Poisoned Pipeline

Poisoned Pipeline / Platforms / Browser extensions

Browser extensions

18 mapped incident(s) that touched this platform or registry.

All platforms Browser extensions (18) npm (135)Git / GitHub (94)Windows software (52)Linux distro / packages (50)PyPI (38)AI coding agents (37)GitHub Actions (33)Developer workstation (33)CI/CD SaaS (25)Installer / update channel (25)VS Code / IDE (23)macOS software (19)CDN / web assets (17)RubyGems (12)Packagist / Composer (11)Certificates / trust stores (11)MCP (10)Go modules (7)crates.io (6)Docker / containers (6)NuGet (6)AUR (5)Kubernetes (5)GitLab (4)Jenkins (4)AWS (3)CircleCI (3)GitLab CI (3)Terraform (3)Azure (2)Maven / Java (2)Azure Pipelines (1)Bitbucket (1)Codeberg (1)Google Cloud (1)pub.dev / Dart (1)TeamCity (1)Travis CI (1)
2026-09

Malicious Firefox extension hijacks Google accounts

Browser extensions

3 mapped techniques

2026-09

Twitch browser extension leaks 30k OAuth tokens

Browser extensions

2 mapped techniques

2026-09

J7Tracker / VREO / Orbit Tracker steal Axiom and Padre session and wallet data

Browser extensions

3 mapped techniques

2026-09

WeaselBiscuit npm import-time stealer

npmBrowser extensions

4 mapped techniques

2026-08

Firefox Add-ons crypto-wallet theft

Browser extensions

5 mapped techniques

2026-08

Chrome and Edge crypto-wallet drainer extensions

Browser extensionsCDN / web assets

5 mapped techniques

2026-08

737 Chrome VPN extensions brand impersonation

Browser extensions

2 mapped techniques

2026-04

108 Chrome extensions shared-C2 session theft

Browser extensions

2 mapped techniques

2026-04

GlassWorm across GitHub, npm, Open VSX, VS Code, Python

Git / GitHubnpmVS Code / IDEPyPIBrowser extensions

4 mapped techniques

2026-04

131 WhatsApp spamware Chrome extensions

Browser extensions

2 mapped techniques

2026-03

Fake imToken Chrome extension seed-phrase theft

Browser extensions

2 mapped techniques

2025-12

Socket Chrome-extension theft cluster

Browser extensions

3 mapped techniques

2025-10

Crypto-developer package theft (Flashbots, BSC, Solana, TON)

npmPyPIBrowser extensions

3 mapped techniques

2025-09

Telegram, Discord, and WhatsApp-developer malware packages

npmPyPIRubyGemsBrowser extensionsCDN / web assets

4 mapped techniques

2025-08

Registry abuse, starjacking, OAST, and LLM-developer targeting

npmPyPIGit / GitHubAI coding agentsBrowser extensionsCDN / web assetsRubyGems

3 mapped techniques

2023-12

Ledger Connect Kit shipped wallet drainer

Browser extensions

3 mapped techniques

2020-10

Nano extensions shipped malicious updates

Browser extensions

1 mapped techniques

2020-10

The Great Suspender Chrome extension hijacked

Browser extensions

1 mapped techniques