Browse public community intelligence reports, source analysis, and threat research.
67 intel reports
Team PCP's Miasma toolkit automates software supply chain attacks by poisoning package registries, hijacking GitHub Actions, and injecting malicious configurations into AI coding agents.
The Miasma campaign targets @redhat-cloud-services npm packages using a multi-stage loader and Bun-executed credential stealer to exfiltrate secrets via GitHub APIs.
TeamPCP uses the Miasma worm to compromise developers and CI/CD pipelines by hijacking AI coding agents and poisoning package registries.
The Miasma threat actor is deploying a self-spreading npm worm that utilizes a 'Phantom Gyp' technique to execute code during installation, targeting cloud credentials and AI coding assistants.
A highly sophisticated multi-stage npm supply chain campaign targeting Red Hat and AI-related packages uses GitHub as an adaptive C2 to deploy the Shai-Hulud infostealer variant 'Miasma'.
The Miasma threat actor compromised 56 npm packages to steal CI/CD secrets and deploy persistent backdoors using a novel binding.gyp execution trigger.
FAMOUS CHOLLIMA (DPRK) distributes the MicrosoftSystem64 RAT via malicious npm packages, leveraging HuggingFace for binary updates and data exfiltration.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
The threat actor JINX-0164 targets cryptocurrency industry developers using sophisticated macOS-specific malware, CI/CD compromise, and social engineering to steal digital assets and credentials.
The Mini Shai-Hulud worm was deployed via compromised @antv npm packages to exfiltrate developer secrets and propagate to other repositories.
