Related Threat Clusters

Supply Chain Attack Compromises Popular Rust Crates to Deliver Malware
On August 20, 2026, a supply chain attack targeted the Rust ecosystem, compromising the widely used crates arrayref, append-only-vec, and internment. The attackers injected a malicious dependency, proc-macro1, which…

22 articles · Updated August 20, 2026
Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages
A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into…

753 articles · Updated April 29, 2026
Malicious Joyfill npm Packages Distribute DEV#POPPER RAT and Credential Stealer
On July 28, 2026, two beta releases of Joyfill npm packages, @joyfill/layouts and @joyfill/components, were found to deliver the DEV#POPPER remote access trojan (RAT) and a credential stealer. The malware executes upon…

5 articles · Updated July 29, 2026

Recent Intelligence Reports

Malicious Rust Crate Arrayref Runs a Build — News.Ycombinator · August 20, 2026
Two Joyfill npm Packages Found Delivering DEV#POPPER Malware — Thecyberexpress · July 29, 2026
North Korean hackers expand supply chain attack campaign across ecosystems — Ground.News · July 3, 2026
North Korea — Cybersecuritynews · July 3, 2026
North Korean hackers expand supply chain attack campaign across ecosystems — Nknews · July 3, 2026
Hackers Compromise GitHub Maintainer Accounts to Publish PolinRider — Gbhackers · July 3, 2026