Threat Watch– active
All incidents
More on Threat Watch
More unknown npm publisher incidents
- Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE) Critical · Supply chain
- Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installers (no CVE) Critical · Supply chain
- npm malware wave: casamare, ansi-sanitize, lineparse — malicious packages fully compromise installed machines Critical · Supply chain
- Malicious npm packages rampage-unpack, griffing-ui-pkg, griffing-ux-pkg, eigenlayer-sdk — full host compromise Critical · Supply chain
- npm typosquat malware wave: ganach, soid-wallet, uniswa-v2-sdk-holesky, cosmjs-types-sovid — full machine compromise; no patched versions Critical · Supply chain
- Off-registry HTTP tarball dependency: @rfewqa-fes/mnm-doc-mcp npm package delivers arbitrary code on install Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.