Poisoned Pipeline / Platforms / macOS software
macOS software
19 mapped incident(s) that touched this platform or registry.
Apex Accelerator published a malicious npm coding agent and a fake audit MCP
npmmacOS softwareWindows softwareMCPAI coding agentsGit / GitHubVS Code / IDEDeveloper workstation
7 mapped techniques
GlassWorm-hijacked contributor replaced OVHcloud CLI release assets on five published versions
Git / GitHubGitHub ActionsDeveloper workstationmacOS softwareLinux distro / packagesWindows software
6 mapped techniques
testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
npmPyPIRubyGemsGit / GitHubGitLabGitHub ActionsDeveloper workstationAI coding agentsMCPVS Code / IDELinux distro / packagesmacOS softwareWindows software
10 mapped techniques
LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
PyPIDocker / containersGit / GitHubGitHub ActionsDeveloper workstationLinux distro / packagesmacOS softwareWindows software
12 mapped techniques
pub.dev universal_file_viewer ships XCSSET (infected maintainer)
pub.dev / DartmacOS softwareDeveloper workstation
4 mapped techniques
MacSync via signed fake Claude Desktop installers on a lookalike download site
macOS softwareAI coding agentsInstaller / update channel
7 mapped techniques
Deep-Live-Cam malicious git dependency
PyPIGit / GitHubmacOS softwareWindows software
8 mapped techniques
Fake TradingView macOS installer via YouTube ad
macOS softwareInstaller / update channel
3 mapped techniques
Hades .pth and AI-assistant config persistence
npmPyPIAI coding agentsLinux distro / packagesmacOS softwareMCPWindows softwareDeveloper workstation
4 mapped techniques
StubMaker RubyGems (and npm) Windows infostealer
RubyGemsnpmGit / GitHubLinux distro / packagesmacOS softwareWindows software
5 mapped techniques
@copilot-mcp/apex macOS infostealer republish
npmmacOS softwareMCPGit / GitHubKubernetesVS Code / IDE
4 mapped techniques
@mastra scope poisoned via typosquat easy-day-js
npmAI coding agentsGit / GitHubLinux distro / packagesmacOS softwareDeveloper workstation
6 mapped techniques
Contagious Interview stage-2 in Git pre-commit / post-checkout hooks
Git / GitHubLinux distro / packagesmacOS softwareWindows softwareVS Code / IDE
4 mapped techniques
TraderTraitor interview repos point Terraform at a lookalike provider registry
TerraformGit / GitHubDeveloper workstationmacOS softwareLinux distro / packagesWindows softwareAWSGoogle Cloud
7 mapped techniques
npm packages hijack Cursor on macOS
npmmacOS softwareVS Code / IDEGit / GitHubWindows software
3 mapped techniques
DarkGPT / Codo-AI / bitcoin-auto-trading VS Code extensions
VS Code / IDEWindows softwareGit / GitHubmacOS software
5 mapped techniques
AppleJeus fake crypto trading apps carried malware from vendor-run sites
Windows softwaremacOS softwareInstaller / update channel
2 mapped techniques
HandBrake mirror delivered Proton RAT
macOS softwareInstaller / update channel
3 mapped techniques