Poisoned Pipeline / Platforms / Linux distro / packages
Linux distro / packages
50 mapped incident(s) that touched this platform or registry.
tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
npmGit / GitHubGitHub ActionsDeveloper workstationAI coding agentsVS Code / IDELinux distro / packagesWindows software
11 mapped techniques
@subql/common 5.8.3 published after a CI artifact swap
npmGitHub ActionsGit / GitHubCI/CD SaaSDeveloper workstationLinux distro / packages
8 mapped techniques
Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
GitLabGitLab CIGit / GitHubJenkinsMCPAI coding agentsLinux distro / packagesAWSKubernetes
6 mapped techniques
GlassWorm-hijacked contributor replaced OVHcloud CLI release assets on five published versions
Git / GitHubGitHub ActionsDeveloper workstationmacOS softwareLinux distro / packagesWindows software
6 mapped techniques
testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
npmPyPIRubyGemsGit / GitHubGitLabGitHub ActionsDeveloper workstationAI coding agentsMCPVS Code / IDELinux distro / packagesmacOS softwareWindows software
10 mapped techniques
Forty-two RubyGems from reqthrottle_3474 run a reverse shell or a crypto stealer at install
RubyGemsDeveloper workstationLinux distro / packagesWindows software
8 mapped techniques
LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
PyPIDocker / containersGit / GitHubGitHub ActionsDeveloper workstationLinux distro / packagesmacOS softwareWindows software
12 mapped techniques
VHX Harvester panel ran npm typosquat recon into a vast.ai GPU-cloud intrusion
npmLinux distro / packagesAI coding agents
5 mapped techniques
DirtyBlanket fake Express/React packages spread a self-propagating Linux worm
npmLinux distro / packagesGit / GitHubAURCodeberg
10 mapped techniques
Virtualizor panel update delivered via BGP hijack of Softaculous update/billing infrastructure
Linux distro / packagesWindows software
6 mapped techniques
Hades .pth and AI-assistant config persistence
npmPyPIAI coding agentsLinux distro / packagesmacOS softwareMCPWindows softwareDeveloper workstation
4 mapped techniques
StubMaker RubyGems (and npm) Windows infostealer
RubyGemsnpmGit / GitHubLinux distro / packagesmacOS softwareWindows software
5 mapped techniques
Exposed operator staging host reveals autonomous AI-agent crypto-theft fleet
AI coding agentsWindows softwareLinux distro / packages
8 mapped techniques
BRIDGEHEAD npm typosquats jump WSL to a Windows wallet stealer
npmWindows softwareLinux distro / packagesGit / GitHub
4 mapped techniques
BdThemes plugins poisoned through the vendor's banner feed
Git / GitHubCI/CD SaaSLinux distro / packages
3 mapped techniques
@mastra scope poisoned via typosquat easy-day-js
npmAI coding agentsGit / GitHubLinux distro / packagesmacOS softwareDeveloper workstation
6 mapped techniques
Typosquat npm packages backdoor Claude Code SessionStart
npmAI coding agentsLinux distro / packagesGit / GitHub
3 mapped techniques
Contagious Interview stage-2 in Git pre-commit / post-checkout hooks
Git / GitHubLinux distro / packagesmacOS softwareWindows softwareVS Code / IDE
4 mapped techniques
TraderTraitor interview repos point Terraform at a lookalike provider registry
TerraformGit / GitHubDeveloper workstationmacOS softwareLinux distro / packagesWindows softwareAWSGoogle Cloud
7 mapped techniques
kubernetes-el workflow poisoned its repo
Git / GitHubGitHub ActionsLinux distro / packages
1 mapped techniques
Sha1-Hulud: The Second Coming
npmGitHub ActionsGit / GitHubLinux distro / packagesWindows softwareDeveloper workstation
4 mapped techniques
fwupd dangling S3 bucket and CVE-2020-10759 signature-verification bypass
Linux distro / packagesInstaller / update channel
2 mapped techniques
PEAR installer served Perl backdoor
Linux distro / packagesInstaller / update channel
3 mapped techniques
Webmin 1.890–1.920 build-server backdoor
Linux distro / packagesDeveloper workstation
7 mapped techniques
NotPetya via M.E.Doc accounting-software updates
Windows softwareLinux distro / packagesInstaller / update channel
4 mapped techniques
Linux Mint downloads served backdoored ISO
Linux distro / packagesWindows softwareInstaller / update channel
3 mapped techniques