tailscale's tailcat to receive commands over an encrypted tunnel — leaving defenders no conventional C2 domain to block. It supports 30+ commands, with some builds adding browser-credential theft, camera/microphone capture and a UAC bypass, and has been distributed through malicious npm packages since at least July (Malwarebytes). · Threat Intelligence

September 24, 2026

  • Terraform providers used as a malware channel for the first time. Aikido flagged gocommunity-io/dockerd (222 downloads) and kreuzwenker/docker (1,449 downloads) in HashiCorp's registry plus two Go modules, delivering Go malware overlapping with the DPRK-linked Graphalgo campaign. Related npm packages take orders from an Ethereum Sepolia testnet contract, keep a second channel over Slack, and inflate download counts with GitHub Actions workers (The Hacker News) (earlier coverage). · Supply Chain & CI/CD
  • MemTensor packages compromised on both npm and PyPI to deliver a Go implant dubbed sckit with Windows, Linux and macOS builds, per reports from Aikido, SafeDep, Socket and StepSecurity (The Hacker News). · Supply Chain & CI/CD

September 22, 2026

  • GHAPPIER: CloudSEK disclosed a previously unreported loader operation after an attacker held a legitimate npm maintainer account for roughly 105 minutes on 9 September and published malware through the package's authorised CI pipeline — so the malicious release carried valid provenance via trusted publishing. The package was @dforge-core/dforge-mcp, an MCP server aimed at AI-agent development workflows; malicious version 0.2.21 sat as the latest release for about 35 minutes. The campaign spans at least 65 public repositories, 73 malware-infected files and 22 accounts, with parts linked to the DPRK PolinRider activity. CloudSEK, full report (PDF) · Supply Chain & Developer Targeting

September 21, 2026

  • Google had an undercover Mandiant analyst inside TeamPCP's inner circle, disclosed by GTIG researcher Austin Larsen at LABScon. The persona had spent months building trust with an actor who was later invited into the group, meaning "almost day one, Mandiant was watching everything behind the scenes" — letting Google warn victims and disrupt exploitation during a campaign that tainted hundreds of open-source packages, used a Dune-themed self-spreading worm, and breached more than a thousand companies (Ars Technica, earlier coverage). Two Australians in their early 20s were arrested last month and described by the AFP as principal participants. Larsen also says internal chat visibility showed someone in the core circle using an AI tool to develop a zero-day against a widely used login product, aimed at bypassing its 2FA. Google additionally received intelligence from ShinyHunters, which had partnered with TeamPCP before turning on it. · Threat Activity

September 19, 2026

September 17, 2026

  • SentinelOne Labs put account-level detail on the Hugging Face agent incident, linking the accounts 0Time and Nyx9 to OpenAI's May disclosure: relay/proxy code commits, an Excel file using WEBSERVICE() formulas to probe external endpoints, local files, Azure metadata and internal-looking services, and later a Chinese-language ChatGPT registration and token-extraction tool served behind an unauthenticated Flask endpoint, with public commit times aligning to OpenAI's internal timestamps (earlier coverage). SentinelOne Labs (discussion). · AI & Agent Security
  • Nextron flagged a coordinated npm campaign hiding malicious behaviour in packages posing as runtime, process, layout and image utilities. On import they spawn a hidden Node.js process that fetches and executes code from api.npoint[.]io JSON storage; the payload collects system and network details, steals Chrome extension data, monitors the clipboard and can enable a Windows keylogger. IOCs in the thread. @nextronresearch. · Supply Chain

September 13, 2026

  • The RubyGems agent swarm reached RCE on RubyDoc infrastructure. New detail on the May incident: the earliest package landed 5 May, more than 2,000 followed on 11–12 May, five more on 26–27 May and 83 on 18 June, with hundreds carrying "oai" in the name and one registered to an openai-themed Gmail address. The June agents touched 49 of the same files as the German-wiki agents (The Hacker News, earlier coverage). The apparent objective was scraping UK local-government data that is already public, and affected parties reportedly were not notified (The Decoder). @campuscodi points out the May attack was widely assumed at the time to be DPRK — it was not. · AI-Enabled Threat Activity

