🧰 StepSecurity Threat Center

The items that name it 11

• OVHcloud CLI Compromised via GitHub Release Swap: Detonating the Real GlassWorm Loader and What We Found
  writeup2026-10-24It is written here as StepSecurity Threat Center: distributed the GHSA-862f-55f5-vmvw and loader/wallet IOCs to protected environments..
• litellm 1.107.0 Compromised on PyPI: Backdoored Wheels Drop a Credential Stealer and an Hourly Remote Code Loader
  writeup2026-10-21It is written here as StepSecurity Threat Center: shows the incident with IOCs, affected versions and remediation, with alerts via SIEM, Slack and email.
• Tensorlake npm Package Compromised: A Worm With a Hostage Token That Wipes Your Machine If You Revoke It
  writeup2026-10-08

  Published threat intel alert for this incident with affected version, IOCs, and triage steps; feeds into SIEM workflows

• Sckit Supply Chain Worm Hits MemTensor npm & PyPi scopes
  writeup2026-09-23

  Aggregates supply chain incident details, affected components, and remediation guidance; generates notifications via AWS S3, webhooks, Slack, and email.

• The State of Open Source Supply Chain Attacks
  article2026-08-23

  Real-time alerting on confirmed supply chain compromises, with indicators of compromise and an automated 'am I affected' check for customers.

• Rust Supply-Chain Attack: arrayref, internment, and append-only-vec Poisoned by the proc-macro1 Build-Time Dropper
  writeup2026-08-22

  Enterprise threat intelligence product; alerted customers to the campaign with full IOC set and maps indicators across an organization's repositories and pipelines

• jscrambler npm package publishes malicious preinstall binary
  writeup2026-07-12

  Delivers threat intel alerts with attack summaries, technical analysis, IOCs, affected packages/versions, and remediation steps directly into SIEM workflows

• Mass npm Supply Chain Attack: 20 Leo Platform Packages Compromised
  writeup2026-07-01

  Publishes threat intel alerts with attack summaries, technical analysis, IOCs, affected packages/versions, and remediation steps, delivered into existing SIEM workflows.

• Mastra npm Supply Chain Attack: 140+ Packages Backdoored via easy-day-js Typosquat
  writeup2026-06-18

  Publishes threat intel alerts with attack summaries, technical analysis, IOCs, affected package lists, and remediation steps delivered into SIEM workflows

• StepSecurity + Endor Labs: Mini-Shai-Hulud Wave 2
  writeup2026-05-19

  Publishes threat intel alerts with attack summary, technical analysis, IOCs, affected versions, and remediation steps delivered into SIEM workflows.

• Active Supply Chain Attack: Malicious node-ipc Versions Published to npm
  writeup

  Publishes threat intel alerts with attack summary, technical analysis, IOCs, affected versions, and remediation steps, delivered into SIEM workflows