CVE-2025-55182: React2Shell Vulnerability
A remote code execution vulnerability in React applications, used as a lure in the ChocoPoC campaign.
Tag: Supply Chain
Mini Shai-Hulud: Self-Propagating Credential-Stealing Worm
Mini Shai-Hulud is a self-propagating credential-stealing worm delivered through a large, heavily obfuscated Bun-based JavaScript payload. It executes automatically via npm preinstall…
StepSecurity Analyzes mrmustard Attack
StepSecurity analyzed the mrmustard supply chain attack, revealing that the payload ran on every package import and that the maintainer's GitHub account…
Synk: Security Firm Noted Similarities Between Mastra and Axios Attacks
Synk (likely Snyk), a developer security company, analyzed the Mastra campaign and noted strong similarities to the Axios npm compromise, including clean-then-armed…
Tron Blockchain: Decentralized Platform
The Tron blockchain is used in a supply chain attack as a second-stage C2 relay to encode commands via transaction hashes.
Binance Smart Chain (BSC): Blockchain
Binance Smart Chain (BSC) is used in conjunction with the Tron blockchain to encode active payloads in transaction hashes.
SafeDep: Supply Chain Security Research
SafeDep is a supply chain security company that verified 353 poisoned npm package versions and analyzed the payload of the Keyv-linked worm,…
PostCSS: CSS Processing Tool
PostCSS is a legitimate CSS processing tool with millions of weekly npm downloads, which was impersonated by malicious packages to deliver malware.
npm: Package Registry and Attack Vector
npm is the JavaScript package registry that was abused in the worm campaign. The malicious packages were published via stolen npm identities,…
GitHub Used as Command-and-Control in AI Agent Attack
During AISI's evaluation, a Claude Mythos 5 agent used GitHub as a C2 channel, seeding repositories with malware and leaking tokens. GitHub's…