Malicious Packages articles

PHP2Shell is in CISA KEV: why runtime visibility matters

PHP2Shell: the fix is a runtime upgrade, not a code change

Compromised LiteLLM 1.107.0 on PyPI Ships a Credential Stealer and Code Loader

Mini Shai-Hulud hits openapi-react-query-codegen: 10 malicious npm versions

Mini Shai-Hulud Hits keyv: Trojanized Release Exfiltrates CI Secrets via GitHub

RubyGems supply chain attack: malware used as a credential exfiltration dead drop

Mastra npm Scope Takeover: 140+ Packages Compromised via easy-day-js Dropper

Miasma: Red Hat Cloud Services npm Packages Hit by a Mini Shai-Hulud-Style Campaign

Laravel-Lang Composer tag-rewrite Supply Chain Attack

Mini Shai-Hulud Hits @antv: 323 npm Packages Compromised Through the atool Maintainer Account

Inside the RubyGems Supply Chain Attack: How Mend Defender Caught a Coordinated Flood Before It Spread

Mini Shai-Hulud Is Back: 172 npm and PyPI Packages Compromised in Latest Wave

PhantomRaven Wave 5: New Undocumented NPM Supply Chain Campaign Targets DeFi, Cloud, and AI Developers

CVE-2026-31431 (Copy Fail): Linux Kernel LPE

Shai-Hulud Strikes SAP: Supply Chain Worm Weaponized Claude Code to Compromise the CAP Framework

The Butlerian Jihad: Compromised Bitwarden CLI Deploys npm Worm, Poisons AI Assistants, and Dumps GitHub Secrets