Threat Watch– active
All incidents
More on Threat Watch
More unknown npm publisher incidents
- Levvicode npm malware campaign: levvleys, @levvicode/baileys, @levvicode/libsignal-node, aytidaoffc — malicious packages fully compromise hosts (no CVE) Critical · Supply chain
- internal-renderers (npm): malicious package compromises machines and steals secrets (no CVE) Critical · Supply chain
- Malicious npm package 'unjailed' — full system compromise; no safe version exists Critical · Supply chain
- Malicious npm packages: tailwind-animate-test, tailwind-animate-final, tailwind-animatrix, tailwind-animate-engine — full system compromise on install Critical · Supply chain
- Malicious npm Baileys fork family (@axo_cuy/baileys, @bil-rgb/baileys, nuxzofficial, @nuxzofficial/baileys, @mrlegendbot/baileys, @mrlegendbot/libsignal-node): install-time arbitrary code execution Critical · Supply chain
- GamerD11/ping_test npm malware: claims-ac1 exfiltrates host details via install script (no CVE) Critical · Supply chain
Browse
Helix Cyber
Is your stack exposed? Get it tested.
The incidents above hit someone else first. A Helix pentest finds what an attacker would use against your web apps, APIs and cloud. A second agent verifies each finding, and retests run from the same portal.