Threat Watch– active
All incidents
More on Threat Watch
More unknown malicious publishers incidents
- PyPI loader malware campaign: dashloom & acustoviasr — malicious packages download and execute remote code (no CVE) Critical · Supply chain
- npm typosquat malware wave: ganach, soid-wallet, uniswa-v2-sdk-holesky, cosmjs-types-sovid — full machine compromise; no patched versions Critical · Supply chain
- npm typosquat malware wave: redis-type-xyz, ioredis-xyz, express-helmet, helmify — full machine compromise on install Critical · Supply chain
- npm malware wave: cronbits, taskpace, csvbits, jsonrail — malicious packages fully compromise installed machines (no CVE) Critical · Supply chain
- Malicious npm packages sms-activate.js, discord-user-parser, discord-badge-parser, discordjs-dm-parse — full host compromise Critical · Supply chain
- Malicious npm packages: moltbook-api-helper, moltbook-health, nodecheck-health, npm-scanner — full compromise of installed hosts Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.