https://security.microsoft.com/threatanalytics3

• Malicious npm packages abuse dependency confusion to profile developer environments

  Malicious npm packages abuse dependency confusion to profile developer environments A dependency confusion campaign leveraged 33 malicious npm packages to collect reconnaissance data from developer and build environments. This report details the attack chain, observed tradecraft

• Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft

  Mini Shai Hulud: Compromised @antv npm packages enable CI/CD credential theft Compromised @antv npm packages deploy the Mini Shai-Hulud payload to steal CI/CD secrets from Linux-based automation environments. The malware executes during npm install and targets credentials across

• Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

  Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign A large-scale npm supply chain attack compromised over 90 versions of @redhat-cloud-services packages, silently infecting CI/CD environments and developer systems. The malicious code steals cre

All reports →

• Connector · intel_report_ingest2