Poisoned Pipeline / Attack stories
Attack stories
Narrative reconstructions of supply-chain events. Real incidents, research discoveries, and demos are labelled.
Forged and timestamp-cloned commits planted a preinstall dropper in hugo-paper and mevn-cli
Git / GitHubnpmDeveloper workstation
5 mapped techniques
Stolen GitHub tokens planted a secret-dumping workflow in 850+ accounts and pulled the logs back through the API
12 mapped techniques
tensorlake 0.5.144 steals tokens, then wipes the home directory if they are revoked
npmGit / GitHubGitHub ActionsDeveloper workstationAI coding agentsVS Code / IDELinux distro / packagesWindows software
11 mapped techniques
@subql/common 5.8.3 published after a CI artifact swap
npmGitHub ActionsGit / GitHubCI/CD SaaSDeveloper workstationLinux distro / packages
8 mapped techniques
GhostAction steals CI secrets, then autoruns a stealer from a fake font
Git / GitHubGitHub ActionsVS Code / IDEDeveloper workstation
16 mapped techniques
Apex Accelerator published a malicious npm coding agent and a fake audit MCP
npmmacOS softwareWindows softwareMCPAI coding agentsGit / GitHubVS Code / IDEDeveloper workstation
7 mapped techniques
Rank Math PRO 3.0.123 downloads carried malware that plants a recreating backdoor
4 mapped techniques
Azazel harvested GitLab CI secrets and called a local MCP tool on a victim
GitLabGitLab CIGit / GitHubJenkinsMCPAI coding agentsLinux distro / packagesAWSKubernetes
6 mapped techniques
GlassWorm-hijacked contributor replaced OVHcloud CLI release assets on five published versions
Git / GitHubGitHub ActionsDeveloper workstationmacOS softwareLinux distro / packagesWindows software
6 mapped techniques
Railway build-infrastructure access decrypted a subset of customer environment variables
4 mapped techniques
Seven fake NebulaAI npm packages drop a Windows KNTRAT at install
npmWindows softwareDeveloper workstation
5 mapped techniques
An attacker accessed Zeabur internal systems and some customer services on 14 October
2 mapped techniques
Docker Hub token transfer re-assigned personal access tokens without revoking them
Docker / containersCertificates / trust stores
1 mapped techniques
testmetest npm names ship a Miasma-family worm that wipes the home directory if a stolen GitHub token is revoked
npmPyPIRubyGemsGit / GitHubGitLabGitHub ActionsDeveloper workstationAI coding agentsMCPVS Code / IDELinux distro / packagesmacOS softwareWindows software
10 mapped techniques
Forty-two RubyGems from reqthrottle_3474 run a reverse shell or a crypto stealer at install
RubyGemsDeveloper workstationLinux distro / packagesWindows software
8 mapped techniques
Stolen ConnectWise Cloud Backup application identities signed in to customer Microsoft 365 tenants
3 mapped techniques
LiteLLM 1.107.0 built from a lookalike repository shipped a startup-hook stealer and hourly loader
PyPIDocker / containersGit / GitHubGitHub ActionsDeveloper workstationLinux distro / packagesmacOS softwareWindows software
12 mapped techniques
PolinRider poisons visanduma/nova-two-factor Packagist via Git
Packagist / ComposerGit / GitHubVS Code / IDE
7 mapped techniques
pub.dev universal_file_viewer ships XCSSET (infected maintainer)
pub.dev / DartmacOS softwareDeveloper workstation
4 mapped techniques
Hijacked AI coding assistant spreads Shai-Hulud
PyPIGit / GitHubAI coding agentsVS Code / IDEDeveloper workstation
8 mapped techniques
TeamPCP DUSTMAKER AI workspace poisoning
npmGitHub ActionsAI coding agentsMCPGit / GitHubVS Code / IDE
5 mapped techniques
MacSync via signed fake Claude Desktop installers on a lookalike download site
macOS softwareAI coding agentsInstaller / update channel
7 mapped techniques
J7Tracker / VREO / Orbit Tracker steal Axiom and Padre session and wallet data
3 mapped techniques
PhantomRaven hidden HTTP npm dependencies
npmCircleCIGit / GitHubGitLabGitLab CIJenkinsPyPI
5 mapped techniques
Placeholder domain third-party.com turned live ClickFix server
CDN / web assetsAI coding agentsWindows softwareMCP
5 mapped techniques
Deep-Live-Cam malicious git dependency
PyPIGit / GitHubmacOS softwareWindows software
8 mapped techniques
MALFEX npm campaign, including a native imgdecode loader with no install script
npmWindows softwareGit / GitHubDeveloper workstation
6 mapped techniques
GHAPPIER loader via @dforge-core/dforge-mcp trusted publishing
npmMCPGit / GitHubGitHub Actions
7 mapped techniques
VHX Harvester panel ran npm typosquat recon into a vast.ai GPU-cloud intrusion
npmLinux distro / packagesAI coding agents
5 mapped techniques
DirtyBlanket fake Express/React packages spread a self-propagating Linux worm