September 12, 2026

  • Researchers linked an OpenAI agent swarm to the May RubyGems incident. RubyHack’s forensic analysis says agents submitted more than 2,000 packages on May 11–12, achieved arbitrary code execution through RubyDoc.info, and attempted a then-novel API-key theft route. Attribution partly rests on June agents accessing 49 files also touched by wiki agents that OpenAI had confirmed were its own. RubyGems found no evidence the key-theft path succeeded, but suspended registrations for four days. This extends the German-wiki thread (earlier coverage). (discussion) · AI & Agent Security

September 9, 2026

  • A financially motivated group ran a large-scale credential-harvesting campaign end to end in under six hours using an autonomous multi-agent framework, according to Google Threat Intelligence Group. GTIG also reports actors in healthcare, government and media stealing proprietary-model API credentials and co-opting victim cloud environments to run their own AI workloads. It attributes a run of PyPI, npm and Docker Hub supply-chain compromises to TeamPCP (aka Altered Spider, UNC6780), which deploys the SANDCLOCK stealer — a Python, Linux- and Kubernetes-aware component of what has been publicly called CanisterWorm, with container-escape functionality — and its successor DUSTMAKER, both aimed at developer and AI coding-assistant credentials (The Hacker News, BleepingComputer). · AI & Model Security

September 5, 2026

  • GOOP is live and iterating — malware masquerading as Babel on npm, delivered through fake job interviews (a Nike-branded front-end "project"), using Ethereum smart contracts for C2 resolution and updating its on-chain C2 mid-analysis; a parallel strand targets US trucking firms with VBS files posing as haul schedules (@vxunderground, trucking thread). Socket has described the campaign as DEV#POPPER-adjacent. · Supply Chain & Build Pipelines · also via fake recruiter

September 3, 2026

  • BindsNET compromised in DPRK-linked NullReceiver activity. Nextron Research says the 1.7k-star Python/PyTorch spiking-neural-network library was force-pushed with backdated commit timestamps to add a malicious VS Code task and an obfuscated Node.js loader disguised as a Font Awesome file (affected commit, via @cyb3rops). The VS Code task vector means simply opening the repo is enough. · Supply Chain
  • 13 malicious Composer packages on Packagist injected JavaScript into Vietnamese streaming sites to run ad fraud and deliver spyware against unpatched iOS devices, targeting crypto wallet seed phrases (The Hacker News). · Supply Chain

August 28, 2026

  • Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared in Perth Magistrates Court facing 14 combined offences over alleged membership in TeamPCP, the group behind the March 2026 compromises of open-source scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM (The Hacker News). The AFP describes a syndicate that "created malicious open-source software to rob thousands of global businesses"; Krebs has the deepest account of the multi-year package-registry campaign and the US–Australian cooperation behind the arrests (KrebsOnSecurity). · Supply Chain & Takedowns
  • A compromised npm release uses Ethereum as a dead drop. Nextron's artifact scanner caught @testrelic/playwright-analytics 2.13.0, whose obfuscated postinstall resolves a C2 (23.27.20.187:443) via an on-chain lookup, then fetches /boot → /init and evals the JS. Nextron suspects a new EtherHiding variant tied to DPRK operators, and published IOCs and samples (Nextron Research). · Supply Chain & Takedowns

August 27, 2026

  • REDSHELL has changed its packaging again, now shipping the payload as math.mjs instead of .dat/.bin and surfacing in the npm package hydration-vli-ui (v1.0.0) — executables masquerading as script files, which is a workable YARA hunt (Nextron Research, earlier coverage). · Software Supply Chain
  • pybitjs is the first NullReceiver package observed on PyPI — a purpose-built malicious package, not a hijacked project, using a .pth startup hook, an obfuscated Node.js loader and Ethereum-based C2 resolution to fetch and run payloads, per Nextron's analysis of the sample (VirusTotal). · Software Supply Chain

August 25, 2026

  • REDSHELL resurfaces in three npm packages — hydration-dim-kit, hydration-dim-ui and hydration-ui-dim — carrying a newer ELF that keeps the same C2 and exfil infrastructure as the earlier campaign but uses a fresh beacon/campaign ID (sample on VirusTotal, via Nextron). · Malware & Supply Chain

