Research reports
1,224 reports from 387 publishers45 added in the past week
3 reports, newest added first
Added Thu 6 Aug
KICS GitHub Action Compromised: TeamPCP Strikes Again in Supply Chain Attack
The KICS GitHub Action was compromised with credential-stealing malware by TeamPCP, the same group behind the Trivy attack. KICS is an open source infrastructure as code security scanner by Checkmarx. Between 12:58 and 16:50 UTC on March 23rd, any users of…
MalwareSupply chain
Trivy Compromised: Everything You Need to Know about the Latest Supply Chain Attack
Update March 23, 17:40 UTC: Wiz Research has identified a parallel compromise of kics-github-action On March 19, 2026, threat actors compromised Aqua Security's Trivy vulnerability scanner, injecting credential-stealing malware into official releases and…
Supply chain
Mini Shai-Hulud Strikes Again: TanStack more npm Packages Compromised
On 11 May 2026, TeamPCP launched a coordinated supply chain attack against the npm and PyPi ecosystems, compromising packages across multiple namespaces simultaneously. May 13, 2026 2:30 UTC update: Further analysis of the @uipath/* and @mistralai/* npm…
Supply chain
Titles, excerpts and images come from each report or its publisher’s page, and every entry links to the publisher.