Threat Watch– active
All incidents
More on Threat Watch
More GitHub incidents
- Dependency-confusion malware: @zmtcdn/components and @zmtcdn/ui npm packages exfiltrate host data via postinstall script Critical · Supply chain
- Dependency-confusion beacon packages: mw-communication-client, mw-test-utils, mui-wrapper-x-date-pickers exfiltrate user/host/cwd on install Critical · Supply chain
- spectral-net-probe (npm): malicious package exfiltrates local file contents via install-time and load-time callbacks Critical · Supply chain
- Dependency-confusion beacon package identity-two-factor targets Coinbase on npm Critical · Supply chain
- b20miner npm package: malicious cryptominer backdoor fully compromises installed hosts (no CVE) Critical · Supply chain
- @zaip-ai/cli npm package is malware — full machine compromise, no patched versions (GHSA-ffq4-h5jm-8pqr) Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.