Threat Watch– active
All incidents
More on Threat Watch
More unknown malicious publishers incidents
- pino-testkit campaign: loader-utils-kit, pino-std, @k.vict1999/pino-std-serializers — malicious npm packages execute obfuscated code on install/import (no CVE) Critical · Supply chain
- PhantomSub: malicious Baileys WhatsApp forks (@lekzox, @dyllxnn, @raffnotdev, @bellaxchan) silently subscribe victims to spam channels Critical · Supply chain
- hardhat-roof / hardhat-hold npm malware campaign: solidity-map, solidity-cat, solidity-gas-watcher ship droppers Critical · Supply chain
- npm typosquat malware wave: heheheshsds, thththtbhthhth, @saidddddddddd/* — malicious packages fully compromise installed machines (no CVE) Critical · Supply chain
- 2026-11-protecteda / 2026-11-filipt: Malicious PyPI packages protecteda, ln9qw38745g, zyto ship infostealer and RAT payloads Critical · Supply chain
- Malicious npm packages passwordcracker and passwordcrackv2 — full system compromise on install Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.