Poisoned Pipeline / Platforms / AI coding agents
AI coding agents
37 mapped incident(s) that touched this platform or registry.
tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
npmGit / GitHubGitHub ActionsDeveloper workstationAI coding agentsVS Code / IDELinux distro / packagesWindows software
11 mapped techniques
Apex Accelerator published a malicious npm coding agent and a fake audit MCP
npmmacOS softwareWindows softwareMCPAI coding agentsGit / GitHubVS Code / IDEDeveloper workstation
7 mapped techniques
Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
GitLabGitLab CIGit / GitHubJenkinsMCPAI coding agentsLinux distro / packagesAWSKubernetes
6 mapped techniques
testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
npmPyPIRubyGemsGit / GitHubGitLabGitHub ActionsDeveloper workstationAI coding agentsMCPVS Code / IDELinux distro / packagesmacOS softwareWindows software
10 mapped techniques
Hijacked AI coding assistant spreads Shai-Hulud
PyPIGit / GitHubAI coding agentsVS Code / IDEDeveloper workstation
8 mapped techniques
TeamPCP DUSTMAKER AI workspace poisoning
npmGitHub ActionsAI coding agentsMCPGit / GitHubVS Code / IDE
5 mapped techniques
MacSync via signed fake Claude Desktop installers on a lookalike download site
macOS softwareAI coding agentsInstaller / update channel
7 mapped techniques
Placeholder domain third-party.com turned live ClickFix server
CDN / web assetsAI coding agentsWindows softwareMCP
5 mapped techniques
VHX Harvester panel ran npm typosquat recon into a vast.ai GPU-cloud intrusion
npmLinux distro / packagesAI coding agents
5 mapped techniques
Keyv / Cacheable ChainDrop worm
npmGitHub ActionsDeveloper workstationAI coding agentsKubernetes
8 mapped techniques
Hades .pth and AI-assistant config persistence
npmPyPIAI coding agentsLinux distro / packagesmacOS softwareMCPWindows softwareDeveloper workstation
4 mapped techniques
Exposed operator staging host reveals autonomous AI-agent crypto-theft fleet
AI coding agentsWindows softwareLinux distro / packages
8 mapped techniques
Unclaimed packages in official llms.txt files
npmPyPIAI coding agentsCDN / web assets
5 mapped techniques
RevStealer trojanized Electron apps via fake Claude desktop and cheat sites
Git / GitHubWindows softwareAI coding agents
5 mapped techniques
@mastra scope poisoned via typosquat easy-day-js
npmAI coding agentsGit / GitHubLinux distro / packagesmacOS softwareDeveloper workstation
6 mapped techniques
actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
Git / GitHubGitHub ActionsVS Code / IDEAI coding agents
13 mapped techniques
TanStack Mini Shai-Hulud (CVE-2026-45321)
npmGitHub ActionsAI coding agentsVS Code / IDEDeveloper workstation
18 mapped techniques
Typosquat npm packages backdoor Claude Code SessionStart
npmAI coding agentsLinux distro / packagesGit / GitHub
3 mapped techniques
hackerbot-claw autonomous GitHub Actions exploitation
GitHub ActionsGit / GitHubAI coding agentsVS Code / IDE
7 mapped techniques
Shai-Hulud first wave (@ctrl/tinycolor)
npmGitHub ActionsGit / GitHubAI coding agentsDeveloper workstation
6 mapped techniques
Registry abuse, starjacking, OAST, and LLM-developer targeting
npmPyPIGit / GitHubAI coding agentsBrowser extensionsCDN / web assetsRubyGems
3 mapped techniques