Research reports
1,224 reports from 387 publishers45 added in the past week
2 reports, newest added first
Added Fri 31 Jul
Compromised npm Packages: @joyfill/components and @joyfill/layouts Ship an Obfuscated Remote Access Trojan
On July 28, 2026, malicious beta versions of two Joyfill npm packages, @joyfill/components and @joyfill/layouts , were published to the npm registry. Both versions carry the same heavily obfuscated payload injected into the built distribution bundles. The…
MalwareSupply chain
Added Wed 10 Jun
The Hades Campaign: Graph ML PyPI Packages Deploy Cross-Platform Memory Scrapers, AI Analyst Misdirection, and a Wiper Deterrent
On June 8, 2026, version 0.8.101 of the popular graph machine learning package ensmallen on PyPI was identified as containing a highly sophisticated supply chain compromise. Concurrently, a series of related packages in the computational biology,…
MalwareSupply chain
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.