Threat Watch– active
All incidents
More on Threat Watch
More GitHub incidents
- fcefi-wdojs-util npm package: malicious multi-stage dropper executes hidden payload on require, evades CI/sandboxes (no CVE) Critical · Supply chain
- strutil-helpers-core (npm): malicious load-time dropper with sandbox evasion executes attacker code on require Critical · Supply chain
- teahy-znrpz-util (npm): malicious package executes zlib-obfuscated payload via Function() on require, skipping CI environments Critical · Supply chain
- aurum-pay PyPI malware: remote code execution via hidden command execution on first SDK call Critical · Supply chain
- npm typosquat malware wave: redis-type-xyz, ioredis-xyz, express-helmet, helmify — full machine compromise on install Critical · Supply chain
- oracle-redis npm package is malware — full host compromise, no safe version Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.