Tracked topic
… Researchers at OXsecurity, a company that secures applications from code to runtime, discovered the malicious uploads over the weekend and noticed that the threat actor used misspelled names typosquatting targeting Axios users, and some generic ones: chalk-tempalte – Shai-Hulud clone information st… …
… Given that Shai Hulud's code was recently leaked on GitHub by the TeamPCP threat group, and has already been used in attacks , attribution of the new Shai-Hulud campaign is more difficult. …
… Download Now Related Articles: TeamPCP hackers advertise Mistral AI code repos for sale Official SAP npm packages compromised to steal credentials Shai Hulud attack ships signed malicious TanStack, Mistral npm packages Bitwarden CLI npm package compromised to steal developer credentials Trivy vulne… …
Shai Hulud attack ships signed malicious TanStack, Mistral npm packages By Bill Toulas May 12, 2026 07:29 AM Hundreds of packages across npm and PyPI have been compromised in a new Shai-Hulud supply-chain campaign delivering credential-stealing malware targeting developers. …
… Download Now Related Articles: New GoGra malware for Linux uses Microsoft Graph API for comms Cybercrime service disrupted for abusing Microsoft platform to sign malware New Shai-Hulud malware wave compromises 600 npm packages Shai Hulud attack ships signed malicious TanStack, Mistral npm packages … …
… In the ongoing Shai-Hulud malware campaign attributed to TeamPCP hackers, dozens of TanStack packages infected with credential-stealing code were published on the npm index, compromising developer environments, including Grafana's. …
… Download Now Related Articles: Australia warns of ClickFix attacks pushing Vidar Stealer malware New Shai-Hulud malware wave compromises 600 npm packages Shai Hulud attack ships signed malicious TanStack, Mistral npm packages INTERPOL ‘Operation Ramz’ seizes 53 malware, phishing servers Popular nod… …
… Download Now Related Articles: Shai Hulud attack ships signed malicious TanStack, Mistral npm packages New npm supply-chain attack self-spreads to steal auth tokens PyPI package with 1.1M monthly downloads hacked to push infostealer Hackers compromise Axios npm package to drop cross-platform malwar… …
… Download Now Related Articles: New macOS stealer campaign uses Script Editor in ClickFix attack New Infinity Stealer malware grabs macOS data via ClickFix lures Popular node-ipc npm package compromised to steal credentials Shai Hulud attack ships signed malicious TanStack, Mistral npm packages Fake… …
… Send your offers to the communications below, we are not interested in under 50k, the best offer will get it." TeamPCP was previously linked to massive supply chain attacks targeting developer code platforms, including GitHub , PyPI , NPM , and Docker , and, more recently, to the "Mini Shai-Hulud"… …