Research reports
1,224 reports from 387 publishers45 added in the past week
7 reports, newest added first
Added Sun 25 Oct
From PostCSS Masquerading to Windows RAT
The package name is not random. The legitimate postcss-selector-parser package is widely used across the JavaScript build ecosystem, with npm reporting more than 150M weekly downloads. postcss-minify-selector-parser is not a classic one-character typo.…
MalwareSupply chain
Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installers
Overview of the Silver Fox AtlasCross campaign kill chain, from typosquatted lure domains through the triple-nested Setup Factory installer to fileless AtlasCross RAT deployment. Executive Summary A multi-stage remote access trojan campaign is actively…
MalwareSupply chain
Added Sat 24 Oct
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic
A fake Web3 accelerator has been observed pushing information stealers and backdoors to Windows and macOS systems using malicious npm packages under the pretext of offering free artificial intelligence (AI) credits for Anthropic Claude and Google Gemini,…
MalwareSupply chain
Investigating Ephemeral Supply Chain Tampering
Google Threat Intelligence Group (GTIG) and Mandiant investigated a software supply chain compromise campaign targeting the update infrastructure belonging to AOMEI Technology between April 2026 and July 2026. The threat actor conducted repeated, short-burst…
Supply chain
The GhostAction Campaign: 3,325 Secrets Stolen Through Compromised GitHub Workflows
TL;DR: GitGuardian discovered and investigated the GhostAction campaign, which compromised 327 GitHub users across 817 repositories, stealing 3,325 secrets through malicious workflows disguised as "Github Actions Security." Attackers extracted PyPI, npm,…
Supply chain
Supply-Chain Compromise via AOMEI Backupper
Published in coordination with Google Threat Intelligence Group and Mandiant. Their report on the wider UNC7017 campaign is available here. Detection: On 28 May 2026, ManageEngine EDR recorded AOMEI Backupper installing Radmin, a commercial…
Supply chain
Added Wed 14 Oct
Attackers Target Agents via The Skill Supply Chain
An active malware campaign used typosquatted skills, trojanized packages, and remote loaders to target users of popular AI tools. TL;DR We disrupted an active malware campaign targeting agents through typosquatted skills. It targets users of popular AI tools…
MalwareSupply chainAI
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.