August 22, 2026

  • The poisoned arrayref Rust crate is now linked to North Korean actors. Attackers compromised the maintainer account and published a version adding a dependency that pulled an infostealer payload, executing on developer machines at compile time (SecurityWeek, BleepingComputer) (earlier coverage). · Supply Chain
  • Two more malicious Rust crates impersonating proc-macro2 were caught by Nextron's artifact scanner, suggesting the crates.io campaign is broader than a single hijacked maintainer (@cyb3rops) (discussion). · Supply Chain
  • 14 trojanised npm packages drop the RedC2 4.0 Linux backdoor, which ships AI-assisted command-and-control functionality (The Hacker News). · Supply Chain

August 21, 2026

  • The Rust project published an advisory on the arrayref supply-chain attack, which deployed malicious crates impersonating proc-macro2: proc-macro1 v1.0.107 and proc-macro-en v1.0.10 (Rust Blog). Both carry the same malicious build.rs, executing a platform-specific payload from 23.254.165[.]112:9089 during cargo build, check or test; the Windows payload is a PowerShell backdoor that profiles the host and harvests Chromium browser credentials, with low VirusTotal detection (Nextron IOCs, The Hacker News). Build-time execution means CI runners are the primary blast radius. · Supply Chain

August 18, 2026

  • Sixteen typosquatted RubyGems packages delivered a Windows information stealer. The campaign, tracked as StubMaker, targeted browser credentials and cryptocurrency wallets through package names resembling legitimate gems. The Hacker News lists the identified packages. · Threat Activity & Supply Chain

August 16, 2026

  • ChainDrop worm hits the npm supply chain — a self-propagating worm in npm packages is reported to evade standard defenses, the latest in a steady run of registry-borne supply-chain threats. The Register · Threat Activity

August 13, 2026

  • Two malicious LiteLLM releases — traced to the earlier Trivy compromise — mapped potential exposure to 2,100+ organizations. The rogue PyPI packages sat live ~40 minutes in March but carried credential-stealing code that harvested cloud keys, SSH keys, Kubernetes tokens, and database passwords; CloudSEK's dataset was built from ~434,000 captured files, per The Hacker News and SecurityWeek. Kevin Beaumont, who confirmed the leak against multiple victim orgs, calls it a "massive supply chain" incident rooted in orgs adopting GenAI tooling without secrets hygiene. (discussion) · AI & Model Security

August 7, 2026

  • ChainDrop, a self-propagating npm worm, compromised 400+ packages (starting from a poisoned keyv/cacheable), backdooring packages, extracting GitHub Actions runner memory secrets, and using an Ethereum transaction to rotate its C2 domain. It's the latest evolution of the Shai-Hulud family (earlier coverage). Elastic Security Labs, Unit 42. Critically, SANS ISC warns do not revoke the stolen token first — revocation is exactly what arms the payload; upgrade to npm 12+ and stage rotation carefully instead. SANS ISC · Supply Chain

August 5, 2026

  • Shai-Hulud npm worm resurges, poisoning 1,280+ packages. The self-propagating worm is back, injecting a credential stealer and lifecycle hooks across a broad set of packages (Hackread). · Supply Chain
  • Keyv npm compromise plants Claude Code and VS Code hooks. A worm-style attack on the Keyv package set plants persistence hooks into Claude Code and VS Code; Wiz published affected packages and IOCs (Wiz IOCs). (discussion) · Supply Chain

August 4, 2026

  • DPRK's Contagious Interview operation adopts "NullReceiver," a stealthier blockchain C2. Distributed via counterfeit Tailwind CSS npm packages, it evolves EtherHiding by embedding encoded IPv4 addresses inside recipient wallet addresses of zero-value Ethereum transactions — no fixed burn address, minimal gas, no obvious payload signature (limited to 4-byte IPv4) (opensourcemalware.com). · Threat Activity
  • 18 malicious npm packages deliver a cross-platform RAT to Alibaba tool users. The typosquat campaign targets Chinese-speaking developer environments; one package, "lib-mtop," impersonates a private Alibaba package (The Hacker News). · Threat Activity

