Intel Exchange

The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.

The threat actor vpmdhaj published 14 malicious npm packages typosquatting OpenSearch and ElasticSearch libraries to harvest AWS, HashiCorp Vault, and GitHub Actions credentials.

A Chinese-speaking threat actor compromised DAEMON Tools installers to deploy information collectors, minimalistic backdoors, and the complex QUIC RAT against targeted organizations.

The TeamPCP campaign hijacked the @bitwarden/cli npm package to distribute a sophisticated stealer targeting developer credentials, cloud secrets, and AI configuration files.

The Shai Hulud threat actor compromised SAP CAP framework packages by exploiting an AI coding assistant's GitHub integration to inject malicious code and steal npm OIDC tokens.

MiniRAT is a Go-based macOS remote access trojan delivered via the compromised velora-dex-sdk npm package, utilizing LaunchAgent persistence and AES-encrypted C2 configurations.

TeamPCP executed a supply chain attack on the elementary-data PyPI package using GitHub Actions injection to distribute a credential-stealing payload targeting data engineers.

Threat actors compromised the axios npm package to deliver a multi-stage, cross-platform Remote Access Trojan (RAT) via a malicious dependency named plain-crypto-js.

Threat actor TeamPCP compromised the LiteLLM AI proxy via a cascading supply chain attack originating from malicious GitHub Actions in the Trivy vulnerability scanner.

Threat actor TeamPCP compromised the 'telnyx' PyPI package to distribute credential-stealing malware using WAV steganography.