Browse public community intelligence reports, source analysis, and threat research.
84 intel reports
Unknown actors compromised MemTensor packages on npm and PyPI to deliver 'sckit', a Go-based worm designed for credential harvesting and self-propagation via CI/CD pipelines.
The North Korean threat actor Jade Sleet (TraderTraitor) is targeting DevOps engineers at IT services firms using weaponized Terraform coding projects and macOS backdoors FLATROOF and ROOFDECK.
An unidentified threat actor published malicious npm packages posing as Twilio security research tools to exfiltrate sensitive API credentials and system metadata.
Threat actor Bratteam88 is distributing the Rust-based KRSID ransomware and Quasar RAT by compromising and updating fraudulent Home Trading System (HTS) applications.
A flaw in major AI coding agents allows attackers to bypass SHA-pinning and execute zero-click remote code by swapping trusted plugins with malicious code via branch-name manipulation.
The TeamPCP threat group utilized backdoored TanStack npm packages to harvest credentials from a former CrowdSec employee, leading to the theft of 170 private GitHub repositories.
Russia-aligned threat actor UAC-0099 is using the GuardBreaker technique to trip AI safety guardrails and blind automated malware analysis tools targeting Ukrainian critical infrastructure.
A maintainer compromise on the pub.dev platform led to the injection of malicious build-time scripts targeting developer credentials in the Flutter ecosystem.
An unidentified actor compromised Coder's Cloudflare-managed registry infrastructure to distribute malicious Terraform modules that steal infrastructure credentials and API keys.
The Superior threat actor uses 19 malicious Chrome and Edge extensions to deliver wallet drainers and credential-stealing payloads through a modular JavaScript framework.
