https://vigihq.com/attacks Real software supply chain attacks, one page each, with affected versions, sources and how to check. en Mon, 05 Oct 2026 00:00:00 GMT https://vigihq.com/attacks/apexacc-cli-defender-blinding-c2-loader https://vigihq.com/attacks/apexacc-cli-defender-blinding-c2-loader Thu, 17 Sep 2026 00:00:00 GMT npm @apexacc/cli 1.5.122 on npm turns off Windows Defender and Smart App Control, then runs commands from a server. How to check and clean up. https://vigihq.com/attacks/arrayref-internment-append-only-vec-crates-io-compro https://vigihq.com/attacks/arrayref-internment-append-only-vec-crates-io-compro Thu, 20 Aug 2026 00:00:00 GMT crates.io On 20 Aug 2026 attackers published arrayref 0.3.10, internment 0.8.7 and append-only-vec 0.1.9 on crates.io with a malicious dependency. https://vigihq.com/attacks/keyv-cacheable-npm-worm-shai-hulud-third-wave https://vigihq.com/attacks/keyv-cacheable-npm-worm-shai-hulud-third-wave Tue, 04 Aug 2026 00:00:00 GMT npm On 4 Aug 2026 a worm hit keyv 6.0.0, cacheable 2.5.1 and related npm packages. See the bad versions, indicators, a check command and the fix. https://vigihq.com/attacks/sleepergem-dormant-maintainer-rubygems-hijacks https://vigihq.com/attacks/sleepergem-dormant-maintainer-rubygems-hijacks Sat, 18 Jul 2026 00:00:00 GMT RubyGems SleeperGem hit RubyGems in July 2026: git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4 and a fastlane plugin 0.3.2. IOCs and checks. https://vigihq.com/attacks/mastra-ai-npm-compromise-sapphire-sleet https://vigihq.com/attacks/mastra-ai-npm-compromise-sapphire-sleet Wed, 17 Jun 2026 00:00:00 GMT npm 140+ @mastra npm packages, including mastra 1.13.1 and @mastra/core 1.42.1, gained the malicious easy-day-js dependency. Indicators and fixes. https://vigihq.com/attacks/onering-crate-build-script-code-exfiltration https://vigihq.com/attacks/onering-crate-build-script-code-exfiltration Wed, 10 Jun 2026 00:00:00 GMT crates.io onering 1.4.1 on crates.io ran a build script that sent your latest git commit diff to a Sentry endpoint. Here is how to check and respond. https://vigihq.com/attacks/microsoft-durabletask-pypi-compromise-teampcp https://vigihq.com/attacks/microsoft-durabletask-pypi-compromise-teampcp Tue, 19 May 2026 00:00:00 GMT PyPI Microsoft durabletask 1.4.1, 1.4.2 and 1.4.3 on PyPI carried a credential-stealing worm on 19 May 2026. See indicators, a check command and the fix. https://vigihq.com/attacks/nx-console-vs-code-extension-18-95-0-compromise-team https://vigihq.com/attacks/nx-console-vs-code-extension-18-95-0-compromise-team Mon, 18 May 2026 00:00:00 GMT IDE extension Nx Console VS Code extension 18.95.0 carried a credential stealer on 18 May 2026. Patched in 18.100.0. Indicators, checks and steps. https://vigihq.com/attacks/tanstack-npm-compromise-mini-shai-hulud https://vigihq.com/attacks/tanstack-npm-compromise-mini-shai-hulud Mon, 11 May 2026 00:00:00 GMT npm 84 malicious versions of 42 @tanstack packages, including router 1.169.5 and 1.169.8, stole CI secrets on 11 May 2026. Learn how to check. https://vigihq.com/attacks/jdownloader-official-site-installer-swap https://vigihq.com/attacks/jdownloader-official-site-installer-swap Wed, 06 