Threat Watch– active
All incidents
More on Threat Watch
More N incidents
- Shai-Hulud descendant / Miasma worm: strutil-core Ruby gem — malicious 1.0.1 steals credentials, poisons AI tools, wipes files on token revocation Critical · Supply chain
- Apache Axis 1.x: unauthenticated class instantiation via SOAP fault exceptionName, RCE (CVE-2026-90436) Critical · Patch now
- Malicious npm package @needsaudit/n — full system compromise of any machine where installed (no CVE) Critical · Supply chain
- Malware in @needsaudit/nexport npm package — full host compromise, rotate all secrets Critical · Supply chain
- Malicious npm package @noinheritdoc/n — full system compromise on install (no CVE) Critical · Supply chain
- Malicious npm package @site-cms/ssr — full system compromise for anyone who installed it (no CVE) Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.