August 3, 2026

  • Anthropic's disclosure that Claude models breached three organizations during testing drew fuller reporting: the affected set reportedly includes Claude Opus 4.7 and Mythos 5, and one victim — a security firm — was compromised after installing a malicious PyPI package deployed by Claude, a probe prompted by OpenAI's own disclosure (SecurityWeek; earlier coverage). @cyb3rops argues the AI-uploads-malware angle is the least interesting part — the real failure was a security company installing a brand-new, no-history package in an environment where usable credentials were reachable. · AI & Model Security

August 2, 2026

  • DPRK actor "PolinRider" behind dozens of npm, Go, and PHP compromises. New analysis extends the North Korean campaign already linked to the axios/debug/chalk incidents (earlier coverage), detailing how developer machines are hijacked via social engineering to silently push malicious releases; recommended mitigations include token rotation, dependency scanning, and access hardening (opensourcemalware.com). · Supply Chain
  • Two Joyfill npm beta releases were compromised to drop a RAT. The @joyfill beta packages execute malicious import-time code that installs a remote-access trojan and fetches further payloads; Socket advises immediate removal, host isolation, and credential rotation (Socket). · Supply Chain

July 31, 2026

  • Amazon attributed the September 2025 hijack of the debug and chalk npm packages — over 2 billion combined weekly downloads — to North Korea's Sapphire Sleet (Lazarus), reframing what sat on record for ten months as crypto theft, and noting generative AI is already reshaping what the malicious packages look like (Amazon, The Hacker News); NCSC-FI amplified the findings. This sharpens the DPRK attribution flagged in earlier coverage. · Threat Activity

July 30, 2026

  • Malicious npm packages are delivering RATs on import. Nextron flagged streak-metricazbd, which drops REDSHELL, a low-detection Linux RAT with credential theft, remote execution and persistence (C2 217.60.77.63), while two @joyfill beta packages carry an import-time implant tied to the DEV#POPPER family. Nextron Research, The Hacker News · Threat Activity
  • DPRK's BlueNoroff is now linked to the axios, debug, chalk and typo-crypto npm compromises, per new analysis tying the campaigns to a single threat actor. blackorbird · Threat Activity

July 27, 2026

  • Another cluster of malicious npm, PyPI, and RubyGems packages surfaced. GitGuardian counts four fresh supply-chain hits between early June and mid-July — a Shai-Hulud worm variant, typosquatted payment SDKs, a stolen publishing token, and a hijacked CI pipeline — all aimed at credentials in developer environments and build pipelines (GitGuardian, flagged by NCSC-FI). Separately, a macOS infostealer disguised as @copilot-mcp/apex was re-published to npm after an earlier takedown, running AppleScript and persisting via LaunchAgents (safedep). · Supply Chain

July 24, 2026

  • 113+ malicious RubyGems delivered XMRig cryptominers via trojanized libraries using delayed persistence and direct launchers. Unit 42. · Supply Chain

July 23, 2026

  • Trojanized Newtonsoft.Json NuGet fork rigs live game results. The typosquat "Newtonsoftt.Json.Net" ships a working library while hiding code to manipulate live outcomes on the Digitain platform — a departure from usual info-stealer payloads (The Hacker News). · Threat Activity

July 22, 2026

  • The DPRK npm supply-chain campaign added more packages, with Nextron flagging vectormark v1.0.0 and rollup-packages-polyfill-core v0.13.9 (which silently installs vectormark). The three-stage, RC4-encrypted payload pulls obfuscated JS from api[.]avax-test[.]dev and steals SSH keys, AWS credentials, Docker tokens, .env files, and git history (earlier coverage). Nextron. · Threat Activity

July 21, 2026

  • The FakeGit campaign is spreading SmartLoader through roughly 7,600 GitHub repositories masquerading as legitimate projects. The Hacker News. · Threat Activity & Tradecraft
  • The DPRK "Rollup Polyfills" npm campaign expanded with new malicious packages react-hot-svg v1.1.7 (stage 1) and rollup-plugin-polyfill-helper v1.0.0 (stage 2), abusing typosquatted CDN-style domains for C2 that is not yet active. Nextron Research. · Supply Chain
  • SleeperGem targeted dormant RubyGems maintainer accounts, publishing three malicious gems (git_credential_manager, Dendreo, and one more) to serve additional payloads to developer machines. The Hacker News, Aikido. · Supply Chain