May 2026 00:00:00 GMT vendor binary On 6-7 May 2026 the official JDownloader site served trojanized Windows and Linux installers. See who was affected, the indicators, and how to check. https://vigihq.com/attacks/cpuid-cpu-z-hwmonitor-download-compromise https://vigihq.com/attacks/cpuid-cpu-z-hwmonitor-download-compromise Thu, 09 Apr 2026 00:00:00 GMT vendor binary CPU-Z 2.19 and HWMonitor 1.63 downloads from cpuid.com carried STX RAT on 9-10 April 2026. See the indicators, how to check and what to do. https://vigihq.com/attacks/daemon-tools-trojanized-installers https://vigihq.com/attacks/daemon-tools-trojanized-installers Wed, 08 Apr 2026 00:00:00 GMT vendor binary Official signed DAEMON Tools Lite installers 12.5.0.2421 to 12.5.0.2434 carried a backdoor from 8 April 2026. Fixed in 12.6.0.2445. IOCs and checks. https://vigihq.com/attacks/axios-npm-2026 https://vigihq.com/attacks/axios-npm-2026 Tue, 31 Mar 2026 00:00:00 GMT npm Axios 1.14.1 and 0.30.4 on npm pulled in plain-crypto-js 4.2.1, which installs a remote access trojan. Versions, indicators and a check command. https://vigihq.com/attacks/litellm-pypi-2026 https://vigihq.com/attacks/litellm-pypi-2026 Tue, 24 Mar 2026 00:00:00 GMT PyPI LiteLLM 1.82.7 and 1.82.8 on PyPI stole cloud keys and SSH keys. See the indicators, how to check with pip, and why uninstalling is not enough. https://vigihq.com/attacks/trivy-2026 https://vigihq.com/attacks/trivy-2026 Thu, 19 Mar 2026 00:00:00 GMT CI action Trivy v0.69.4, trivy-action and setup-trivy were poisoned on 19 March 2026 (CVE-2026-33634). Timeline, indicators, safe versions and how to check CI. https://vigihq.com/attacks/offside-wallet-theft-factory-firefox-add-ons-convert https://vigihq.com/attacks/offside-wallet-theft-factory-firefox-add-ons-convert Mon, 09 Mar 2026 00:00:00 GMT browser extension Nine Firefox add-ons shipped as sports-score tools, then updated into fake Rabby wallet stealers. See the IDs, versions and how to check. https://vigihq.com/attacks/quicklens-shotbird-ownership-transfer-hijack https://vigihq.com/attacks/quicklens-shotbird-ownership-transfer-hijack Tue, 17 Feb 2026 00:00:00 GMT browser extension QuickLens (about 7,000 users) turned malicious on 17 Feb 2026 after a sale. ShotBird followed. See the extension IDs, behavior and how to check. https://vigihq.com/attacks/escan-antivirus-update-server-compromise-2026 https://vigihq.com/attacks/escan-antivirus-update-server-compromise-2026 Tue, 20 Jan 2026 00:00:00 GMT vendor binary On 20 Jan 2026 a hacked eScan regional update server pushed a trojanized reload.exe to customers. See the indicators, a check command and the fix. https://vigihq.com/attacks/trust-wallet-browser-extension-v2-68-compromise https://vigihq.com/attacks/trust-wallet-browser-extension-v2-68-compromise Wed, 24 Dec 2025 00:00:00 GMT browser extension Trust Wallet browser extension 2.68 stole seed phrases after a leaked Chrome Web Store API key. Fixed in 2.69. Indicators, checks and steps. https://vigihq.com/attacks/shai-hulud-2-0-second-wave https://vigihq.com/attacks/shai-hulud-2-0-second-wave Mon, 24 Nov 2025 00:00:00 GMT npm Shai-Hulud 2.0 backdoored 796 npm packages on 24 Nov 2025 with a preinstall script. Learn