Browse public community intelligence reports, source analysis, and threat research.
23 intel reports
The Miasma worm campaign compromised 20 LeoPlatform npm packages and a Verana Blockchain Go module to deploy a Bun-based credential stealer targeting developer environments and CI/CD pipelines.
A campaign involving hijacked npm and Go packages uses malicious VS Code tasks to trigger a multi-stage infection chain involving blockchain dead drops, a socket.io backdoor, and a Python infostealer.
Threat actors are weaponizing the OpenClaw AI agent ecosystem by publishing malicious skills on ClawHub that deliver infostealers and execute novel agentic financial fraud.
