Mend.io Malicious Packages

Mini Shai-Hulud Hits @antv: 323 npm Packages Compromised Through the atool Maintainer Account

Inside the RubyGems Supply Chain Attack: How Mend Defender Caught a Coordinated Flood Before It Spread

Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

CVE-2026-31431 (Copy Fail): Linux Kernel LPE

Shai-Hulud Strikes SAP: Supply Chain Worm Weaponized Claude Code to Compromise the CAP Framework

The Butlerian Jihad: Compromised Bitwarden CLI Deploys npm Worm, Poisons AI Assistants, and Dumps GitHub Secrets

A Poisoned Xinference Package Targets AI Inference Servers

Poisoned Axios: npm Account Takeover, 50 Million Downloads, and a RAT That Vanishes After Install

Famous Telnyx Pypi Package compromised by TeamPCP

TeamPCP Supply Chain Attack Part 2: LiteLLM PyPI Credential Stealer

CanisterWorm: The Self-Spreading npm Attack That Uses a Decentralized Server to Stay Alive

Shai-Hulud: The Second Coming

NPM Ecosystem Under Siege: Self-Propagating Malware Compromises 187 Packages in a Huge Supply Chain Attack

NPM Supply Chain Attack: Sophisticated Multi-Chain Cryptocurrency Drainer Infiltrates Popular Packages

Fake VS Code Extension on npm Spreads Multi-Stage Malware