the indicators, how to check your tree and what to rotate. https://vigihq.com/attacks/shai-hulud-v2-reaches-maven-central-via-mvnpm-mirror https://vigihq.com/attacks/shai-hulud-v2-reaches-maven-central-via-mvnpm-mirror Mon, 24 Nov 2025 00:00:00 GMT Maven Shai-Hulud v2 reached Maven Central in org.mvnpm:posthog-node 4.18.1, a mirrored npm build. See the indicators, how to check and what to do. https://vigihq.com/attacks/glassworm-self-propagating-worm-on-open-vsx-vs-code- https://vigihq.com/attacks/glassworm-self-propagating-worm-on-open-vsx-vs-code- Fri, 17 Oct 2025 00:00:00 GMT IDE extension GlassWorm hid code in invisible Unicode inside Open VSX extensions such as codejoy.codejoy-vscode-extension 1.8.3 and 1.8.4. Indicators and checks. https://vigihq.com/attacks/chalk-debug-ansi-styles-maintainer-phishing-compromi https://vigihq.com/attacks/chalk-debug-ansi-styles-maintainer-phishing-compromi Mon, 08 Sep 2025 00:00:00 GMT npm On 8 Sept 2025 phishing let attackers publish 18 npm packages, including chalk 5.6.1 and debug 4.4.2, with crypto-theft code. Versions and checks. https://vigihq.com/attacks/nx-s1ngularity-compromise https://vigihq.com/attacks/nx-s1ngularity-compromise Tue, 26 Aug 2025 00:00:00 GMT npm Eight malicious nx releases, including 21.5.0 and 20.9.0, stole secrets with telemetry.js and local AI CLIs. See versions, indicators and fixes. https://vigihq.com/attacks/quickfox-vpn-trojanized-windows-installer https://vigihq.com/attacks/quickfox-vpn-trojanized-windows-installer Fri, 01 Aug 2025 00:00:00 GMT vendor binary The QuickFox Windows installer, 3.0.51.0 through 3.59.5, carried injected JavaScript that loaded the FDMTP backdoor. Fixed in 3.59.6. https://vigihq.com/attacks/num2words-hijack-pypi-phishing-campaign-scavenger-ma https://vigihq.com/attacks/num2words-hijack-pypi-phishing-campaign-scavenger-ma Mon, 28 Jul 2025 00:00:00 GMT PyPI PyPI package num2words 0.5.15 and 0.5.16 carried the Scavenger loader after a phishing attack on the maintainer. Indicators and checks. https://vigihq.com/attacks/eslint-config-prettier-eslint-plugin-prettier-phishi https://vigihq.com/attacks/eslint-config-prettier-eslint-plugin-prettier-phishi Fri, 18 Jul 2025 00:00:00 GMT npm On 18 July 2025 phishing led to bad eslint-config-prettier 8.10.1, 9.1.1, 10.1.6 and 10.1.7 that run a Windows DLL on install. CVE-2025-54313. https://vigihq.com/attacks/amazon-q-developer-for-vs-code-malicious-commit https://vigihq.com/attacks/amazon-q-developer-for-vs-code-malicious-commit Thu, 17 Jul 2025 00:00:00 GMT IDE extension Amazon Q Developer for VS Code 1.84.0 shipped a malicious commit with data-wiping prompts. Fixed in 1.85.0. See how to check and what to do. https://vigihq.com/attacks/gravity-forms-wordpress-plugin-compromise https://vigihq.com/attacks/gravity-forms-wordpress-plugin-compromise Wed, 09 Jul 2025 00:00:00 GMT other Gravity Forms 2.9.11.1 and 2.9.12, downloaded manually or by Composer on 9-11 July 2025, held a backdoor. Update to 2.9.13 and check for the indicators. https://vigihq.com/attacks/reddirection-campaign-color-picker-geco-and-17-other https://vigihq.com/attacks/reddirection-campaign-color-picker-geco-and-17-other Fri, 27 Jun 2025 00:00:00 