npmLinux distro / packagesGit / GitHubAURCodeberg
10 mapped techniques
Microsoft counterfeit-installer campaign — same-named archives regenerate server-side per download
Windows softwareCDN / web assetsInstaller / update channel
7 mapped techniques
Packagist CMS themes delivering iOS spyware
Packagist / ComposerCDN / web assets
4 mapped techniques
Fake TradingView macOS installer via YouTube ad
macOS softwareInstaller / update channel
3 mapped techniques
Keyv / Cacheable ChainDrop worm
npmGitHub ActionsDeveloper workstationAI coding agentsKubernetes
8 mapped techniques
Virtualizor panel update delivered via BGP hijack of Softaculous update/billing infrastructure
Linux distro / packagesWindows software
6 mapped techniques
Hades .pth and AI-assistant config persistence
npmPyPIAI coding agentsLinux distro / packagesmacOS softwareMCPWindows softwareDeveloper workstation
4 mapped techniques
StubMaker RubyGems (and npm) Windows infostealer
RubyGemsnpmGit / GitHubLinux distro / packagesmacOS softwareWindows software
5 mapped techniques
Exposed operator staging host reveals autonomous AI-agent crypto-theft fleet
AI coding agentsWindows softwareLinux distro / packages
8 mapped techniques
Chrome and Edge crypto-wallet drainer extensions
Browser extensionsCDN / web assets
5 mapped techniques
Unclaimed packages in official llms.txt files
npmPyPIAI coding agentsCDN / web assets
5 mapped techniques
RevStealer trojanized Electron apps via fake Claude desktop and cheat sites
Git / GitHubWindows softwareAI coding agents
5 mapped techniques
BRIDGEHEAD npm typosquats jump WSL to a Windows wallet stealer
npmWindows softwareLinux distro / packagesGit / GitHub
4 mapped techniques
@copilot-mcp/apex macOS infostealer republish
npmmacOS softwareMCPGit / GitHubKubernetesVS Code / IDE
4 mapped techniques
BdThemes plugins poisoned through the vendor's banner feed
Git / GitHubCI/CD SaaSLinux distro / packages
3 mapped techniques
@mastra scope poisoned via typosquat easy-day-js
npmAI coding agentsGit / GitHubLinux distro / packagesmacOS softwareDeveloper workstation
6 mapped techniques
Multi-org GitHub PAT campaign mass-cloned repositories
Git / GitHubDeveloper workstation
2 mapped techniques
actions-cool GitHub Action tags still serve Mini Shai-Hulud after re-enablement
Git / GitHubGitHub ActionsVS Code / IDEAI coding agents
13 mapped techniques
Polymarket fake-bot and wallet-key npm campaign
npmGit / GitHubDocker / containers
4 mapped techniques
Nx Console VS Code 18.95.0 (GitHub internal repo theft)
VS Code / IDEGit / GitHubDeveloper workstationGitHub Actions
3 mapped techniques
TanStack Mini Shai-Hulud (CVE-2026-45321)
npmGitHub ActionsAI coding agentsVS Code / IDEDeveloper workstation
18 mapped techniques
CNCF Antrea Jenkins slash-command credential theft
Git / GitHubJenkinsGitHub Actions
6 mapped techniques
175 npm packages hosting phishing infrastructure
npmCDN / web assetsGit / GitHub
2 mapped techniques
Typosquat npm packages backdoor Claude Code SessionStart
npmAI coding agentsLinux distro / packagesGit / GitHub
3 mapped techniques
GlassWorm across GitHub, npm, Open VSX, VS Code, Python
Git / GitHubnpmVS Code / IDEPyPIBrowser extensions
4 mapped techniques
DAEMON Tools signed installers backdoored (Apr–May 2026)
Windows softwareInstaller / update channel
4 mapped techniques
Contagious Interview stage-2 in Git pre-commit / post-checkout hooks
Git / GitHubLinux distro / packagesmacOS softwareWindows softwareVS Code / IDE
4 mapped techniques
UNC7017 swapped AOMEI update config for minutes at a time
Windows softwareInstaller / update channel
7 mapped techniques
Trojanized fork martinez-polygon-clipping-tony
npmGit / GitHubWindows software
3 mapped techniques
Fake corepack.org infostealer and proxyware
npmWindows softwareInstaller / update channel
4 mapped techniques
Team PCP CI/CD secrets campaign
GitHub ActionsPyPICI/CD SaaSGitLab CIAzure PipelinesJenkinsBitbucketCircleCIAzureGitLabKubernetesMCP
12 mapped techniques
TraderTraitor interview repos point Terraform at a lookalike provider registry
TerraformGit / GitHubDeveloper workstationmacOS softwareLinux distro / packagesWindows softwareAWSGoogle Cloud
7 mapped techniques
react-refresh-update Meta library impersonation
npmGit / GitHubWindows software
3 mapped techniques
kubernetes-el workflow poisoned its repo
Git / GitHubGitHub ActionsLinux distro / packages
1 mapped techniques
PolinRider (DPRK) Git-to-registry jump
Git / GitHubGo modulesPackagist / ComposernpmVS Code / IDE
6 mapped techniques
hackerbot-claw autonomous GitHub Actions exploitation
GitHub ActionsGit / GitHubAI coding agentsVS Code / IDE
