Research reports
1,224 reports from 387 publishers45 added in the past week
40 reports, newest added first
Added Thu 6 Aug
TeamPCP expands: Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions
On March 19, 2026, the threat actor known as TeamPCP compromised Aqua Security's Trivy vulnerability scanner and its associated GitHub Actions, injecting a credential-stealing payload into CI/CD pipelines across thousands of repositories. The incident was…
Supply chain
Added Fri 31 Jul
Joyfill npm Packages Compromised with Blockchain C2 Loader
Two beta versions published to the @joyfill npm scope on July 28, 2026 carried the same blockchain C2 loader documented in the astro.config.mjs attack. The compromised packages are @joyfill/layouts@0.1.2-2773.beta.0 and…
MalwareSupply chain
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Socket proactively blocks malicious open source packages in your code. Install Two npm beta releases in the @joyfill namespace contain an import-time JavaScript implant that resolves encrypted code through Tron, Aptos, and BNB Smart Chain transactions. Static…
MalwareSupply chain
Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts , were published to the npm registry. Both versions carry the same heavily obfuscated payload injected into the built distribution bundles. The…
MalwareSupply chain
Added Tue 21 Jul
ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey
Checkmarx Zero’s ongoing research into malicious open-source libraries has uncovered and reported a targeted supply chain campaign that bears strong indications of being operated by a threat actor known as “SuccessKey” (no apparent relationship to several…
Supply chain
Sequel to ChainVeil npm malware: ViteVenom
When we published our ChainVeil report in June 2026, we noted something that didn’t fit: the SuccessKey campaign’s Command and Control (Command and Control (C2)) infrastructure contained a secondary server at 198.105.127[.]210 and a tertiary server at…
MalwareSupply chain
ChainVeil and ViteVenom are DPRK’s PolinRider Campaign
On June 16, 2026, Checkmarx Zero published a detailed breakdown of an npm supply chain campaign they named "ChainVeil." It's careful work: they pulled together nine malicious packages, a 77KB remote access trojan (RAT), a four-tier blockchain command channel…
MalwareSupply chain
Added Sat 18 Jul
Malware-Slop: Crypto Stealer Impersonating Polymarket Exposes Its Own Credentials
Then Exposes Its Own GitLab Credentials Overview The OX Research team recently discovered a malicious npm package cryptocurrency theft and credential exfiltration campaign. The package specifically impersonates target high-value crypto users. In a new…
MalwareInfostealersSupply chain
Added Thu 9 Jul
Threat Assessment: TeamPCP - CanisterWorm & Kubernetes Wiper Campaign
No excerpt available.
MalwareSupply chain
Added Wed 10 Jun
The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
On June 8, 2026, version 0.8.101 of the popular graph machine learning package ensmallen on PyPI was identified as containing a highly sophisticated supply chain compromise. Concurrently, a series of related packages in the computational biology,…
MalwareSupply chain
A rigged game: ScarCruft compromises gaming platform in a supply-chain attack
ESET researchers uncovered a multiplatform supply-chain attack by North Korea-aligned APT group ScarCruft, targeting the Yanbian region in China – home to ethnic Koreans and a crossing point for North Korean refugees and defectors. In the attack, probably…
MalwareSupply chainMobile
Added Thu 14 May
jsonspack: Multi-Tenant Node.js RAT — DPRK Supply Chain Campaign
Note — jsonspack vs legitimate jsonpack : jsonpack is a legitimate npm JSON compression library published by sapienlab in 2013, maintained through 2022, with 1.1.5 as the final version.P2 (Footnote prefixes: E = evidence, P = prior art, R = references, A =…
MalwareSupply chain
Added Wed 6 May
Tracking & Detecting GhostSocks Malware
Software supply-chain attacks now represent the primary threat shaping the 2026 security landscape. Rather than relying on exploits at the perimeter, attackers are targeting the connective tissue of modern engineering environments: package managers, CI/CD…
MalwareSupply chain
Quasar Linux (QLNX) – A Silent Foothold in the Supply Chain: Inside a Full-Featured Linux RAT With Rootkit, PAM Backdoor, Credential Harvesting Capabilities
Quasar Linux RAT (QLNX) is a comprehensive Linux implant that combines remote access capabilities with advanced evasion, persistence, keylogging, and credential harvesting features. The malware carries embedded C source code for both its PAM backdoor and…
MalwarePhishingSupply chain
Added Wed 29 Apr
Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading
In mid-September 2025, security researchers first identified a supply-chain compromise in the npm ecosystem, the original Shai-Hulud campaign. The first known compromised package was @ctrl/tinycolor version 4.1.1. Only two months later, a far more aggressive…
Supply chain
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40 Packages
Socket proactively blocks malicious open source packages in your code. Install Update (September 16, 2025): This campaign has expanded significantly. Our follow up documents nearly 500 affected npm packages, including several open source CrowdStrike packages.…
Supply chain
Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack
The Shai‑Hulud 2.0 supply chain attack represents one of the most significant cloud-native ecosystem compromises observed recently. Attackers maliciously modified hundreds of publicly available packages, targeting developer environments, continuous…
Supply chain
Added Thu 23 Apr
Deep into the SunBurst Attack
During the week of December 13th, we witnessed what many are calling one of the biggest cyberattacks in recent times. SunBurst, the malware installed on SolarWinds’ Orion product, perpetrated what seems like a nation-state sponsored supply chain attack, and…
Supply chain
Added Fri 17 Apr
GrayCharlie Hijacks Law Firm Sites in Suspected Supply-Chain Attack
Insikt Group has been monitoring GrayCharlie, a threat actor overlapping with SmartApeSG and active since mid-2023, for some time, and is now publishing its first report on the group. GrayCharlie compromises WordPress sites and injects them with links to…
MalwareSupply chain
Added Mon 6 Apr
Detection of Compromise Software Supply Chain, Detection Strategy DET0721
Privacy Policy Storage Preferences Targeted Advertising Personalization Analytics Source: https://attack.mitre.org/detectionstrategies/DET0721
Supply chain
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.