Threat Watch– active
All incidents
More on Threat Watch
More unknown npm publisher incidents
- Malicious npm packages: moltbook-api-helper, moltbook-health, nodecheck-health, npm-scanner — full compromise of installed hosts Critical · Supply chain
- Malicious npm package @generic-means/ing-feat-scanner-libs — full system compromise on install Critical · Supply chain
- npm typosquat malware wave: charape, @bestcoolman/dev-mcp, polymarket-stake-mathss, js-price-client-node — malicious packages fully compromise hosts Critical · Supply chain
- npm malware wave: archetype-index-sdk, file-saver-bg, react-bootstrap-table2-toolkit-bg, react-bootstrap-table-next-bg — full machine compromise Critical · Supply chain
- npm malware wave: focashi, dsh-ungate, @aaron205whitmore/postcss-animate-utils, template-cards — malicious packages fully compromise hosts Critical · Supply chain
- Malicious npm packages @velliajs/discord and @velliajs/telegram — full host compromise; rotate all secrets Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.