Threat Watch– active
All incidents
More on Threat Watch
More unknown attacker incidents
- 2026-11-reqnest: Malicious PyPI packages reqnest, reqnests, fhqiouhq, ajfhiuqhfqgwerhuqnfqh exfiltrate Telegram files on import Critical · Supply chain
- @sideeffects/n npm package is malware — full machine compromise, no safe version exists Critical · Supply chain
- Malicious npm package tw-motion-css — full system compromise on install; no safe version exists Critical · Supply chain
- Malicious npm package zero2-baileys — full host compromise on install (no CVE) Critical · Supply chain
- Malicious npm packages plain-lang and talk-lang flagged as malware — full system compromise Critical · Supply chain
- Dependency-confusion beacon campaign: wiasdcxc, wiselllx, wisewwasd, wxwxtt (npm) — postinstall exfiltrates host info Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.