Threat Watch– active
All incidents
More on Threat Watch
More unknown malicious publishers incidents
- npm malware wave: focashi, dsh-ungate, @aaron205whitmore/postcss-animate-utils, template-cards — malicious packages fully compromise hosts Critical · Supply chain
- 2026-11-parseyaml campaign: extrahtml & parseyaml (PyPI) — malicious YAML-loader dependency downloads and executes remote code Critical · Supply chain
- Malicious npm packages plain-lang and talk-lang flagged as malware — full system compromise Critical · Supply chain
- pino-testkit campaign: loader-utils-kit, pino-std, @k.vict1999/pino-std-serializers — malicious npm packages execute obfuscated code on install/import (no CVE) Critical · Supply chain
- 2026-11-protecteda / 2026-11-filipt: Malicious PyPI packages protecteda, ln9qw38745g, zyto ship infostealer and RAT payloads Critical · Supply chain
- npm typosquat malware wave: heheheshsds, thththtbhthhth, @saidddddddddd/* — malicious packages fully compromise installed machines (no CVE) Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.