Tag: ci/cd compromise

7 Attack Reports | 0 Vulnerabilities

Attack reports

Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious PyPI Wheels

A sophisticated supply chain attack campaign has expanded to 471 affected artifacts across npm and PyPI, targeting developers through malicious packages. The campaign uses three distinct delivery methods: executable .pth startup hooks, trojanized native .abi3.so extensions that execute at import ti…

credential theft

supply chain attack

ci/cd compromise

mini shai-hulud

javascript stealer

native extensions

Published: June 8, 2026

Downloadable IOCs: 2

The Worm That Keeps on Digging: Latest Wave

A sophisticated supply chain campaign targeting the open source developer ecosystem has emerged, compromising NPM packages in the @antv namespace, GitHub Actions including actions-cool/issues-helper, and the VSCode extension nrwl.angular-console. The malware initiates multi-stage infection chains u…

credential theft

supply chain attack

developer environments

backdoor persistence

cicd compromise

vscode extension

Published: May 19, 2026

Downloadable IOCs: 1

Active Supply Chain Attack Compromises Packages on npm

An active npm supply chain attack has compromised packages in the @antv ecosystem, affecting the maintainer account 'atool'. The attack is part of the Mini Shai-Hulud campaign, involving 639 compromised package versions across 323 unique packages. Notable affected packages include echarts-for-react…

credential theft

supply chain attack

ci/cd compromise

github exfiltration

mini shai-hulud

echarts-for-react

Published: May 19, 2026

Downloadable IOCs: 1

Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware

A supply chain operation dubbed 'Mini Shai Hulud' compromised SAP-related npm packages by injecting malicious preinstall scripts that execute during installation. The campaign leverages multi-stage payloads to harvest developer and CI/CD secrets from GitHub, npm, and major cloud providers, exfiltra…

credential theft

supply chain attack

ci/cd compromise

github exfiltration

mini shai hulud

Published: April 30, 2026

Downloadable IOCs: 10

The npm Threat Landscape: Attack Surface and Mitigations

The npm ecosystem experienced a critical shift in September 2025 with the Shai-Hulud worm, marking the transition from isolated attacks to systematic supply chain compromises. In April 2026, TeamPCP launched a coordinated campaign through a malicious @bitwarden/cli package targeting multiple distri…

credential harvesting

ci/cd compromise

worm propagation

self-replicating malware

Published: April 25, 2026

Downloadable IOCs: 4

Malicious Artifacts Found in Official KICS Docker Repository and Code Extensions

Docker and Socket uncovered a supply chain compromise affecting Checkmarx KICS distribution channels. Attackers poisoned official Docker Hub images (tags v2.1.20, v2.1.21, alpine) and VS Code extensions (versions 1.17.0, 1.19.0), introducing unauthorized data exfiltration capabilities. The trojaniz…

credential theft

ci/cd compromise

supply chain compromise

docker hub poisoning

npm propagation

vs code extension

Published: April 22, 2026

Downloadable IOCs: 13

Supply chain compromise spreads from Trivy to Checkmarx GitHub Actions

A threat actor known as TeamPCP expanded its supply chain attack from Aqua Security's Trivy to Checkmarx's AST GitHub Action. The attack, which began on March 19, 2026, involved injecting a credential-stealing payload into CI/CD pipelines across thousands of repositories. The malicious code harvest…

supply chain attack

teampcp cloud stealer

ci/cd compromise

Published: March 24, 2026

Downloadable IOCs: 0

Click here to see more Attack Reports