Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

NCSC UK

GCP Compute Engine Security

JVN Japan

GCP Kubernetes Security

AWS Security Bulletins

Tenable Research

CERT/CC

Microsoft Security Blog

Google Project Zero

Cisco Talos

Zero Day Initiative

Palo Alto Unit 42

Krebs on Security

Check Point Research

Kaspersky Security Blog

GCVE Database

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Reddit ExploitDev

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ThreatIntel

Reddit BlueTeam

Reddit Malware

Reddit Reverse Engineering

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

A self-replicating worm named Shai-hulud has been detected on the npm registry, spreading through compromised developer accounts and injecting malicious code into legitimate packages. The worm steals cloud service tokens, primarily targeting npm, GitHub, AWS, and GCP. It also installs Trufflehog to detect additional secrets. The compromised packages include popular ones with millions of weekly downloads. The worm's functionality includes auto-spreading, token theft, and exposing private repositories. Similarities with previous npm compromises have been noted. The impact is significant, affecting numerous developers and organizations across various industries.

The Shai-hulud worm is a self-replicating malware threat detected within the npm (Node Package Manager) ecosystem. It propagates by compromising developer accounts and injecting malicious code into legitimate npm packages, including some with millions of weekly downloads. Once a package is infected, the worm spreads automatically by modifying other packages, creating a supply chain infection that can rapidly escalate. The worm's primary malicious functionality is to steal cloud service tokens from environments such as npm, GitHub, AWS, and Google Cloud Platform (GCP). These tokens provide attackers with unauthorized access to cloud resources, potentially exposing sensitive data and infrastructure. Additionally, Shai-hulud installs Trufflehog, a tool used to scan repositories for secrets, which helps the worm identify and exfiltrate further credentials and private information. The worm also exposes private repositories, increasing the risk of intellectual property theft and further compromise. The infection vector leverages the trust developers place in open-source packages, making detection and mitigation challenging. Similarities with previous npm supply chain compromises suggest a recurring threat pattern targeting the open-source ecosystem. Although no known exploits are currently reported in the wild, the worm’s ability to self-propagate and steal high-value tokens makes it a significant threat to software supply chains and cloud environments.

Detailed information about Self-replicating Shai-hulud worm spreads token stealing malware on npm. Get real-time updates, technical details, and mitigation stra

Self-replicating Shai-hulud worm spreads token stealing malware on npm - Live Threat Intelligence - Threat Radar | OffSeq.com

Self-replicating Shai-hulud worm spreads token stealing malware on npm

Threats Tagged 'token-stealing'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'token-stealing'

Lead Pen Test Professional