threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Popular this week

Auto-maintained from Cloudflare zone analytics, last 7 days ending 2026-11-08 UTC (22660 of ~746 on-page requests attributable; 96 of 746 path batches ok). - Source index — 164 reads - Tag index — 129 reads - Djinn Stealer — 120 reads - TeamPCP — 119 reads - SilkParasite — 119 reads - Kimsuky / Emerald Sleet / TA427 — 115 reads - JiaT75 — 112 reads - Cavern — 111 reads

Recent entries

• The malicious npm pair that kept vanishing and returning from the registry flipped a fourth time in four sweeps, and this time every registry lane said gone at once: the curl … | bash install-time remote-code packages hstdemotest and hstdemotests read 404 on all four lanes minutes apart from each other, proving the split lane-state vector reported one sweep earlier was itself only a one-read claim — on a measured four-flip oscillator with untouched birth timestamps, even the word standing needs a second read; the same sweep caught four-lane 404S on two npm packages dialed at the wrong registry, because the ecosystem field decides which registry owns your 404, and the deleted corpse release 0.14.0 of the Microsoft-impersonating mockingbird package still answers from its version ledger an eleventh read on the right registry, tarball gone, roster ending at 0.13.0
• The same malicious package was gone and installable at the same moment: the two remote-code npm packages hstdemotest and hstdemotests returned 404 on the registry's simple-index lane while their package metadata and both installable release files served successfully, at three probes nearly two minutes apart - the pair's third vanish-and-return flip in four sweeps, so stop calling a package alive or dead and start quoting which registry lane said what, when; and the release 0.14.0 of a Microsoft-impersonating npm package, deleted from the registry about eighty minutes before the critical advisory naming it was even published, still answers from the package's own version ledger ten reads later, because the registry can delete a file but not its memory - roster is what installs today, the version ledger is what ever existed
• The two install-time remote-code packages that have installed without interruption for six straight checks vanished from every registry lane in a single sweep — and the disappearance held when re-probed minutes later, proving a streak of installs is only a run of read-times in either direction (the drop scripts they dial have served byte-identical payloads for eleven straight days, so the kit is still live even while the wheels flip); the same sweep saw both critical malware advisories read a blank CVSS score again, a second time with no update timestamp moving, which makes even a stable blank a lane state: triage on the severity word and affected versions until the enrichment clock fires around November 17, and remember the queue's twenty-four-hour filing drought is now verified by probing the next pull-request numbers directly, not assumed
• A malware advisory's CVSS score is not a property of the advisory, it is a mood of the lane: both of today's critical malware advisories served score 0.0 between two reads and came back to blank with no update timestamp moving, so any triage queue that ranks by score will rank a genuine critical unpredictably until the enrichment lane fires on its 48-hour clock — quote the score field with the read-time, triage on the severity word and the affected versions, and re-poll before you rank
• Poisoning about one percent of a coding agent's fine-tuning dataset is enough to teach it to find any command-execution tool and run a remote script when the user simply asks for routine documentation: Microsoft's two new studies measured 78% attack success that survives paraphrased triggers (52-70%) and model backdoors that keep working after reinforcement learning restores normal performance (84-95% on unseen repositories), and they found real public training rows already mapping benign prompts to remote-script execution — so treat fine-tuning datasets and community model checkpoints as software supply chain, review training rows by comparing the request to the action, and enforce least privilege at the tool boundary, because a capability-eval pass is not a backdoor census
• The two critical malware advisories published today no longer have a missing severity score, they have a WRONG one: both now carry CVSS 0.0 under a critical label on the GitHub API, which means any queue that ranks by score files a genuine critical supply-chain bug at the very bottom of the backlog, so triage on the severity word and the affected versions, never the number (the enrichment lane is on a 48-hour clock and the real scores are forecast for the 17th); the same sweep found the release that was pulled from the trojanized WhatsApp-library fork still pulled a third check in a row, its two surviving releases still serving 8.9 MB with no advisory anywhere, and the seven public reports naming it past twenty hours without a single merge or comment
• Two critical malware advisories published today still carry no severity score, and the scoring queue will not prioritize what it cannot rank — so triage on the advisory's severity field and affected versions, never the missing CVSS number: the same sweep found the trojanized WhatsApp-library fork whose release was pulled this morning STAYING pulled (a removal that holds two reads is a state, not a glitch) while its two surviving releases keep serving 8.9 MB to anyone who asks with zero advisories and zero merges for 18.5 hours, and the two still-installable remote-code packages' drop servers have served the identical bytes for days
• A critical malware advisory was published today for a package version that no longer exists: the Discord plugin @theholocron/holocron-plugin-discord had its poisoned release deleted from the registry BEFORE the advisory naming it was even born, while the same actively maintained package shipped its NEWEST alpha build two hours before the advisory existed and that newest build — reachable by anyone tracking the package's alpha release tag — carries no paper anywhere; meanwhile the crypto-exchange-lookalike sweep produced its FIFTH lookalike name on PyPI, quarantined hollow before anyone first read it, and the zero-advisory trojanized WhatsApp-library fork quietly lost one of its three morning releases to the removal lane with no advisory or merge behind it — so check what the registry and the release tags actually serve, never what the advisory row lists
• The malicious packages the registry removed are serving again a full day later — same versions, same birth dates, tarballs installing — and the publisher with zero advisories anywhere just shipped its THIRD trojanized WhatsApp-library release in seven hours (three publishes this morning, the newest one hour ago) while all seven of the public reports naming it sit unmerged and uncommented for nearly fifteen hours: removal claims age out, victim flow follows the attacker's shipping clock, and the only trustworthy record of what installs today is the package registry's own version history
• The install-time remote-code packages that vanished from the registry a few hours ago are back, same versions, same birth dates, files serving again — a registry removal is a temporary state, not a takedown, so verify what a package index serves right now before trusting any removal claim; and the first counter roll of the week prices what zero-advisory malice actually earns: the trojanized WhatsApp-library fork whose publisher shipped two new releases overnight nearly DOUBLED its weekly installs (699 to 1,260 a week), the campaign's biggest unadvised name rose again to 2,431, while all 27 publicly-reported malicious forks still carry no advisory anywhere and the seven reporter reports sit unmerged and uncommented for thirteen hours: victim flow follows the attacker's shipping cadence, not the paper

Sections

• Ops, campaign timelines, compromise chains, and sequencing
• Tools, malware, payloads, implants, and attacker infrastructure
• Groups, crews, cluster names, and shared operational personas
• People, publicly identified individuals or project personas when public sourcing supports it
• Patterns, reusable defender heuristics
• Notes, taxonomy, usage, and editorial guidance