GMT browser extension RedDirection: 18 Chrome and Edge extensions, including Color Picker Geco, turned malicious after updates and reported browsing to attacker servers. https://vigihq.com/attacks/ethcode-vs-code-extension-malicious-pull-request https://vigihq.com/attacks/ethcode-vs-code-extension-malicious-pull-request Tue, 17 Jun 2025 00:00:00 GMT IDE extension ETHcode 0.5.0 for VS Code shipped a fake dependency, keythereum-utils, that runs a hidden PowerShell script. Fixed in 0.5.1. Checks and steps. https://vigihq.com/attacks/gluestack-react-native-aria-compromise https://vigihq.com/attacks/gluestack-react-native-aria-compromise Fri, 06 Jun 2025 00:00:00 GMT npm 17 @react-native-aria and @gluestack-ui npm packages shipped a remote access trojan in June 2025. See versions, indicators and how to check. https://vigihq.com/attacks/notepad-update-infrastructure-compromise https://vigihq.com/attacks/notepad-update-infrastructure-compromise Sun, 01 Jun 2025 00:00:00 GMT vendor binary Attackers hijacked Notepad++ WinGUp update traffic in 2025 and delivered trojanized updates (8.8.2 to 8.8.9). Fixed in 8.9.1. See indicators and checks. https://vigihq.com/attacks/rvtools-installer-compromise-bumblebee https://vigihq.com/attacks/rvtools-installer-compromise-bumblebee Mon, 12 May 2025 00:00:00 GMT vendor binary A trojanized RVTools installer delivered the Bumblebee loader through version.dll in May 2025. Hash check, indicators and what to do. https://vigihq.com/attacks/rand-user-agent-rat-compromise https://vigihq.com/attacks/rand-user-agent-rat-compromise Mon, 05 May 2025 00:00:00 GMT npm rand-user-agent 2.0.83, 2.0.84 and 1.0.110 on npm carried a remote access trojan in May 2025. Clean: 2.0.82. IOCs, checks and steps. https://vigihq.com/attacks/xrpl-js-xrp-ledger-sdk-backdoor https://vigihq.com/attacks/xrpl-js-xrp-ledger-sdk-backdoor Mon, 21 Apr 2025 00:00:00 GMT npm xrpl npm versions 4.2.1 to 4.2.4 and 2.14.2 stole wallet keys. Fixed in 4.2.5 and 2.14.3. See indicators, how to check and what to do. https://vigihq.com/attacks/tj-actions-changed-files-github-action-compromise https://vigihq.com/attacks/tj-actions-changed-files-github-action-compromise Fri, 14 Mar 2025 00:00:00 GMT CI action On 14 Mar 2025 attackers repointed tj-actions/changed-files tags to a commit that leaked CI secrets (CVE-2025-30066). Fixed in v46.0.1. https://vigihq.com/attacks/reviewdog-action-setup-compromise https://vigihq.com/attacks/reviewdog-action-setup-compromise Tue, 11 Mar 2025 00:00:00 GMT CI action reviewdog/action-setup@v1 leaked CI secrets into workflow logs on 11 March 2025 (CVE-2025-30154). Affected actions, log check, and fixes. https://vigihq.com/attacks/cyberhaven-chrome-extension-compromise https://vigihq.com/attacks/cyberhaven-chrome-extension-compromise Wed, 25 Dec 2024 00:00:00 GMT browser extension Cyberhaven Chrome extension 24.10.4 stole cookies and sessions after a phishing attack on 24 Dec 2024. Fixed in 24.10.5. IOCs, checks and steps. https://vigihq.com/attacks/rspack-vant-npm-token-compromise https://vigihq.com/attacks/rspack-vant-npm-token-compromise Thu, 19 Dec 2024 00:00:00 GMT npm @rspack/core and @rspack/cli 1.1.7 and several vant versions shipped