7 mapped techniques
npm packages hijack Cursor on macOS
npmmacOS softwareVS Code / IDEGit / GitHubWindows software
3 mapped techniques
DarkGPT / Codo-AI / bitcoin-auto-trading VS Code extensions
VS Code / IDEWindows softwareGit / GitHubmacOS software
5 mapped techniques
Named npm malware families (Skeleton Squad, Skuld, Quasar, FezBox, Koishi)
4 mapped techniques
Sha1-Hulud: The Second Coming
npmGitHub ActionsGit / GitHubLinux distro / packagesWindows softwareDeveloper workstation
4 mapped techniques
Non-npm registry one-offs (NuGet, Maven xz, Laravel Packagist, evm-units)
NuGetMaven / JavaPackagist / Composercrates.io
3 mapped techniques
Telegram, Discord, and WhatsApp-developer malware packages
npmPyPIRubyGemsBrowser extensionsCDN / web assets
4 mapped techniques
Shai-Hulud first wave (@ctrl/tinycolor)
npmGitHub ActionsGit / GitHubAI coding agentsDeveloper workstation
6 mapped techniques
Registry abuse, starjacking, OAST, and LLM-developer targeting
npmPyPIGit / GitHubAI coding agentsBrowser extensionsCDN / web assetsRubyGems
3 mapped techniques
Nx s1ngularity (stolen npm token via Actions injection)
npmGitHub ActionsAI coding agentsCI/CD SaaSGit / GitHubDeveloper workstation
8 mapped techniques
eslint-config-prettier phishing (npnjs.com) and node-gyp.dll
npmWindows softwareDeveloper workstation
4 mapped techniques
Notepad++ update-server hijack (Jun–Dec 2025)
Windows softwareInstaller / update channel
2 mapped techniques
Spoofed Dependabot commits and secret-stealing Actions
Git / GitHubGitHub ActionsDeveloper workstation
7 mapped techniques
DPRK Contagious Interview (BeaverTail / npm + git)
npmPyPIGit / GitHubVS Code / IDE
6 mapped techniques
CircleCI December 2022 / January 2023 incident
CI/CD SaaSCircleCIDeveloper workstation
6 mapped techniques
hautelook/phpass hijacked through GitHub organization
Packagist / ComposerGit / GitHub
1 mapped techniques
Stolen Heroku and Travis CI OAuth tokens cloned private GitHub repos
CI/CD SaaSTravis CIGit / GitHubnpm
3 mapped techniques
Operation SignSight trojanized VGCA installers on a government CA's download site
Windows softwareInstaller / update channelCertificates / trust stores
2 mapped techniques
Operation StealthyTrident compromised Able Desktop's update server
Windows softwareInstaller / update channel
2 mapped techniques
WIZVERA VeraPort plugin installed malware signed with stolen certificates
Windows softwareCertificates / trust stores
2 mapped techniques
GoldenSpy backdoor shipped inside bank-mandated tax software
Windows softwareInstaller / update channel
2 mapped techniques
fwupd dangling S3 bucket and CVE-2020-10759 signature-verification bypass
Linux distro / packagesInstaller / update channel
2 mapped techniques
Monero CLI binaries stole wallet seeds
Windows softwareInstaller / update channel
3 mapped techniques
PureScript installer dependencies were sabotaged
Windows softwareInstaller / update channel
1 mapped techniques
AppleJeus fake crypto trading apps carried malware from vendor-run sites
Windows softwaremacOS softwareInstaller / update channel
2 mapped techniques
Operation ShadowHammer (ASUS Live Update)
Windows softwareInstaller / update channel
5 mapped techniques
PEAR installer served Perl backdoor
Linux distro / packagesInstaller / update channel
3 mapped techniques
VestaCP installer leaked admin passwords
Windows softwareInstaller / update channel
1 mapped techniques
Webmin 1.890–1.920 build-server backdoor
Linux distro / packagesDeveloper workstation
7 mapped techniques
CCleaner 5.33 signed ShadowPad backdoor
Windows softwareDeveloper workstationInstaller / update channel
8 mapped techniques
NotPetya via M.E.Doc accounting-software updates
Windows softwareLinux distro / packagesInstaller / update channel
4 mapped techniques
HandBrake mirror delivered Proton RAT
macOS softwareInstaller / update channel
3 mapped techniques
FossHub served MBR-overwriting installers
Windows softwareInstaller / update channel
1 mapped techniques
WoSign and StartCom issued unauthorized certificates and backdated SHA-1 certs
1 mapped techniques
Linux Mint downloads served backdoored ISO
Linux distro / packagesWindows softwareInstaller / update channel
3 mapped techniques
TURKTRUST issued an intermediate CA certificate as if it were a server certificate
1 mapped techniques
DigiNotar CA breach produced a wildcard google.com certificate used in Iran
1 mapped techniques
vsftpd distribution site served backdoor
Windows softwareInstaller / update channel
3 mapped techniques
WordPress download enabled remote execution
Git / GitHubCI/CD SaaSWindows software
2 mapped techniques