Skip to content
Threat Feed
Subscribe

Product

PyPI Packages

4 briefs RSS
critical advisory

Denying the Worm: Detecting SANDWORM_MODE and AI Toolchain Supply Chain Attacks

The SANDWORM_MODE campaign is a multi-stage npm supply chain worm that targets AI-augmented development workflows by exploiting runtime behaviors of AI coding assistants and CI/CD pipelines, leading to credential theft, supply chain poisoning, and persistence through obfuscated loaders, credential harvesting, and malicious Git hooks.

npm +16 supply-chain-attack git ai-toolchain development-workflow code-injection credential-theft persistence evasion
3r 14t 8i updated
high advisory

Shai-Hulud Campaign Activity

Tracking brief for the Shai-Hulud campaign; individual sightings are folded in as reported.

jscrambler 8.14.0 +101 campaign shai-hulud
20i updated
critical advisory

CVE-2026-9181: Unauthenticated Directory Traversal in ArcGIS Server

An unauthenticated attacker can exploit CVE-2026-9181, a critical directory traversal vulnerability in ArcGIS Server versions 12.0 and prior, by sending crafted path parameters to access sensitive files, leading to unauthorized information disclosure.

ArcGIS Server +17 directory-traversal web-vulnerability esri cve
2t 1i updated
critical advisory

Compromised OpenSearch Pre-Release npm Packages in Supply Chain Attack

Multiple npm and PyPi packages, including OpenSearch pre-release packages, were compromised in a supply chain attack, potentially leading to arbitrary code execution on developer or user systems.

OpenSearch +2 supply-chain-compromise npm pypi
2r 1t