Skip to content
Threat Feed
Subscribe

Product

AWS

3 briefs RSS
high advisory

Compromised node-ipc npm Package Steals Credentials

Hackers injected credential-stealing malware into newly published versions of the node-ipc npm package in a supply chain attack, collecting cloud credentials, SSH keys, CI/CD secrets, and other sensitive data, exfiltrating it through DNS TXT queries.

node-ipc +10 supply-chain-attack npm infostealer credential-theft
2r 3t 2i
critical advisory

Compromised intercom-client npm Package Exfiltrates Credentials

A compromised version (7.0.4) of the intercom-client npm package was published using a compromised developer account, containing obfuscated JavaScript that executed during installation to harvest and exfiltrate credentials from the environment, as part of the 'Mini Shai-Hulud' supply chain campaign.

intercom-client +5 supply-chain credential-theft npm
2r 2t
high advisory

Multi-Cloud CLI Token and Credential Access via Command-Line Harvesting

This rule detects command-line activity indicative of credential access across multiple cloud platforms (GCP, Azure, AWS, GitHub, DigitalOcean, Oracle, Kubernetes), looking for specific commands used to print or access tokens and credentials, flagging hosts where multiple cloud targets are accessed within a five-minute window, suggesting potential credential harvesting activity.

gcloud +6 credential-access cloud cli token-harvesting
3r 2t