Browse public community intelligence reports, source analysis, and threat research.
4 intel reports
The TeamPCP threat group utilized backdoored TanStack npm packages to harvest credentials from a former CrowdSec employee, leading to the theft of 170 private GitHub repositories.
Multiple campaigns are using ghost accounts and compromised tokens to systematically enumerate and exfiltrate private data from GitHub organizations.
The TeamPCP threat group is conducting a large-scale supply chain campaign using the 'Mini Shai-Hulud' worm to compromise npm packages, steal CI/CD and cloud credentials, and autonomously propagate.
LAPSUS$ and TeamPCP targeted Checkmarx developer artifacts and GitHub repositories to exfiltrate credentials and distribute malicious plugins via the Jenkins Marketplace and OpenVSX registry.
