Tracked topic
…distinct pieces of software . They’ve even automated their attacks using a tool dubbed Mini Shai-Hulud which is a really nasty self-spreading worm. Once it steals a single set of…
…For background, Miasma is a variant of the Mini Shai-Hulud worm, open-sourced by the threat group TeamPCP. It started its journey by compromising a Red Hat employee's GitHub account…
…On May 11, 2026 UTC, TanStack, a widely used open-source library, was compromised as part of a broader software supply chain attack known as Mini Shai-Hulud. Two employee devices in…
…On May 11, 2026 UTC, TanStack, a widely used open-source library, was compromised as part of a broader software supply chain attack known as Mini Shai-Hulud. Two employee devices in…
We've been tracking TeamPCP since March. This is the fifth major package in the same campaign. Full chronology: Mar 19 — Trivy compromised. CI/CD secrets harvested downstream. Mar 24 — LiteLLM 1.82.7/1.82.8 to PyPI via c…
A process can't leak a secret it never had.Shai-hulud, prompt-injection - you name it. They cannot steal what your agent (or an process) don't have.I run coding agents (Claude Code, Codex) on my own machines most of the …
…New macOS stealer campaign uses Script Editor in ClickFix attack New Infinity Stealer malware grabs macOS data via ClickFix lures Popular node-ipc npm package compromised to steal credentials Shai Hulud attack…
…Shai Hulud attack ships signed malicious TanStack, Mistral npm packages Popular node-ipc npm package compromised to steal credentials PyPI package with 1.1M monthly downloads hacked to push infostealer New npm…
…New Shai-Hulud malware wave compromises 600 npm packages Popular node-ipc npm package compromised to steal credentials Fake OpenAI repository on Hugging Face pushes infostealer malware GlassWorm malware attacks return via…
…It’s essentially a clone of TeamPCP’s Mini Shai-Hulud toolkit, which the threat actor open-sourced recently. Security firm Cloudsmith said the malware harvests OIDC (OpenID-Connect) token credentials that…
…in npm supply-chain attack Red Hat npm packages compromised to steal developer credentials New Shai-Hulud malware wave compromises 600 npm packages BlueNoroff Mastra AI Microsoft North Korea npm Saphire Sleet…
…Last week, hackers compromised several open source projects that pushed out malicious updates in a different hacking campaign that was called “Mini Shai-Hulud.” At least two OpenAI developers were compromised by…
