Skip to content
Threat Feed
Subscribe

Product

Bitwarden CLI

3 briefs RSS
high threat

Vect and TeamPCP Partner for Ransomware Campaigns Exploiting Supply Chain Compromises

The threat groups Vect and TeamPCP have formally partnered since March 2026 to conduct widespread ransomware deployment and extortion campaigns by leveraging TeamPCP's credential harvesting and data theft capabilities, often initiated through supply chain compromises involving poisoned software updates and exploitation of critical vulnerabilities like CVE-2025-55182, leading to significant data exfiltration and encrypted systems across multiple sectors.

React Server Components +10 Vect +1 ransomware supply-chain-attack data-theft credential-access extortion python github pypi
1r 10t 1i updated
critical threat

Shai-Hulud Malware Used in Supply Chain Attack via Compromised npm Packages

The Shai-Hulud malware was used in a large-scale software supply-chain attack compromising hundreds of packages across open-source software ecosystems by compromising developer secrets and CI/CD pipelines.

router +11 TeamPCP supply-chain supply-chain-attack npm pypi credential-theft shai-hulud
3r 7t 3i
critical advisory

Compromised Bitwarden CLI npm Package Enables Credential Theft and Information Exfiltration

A remote attacker can exploit a compromised Bitwarden CLI npm package to steal credentials and exfiltrate sensitive information.

Bitwarden CLI supply-chain credential-theft exfiltration npm
2r 2t