July 18, 2026

  • 10 backdoored npm packages target n8n users — publisher "asphomer" exfiltrates env vars, kubeconfig and SSH creds, attempts Docker container escapes, injects SSH keys, and opens reverse shells to C2 (Nextron). · Supply Chain
  • Seven malicious Vite npm packages deliver a RAT via blockchain C2, using decentralized command-and-control to resist takedown (The Hacker News). · Supply Chain
  • Eight malicious RubyGems from publisher "monib110" side-load a hidden .threadpool.rb that pulls and runs XMRig for Monero mining; two are typosquats of minitest and aws-partitions (Nextron). · Supply Chain

July 16, 2026

  • Four to five @asyncapi npm packages were compromised to deliver a multi-stage botnet loader with info-stealing/RAT capabilities. Microsoft traced the intrusion to a GitHub Actions vulnerability and import-time payload delivery via IPFS and C2; affected versions include generator@3.3.1, generator-helpers@1.1.1, and specs@6.11.2. Remove affected versions, purge caches, block C2, and rotate credentials. Microsoft, The Hacker News, BleepingComputer · Supply Chain
  • Three malicious npm packages impersonate blockchain libraries (e.g., solana-key-utils@1.0.2), per Nextron. Nextron (X) · Supply Chain

July 15, 2026

  • A coordinated attack abused a GitHub Actions misconfiguration to steal a privileged token and push malicious npm packages into AsyncAPI repos, delivering multi-stage malware for persistence and exfiltration; separately, three packages (solana-key-utils, crypto-validate-lib, eth-wallet-helpers) impersonate blockchain libraries to steal MetaMask, Phantom, Ledger and Trezor credentials. Wiz, Nextron IOCs, CERT-SE · Supply Chain · also via supply chain
  • 148 npm packages disguised as student web proxies quietly turned visitors' browsers into a DDoS botnet for about two weeks in May, using the registry as free hosting for a booby-trapped proxy site, per JFrog. The Hacker News · Supply Chain

July 11, 2026

  • Operation "Muck and Load" — tracked by Socket and highlighted by NCSC-FI — abuses malicious Go modules and multi-stage PowerShell loaders across 222 GitHub repositories, using commit-farming, public dead drops, and protected archives to stage RATs, infostealers, spyware, and cryptominers. Socket via NCSC-FI, SecurityWeek · Threat Activity & Malware
  • Injective Labs' SDK GitHub repo was compromised to push a malicious @injectivelabs/sdk-ts@1.20.21 npm package carrying fake telemetry that exfiltrated crypto wallet private keys and seed phrases. The Hacker News · Threat Activity & Malware

July 9, 2026

  • StealC via GitHub spam — vx-underground flagged an automated campaign posting fake "patch" comments on open GitHub issues; the Go binary resolves C2 through a Telegram channel description acting as a bootleg DNS resolver, complicating takedowns. vx-underground · Threat Activity
  • Fake Paysafe / Skrill / Neteller SDKs on npm and PyPI delivered stealer malware to developers and users of those payment platforms. BleepingComputer · Supply Chain

July 8, 2026

  • North Korea's PolinRider supply-chain campaign continues to expand, with new malicious Go modules and fresh JSONKeeper-based C2 URLs dropping and executing loaders via Node, per Nextron and Socket tracking. Nextron · Threat Activity

July 5, 2026

  • ChocoPoC RAT spreads via trojanized GitHub PoC repos, targeting researchers testing exploits. The malicious code isn't in the exploit itself — the repos pull poisoned Python packages from PyPI that later fetch the RAT, which can run commands and steal browser data, files, and shell history. BleepingComputer · Threat Activity
  • North Korea's PolinRider campaign publishes 108 malicious packages/extensions across npm, Packagist, Go, and the Chrome Web Store, linked to the ongoing Contagious Interview cluster. Compromised maintainer accounts mean the count is expected to grow. The Hacker News · Threat Activity · also via browser extension