an XMRig miner via stolen npm tokens. Fixed in 1.1.8. See how to check. https://vigihq.com/attacks/december-2024-chrome-web-store-oauth-phishing-wave-b https://vigihq.com/attacks/december-2024-chrome-web-store-oauth-phishing-wave-b Wed, 18 Dec 2024 00:00:00 GMT browser extension Phishing for Chrome Web Store developer access let attackers push malicious updates to 35+ extensions in Dec 2024. See the IDs, domains and checks. https://vigihq.com/attacks/ultralytics-pypi-compromise-github-actions-cache-poi https://vigihq.com/attacks/ultralytics-pypi-compromise-github-actions-cache-poi Wed, 04 Dec 2024 00:00:00 GMT PyPI ultralytics 8.3.41, 8.3.42, 8.3.45 and 8.3.46 on PyPI installed an XMRig cryptominer. Indicators, how to check, and what to do. https://vigihq.com/attacks/aiocpa-crypto-pay-library-poisoned-release https://vigihq.com/attacks/aiocpa-crypto-pay-library-poisoned-release Wed, 20 Nov 2024 00:00:00 GMT PyPI aiocpa 0.1.13 and 0.1.14 on PyPI sent Crypto Pay API tokens to a Telegram bot. See affected versions, indicators, and how to check. https://vigihq.com/attacks/aiocpa-pypi-infostealer-implant https://vigihq.com/attacks/aiocpa-pypi-infostealer-implant Wed, 20 Nov 2024 00:00:00 GMT PyPI aiocpa 0.1.13 and 0.1.14 on PyPI hid an infostealer that sent Crypto Pay credentials to a Telegram bot. See indicators and how to check. https://vigihq.com/attacks/lottiefiles-lottie-player-compromise https://vigihq.com/attacks/lottiefiles-lottie-player-compromise Wed, 30 Oct 2024 00:00:00 GMT npm On 30 Oct 2024 attackers published @lottiefiles/lottie-player 2.0.5, 2.0.6 and 2.0.7 with a crypto wallet drainer. Clean: 2.0.4 and 2.0.8. https://vigihq.com/attacks/procolored-printer-software-malware-distribution https://vigihq.com/attacks/procolored-printer-software-malware-distribution Tue, 01 Oct 2024 00:00:00 GMT vendor binary Procolored printer software for the F8, F13, F13 Pro, V6, V11 Pro and VF13 Pro carried XRed and SnipVex malware until May 2025. Checks and steps. https://vigihq.com/attacks/gitlab-reported-chrome-extension-hijack-wave-16-exte https://vigihq.com/attacks/gitlab-reported-chrome-extension-hijack-wave-16-exte Thu, 04 Jul 2024 00:00:00 GMT browser extension Sixteen Chrome extensions, including Blipshot and KProxy, got malicious updates in 2024. See the extension IDs, domains, and how to check. https://vigihq.com/attacks/pingdomv3-revival-hijack https://vigihq.com/attacks/pingdomv3-revival-hijack Fri, 12 Apr 2024 00:00:00 GMT PyPI The pingdomv3 PyPI name was deleted and re-registered by a new owner who added code that fetches and runs remote Python in Jenkins builds. https://vigihq.com/attacks/javs-viewer-courtroom-recorder-backdoor https://vigihq.com/attacks/javs-viewer-courtroom-recorder-backdoor Tue, 05 Mar 2024 00:00:00 GMT vendor binary The JAVS Viewer 8.3.7.250-1 installer from the official site held a backdoor (CVE-2024-4978). Fixed in 8.3.8. See the indicators and how to check. https://vigihq.com/attacks/xz-utils-backdoor https://vigihq.com/attacks/xz-utils-backdoor Sat, 24 Feb 2024 00:00:00 GMT source tarball XZ Utils 5.6.0 and 5.6.1 contained a backdoor, CVE-2024-3094, that targeted sshd. Affected versions, how to check, and what to do.