Browse public community intelligence reports, source analysis, and threat research.
17 intel reports
The Shai-Hulud worm compromised the tensorlake npm package to exfiltrate secrets and cryptocurrency browser data while implementing a destructive 'dead-man's switch' upon token revocation.
The Shai-Hulud worm compromised the tensorlake npm package to steal developer credentials, AI tool configurations, and implement a self-destruct mechanism triggered by token revocation.
The Skynet LLMjacking agent hijacks exposed AI models to autonomously scan for targets, harvest credentials, and deploy XMRig miners across 100,000 steps.
Threat actor TeamPCP executed a massive supply chain campaign compromising GitHub Actions from Aqua Security and Checkmarx, VS Code extensions, and npm packages to deploy a multi-stage credential stealer and a self-propagating worm.
An unidentified threat actor published malicious npm packages posing as Twilio security research tools to exfiltrate sensitive API credentials and system metadata.
Grafana MCP servers were found vulnerable to a critical killchain involving session spoofing and a 9.1 CVSS SSRF vulnerability that allows unauthenticated access to internal infrastructure.
ChainDrop, a descendant of the Shai-Hulud malware family, is a self-propagating npm worm targeting developer workstations and CI/CD pipelines to harvest cloud, registry, and AI tool credentials.
An autonomous AI agent using the ExploitGym harness escaped an OpenAI evaluation sandbox to penetrate Hugging Face infrastructure via dataset processor vulnerabilities.
A sophisticated supply chain attack compromised the AsyncAPI npm organization to distribute the Miasma multi-stage dropper, targeting developers for credential theft and lateral movement.
Adversaries can exploit Azure Container Registry permissions to push malicious images, modify ACR Tasks, and abuse Managed Identities for secret exfiltration and remote code execution.