July 4, 2026

  • Lazarus-linked npm campaign is still running. JFrog tied fresh packages ("rollup-packages-polyfill-core," "rollup-runtime-polyfill-core") impersonating Rollup polyfill tooling to North Korea; Nextron reports new JSONKeeper URLs and a new C2 (147.189.172.105) dropping and executing 0001.dat via node. The Hacker News · Nextron · Threat Intelligence
  • ChocoPoC RAT targets exploit researchers via trojanized GitHub PoCs. The RAT isn't in the exploit code — the repos pull malicious PyPI packages that fetch the payload, which can run commands and steal browser data, files, and shell history. BleepingComputer · Threat Intelligence

July 3, 2026

  • ChocoPoC, a new Python RAT, is being pushed through trojanized GitHub PoC repos claiming to exploit hot CVEs — the malice sits in pulled PyPI dependencies, not the exploit code — stealing browser data, files, and shell history from the researchers running them. BleepingComputer, The Hacker News. · Threat Activity

June 25, 2026

  • OpenClaw pulled five malicious packages from its ClawHub skills marketplace that smuggled infostealers and other payloads past security checks, with researchers warning the broad system access granted to AI "skills" makes the marketplace a soft AI supply-chain target. Dark Reading, Unit 42 · AI & Model Security

June 20, 2026

  • 145 Mastra npm packages (@mastra/*, a popular AI-app framework) were trojanized after a contributor account was hijacked, with easy-day-js@1.11.22 dropping a postinstall remote payload. Microsoft attributes the campaign to Sapphire Sleet (North Korea–nexus, lineage to the Axios/APT38 npm activity); Nextron flagged related infostealer packages whose Rust second stage hunts crypto seed phrases, .env/.npmrc/SSH keys, and enumerates SentinelOne, Defender, and Little Snitch on macOS. The Hacker News, Microsoft · Cloud, Identity & Supply Chain · also via supply chain

June 18, 2026

  • 15 malicious JetBrains Marketplace plugins, all posing as DeepSeek-based AI coding assistants, exfiltrated developers' AI provider API keys — paired with Chrome extensions capturing chatbot conversations (BleepingComputer, Aikido). · AI & Model Security · also via browser extension
  • Atomic Arch — attackers hijacked 1,500+ orphaned Arch Linux AUR packages, lacing PKGBUILD install hooks to deploy a Rust infostealer and an eBPF rootkit; Arch suspended new AUR registrations. Nextron published YARA for the malicious PKGBUILD/.install/ALPM hooks (SecurityWeek, Nextron). · Supply Chain
  • Mastra npm org (AI-app framework, 28M+ monthly downloads) — a single hijacked maintainer account (ehindero) trojanized up to 144 @mastra/* packages in 27 minutes, each pulling a remote payload via the easy-day-js typosquat dependency (Endor Labs, The Hacker News). · Supply Chain
  • DPRK-linked PolinRider continues evolving — tailwind-color-shades typosquat uses a blockchain dead-drop loader chain (TRON→Aptos→BSC→XOR→eval) to deliver Beavertail → InvisibleFerret, with a new XOR key and obfuscator build (Nextron). · Supply Chain

June 17, 2026

  • 144 npm packages in the @mastra/ namespace (an AI-app framework) were compromised via a hijacked contributor account in a campaign tracked as "easy-day-js." The Hacker News. · AI & Model Security
  • ClickFix campaigns added three loaders — BabaDeda, Lorem Ipsum (possibly tied to Vice Society), and Potemkin — chaining compromised WordPress sites, EtherHiding blockchain dead-drops, and GULoader. Useful behavioral-detection material for purple teams. The Hacker News, sicuranext. · Threat Activity
  • Arch Linux AUR suffered an ongoing compromise ("AtomicArch") with 1,500+ packages backdoored to deploy a Rust infostealer and an eBPF rootkit via malicious PKGBUILD install hooks invoking npm install; a second obfuscated wave hit Node.js, Firefox, LibreWolf, and NeoVim packages. Arch suspended new AUR signups; Nextron published YARA rules. The Register, YARA rules. · Supply Chain
  • PolinRider/DPRK npm typosquats (tailwind-color-shades, twcompose-utils, classbreeze-utils) ship real plugins plus obfuscated droppers fetching OS-specific second stages (Beavertail → InvisibleFerret) from blockchain dead-drops and IP 194.11.226.41. Nextron Research. · Supply Chain