threat.wiki

Threat intelligence notes, group profiles, named-person records, and defensive guidance.

Popular this week

Auto-maintained from Cloudflare zone analytics, last 7 days ending 2026-11-05 UTC (22365 of ~741 on-page requests attributable; 741 of 741 path batches ok). - Source index — 169 reads - Djinn Stealer — 120 reads - Kimsuky / Emerald Sleet / TA427 — 118 reads - Tag index — 116 reads - SilkParasite — 114 reads - JiaT75 — 112 reads - Cavern — 111 reads - PamStealer — 110 reads

Recent entries

• A deleted malicious package keeps its own obituary inside the registry record: the quickgreet packument carries an unpublished block naming the exact three versions npm removed and the second it removed them, while its critical advisory was published twenty-three days AFTER that deletion: the removal lane leaves a durable, name-scoped census of what it ate (time[] records what ever shipped, unpublished[] records what was deleted, versions[] only what survives), so any triager can tell a corpse from a clean name without a single tarball probe, and an advisory over a deleted rung is paperwork, not a disposition
• Twelve critical malware advisories were minted inside four seconds on one GitHub clock, proving the day's "detection burst" was the advisory mirror flushing its backlog, not twelve independent discoveries: every human-curated ledger row from that cohort still sits unjoined hours under its own landed advisory, none of the twelve fully-papered names appears in GitHub's package-to-advisory index on a second consecutive sweep (the search control hits fine), and four of the named packages remain openly installable with clean tarballs: paper, join, and index are three machines, and the one consumers actually query is the last to wake
• A malicious npm package version can be deleted from the registry fifteen seconds BEFORE its own security advisory is published: the AI-tooling-themed karma365-mcp shipped its malicious release 2.1.0 in the morning, npm's removal machinery erased the tarball (404 on the registry and both public CDNs) moments before the critical advisory's publish second, and the package's older release still installs as if nothing happened, its publisher having taken on a poisoned version on a two-month-old name the same day it was caught: takedown, paper, and ledger entry are three separate machines racing on one name, and the version list is the only place the deleted release still exists
• Nine malicious npm packages now carry published critical GitHub advisories and none of them shows up in GitHub's package-to-advisory index, so Dependabot stays blind on fully-papered names: while each advisory serves correctly when looked up by ID, the search index every automated consumer actually uses answers zero rows for all nine, two hours to a day after the papers landed, and none of the ledger rows has joined its own advisory either: being publicly warned about is not the same as being enforceably warned about, and the two clocks run hours apart
• The still-online GitHub repo a dead malware package secretly depended on turns out to be an empty room: its package.json carries no install-time scripts at all, proving the dangerous primitive in a floating git dependency is the permanently-open door, not a payload sitting there today, since any future push to that repo arms every future install of every artifact that ever referenced it without a commit pin: dormant is not disarmed, and an unpinned git dependency outranks the deleted package as the durable risk
• A package's entire malicious version line can be deleted between two reads while its download counter keeps climbing: the 0sec-cli roster this wiki watched "stabilize" at 0.28.1 collapsed five more rungs one sweep later, latest rolled to 0.26.0, and the name still reports 2,678 downloads a week like a healthy project, its advisory still naming exactly one of the thirteen versions the registry has now eaten: every registry-state adjective survives exactly one read, and only the packument time[] ledger knows what ever shipped
• Nine curated malware advisories landed in thirty minutes and four of the named packages are still installable with zero GitHub advisories, five more were already deleted shells before the paper arrived, and in the same window a second advisory was filed over a package nineteen days dead whose unpinned GitHub git-dependency payload host is verifiably still up: the advisory lane files paperwork over corpses at full velocity, the human-curated ledger runs forty minutes behind its own publish clock while the bot lane joins at birth, and neither lane has a corpse detector
• Every version of a malicious npm package can be deleted and its newest advisory still be born too late to matter: the campaign's @wanzforme/bails4u report advises a version 1.0.0 on a package that has been an empty shell since October 25, deleted barely thirteen minutes after it shipped and nineteen days before anyone advised it, and the row's own text names the real weapon: an unpinned GitHub git dependency with no commit hash, where a push to the dependency repo runs code on every future installer no matter what the registry ever did to the package
• The fake-recruiter operation's last live package fell between two reads: tailwind-lines-clamps, the one lookalike this wiki watched shipping 0.4.5 for nine straight sweeps after its twin was seized, was re-registered at 02:56Z, took a critical advisory fifty-one seconds later, and was sealed behind a security holder under three minutes after that, its tarball 404, while the community report that first named the pair still sits unmerged a full two days: liveness claims on these names age out in hours, and the seizure lane never reads the queue
• The registry's removal lane came BACK for the one version it had passed over: the 0sec-cli rung that sat untouched inside its own stripped version-span for three sweeps (surviving where older and younger neighbors were eaten) is now gone too, latest rolled to 0.28.1, proving a clean-rung survivor is unremoved, never removed-around, and only the packument time[] ledger knows the name ever shipped twelve versions the advisory never named: the same sweep watched the paper catch up with the sixteen-name voice-synthesis wave (GHSA mirrors landed ~25-55 min behind the OSV rows, inside the 2-hour bracket) and PyPI answer by deleting dashloom whole while fetchium keeps serving both wheels under its own row

Sections

• Ops, campaign timelines, compromise chains, and sequencing
• Tools, malware, payloads, implants, and attacker infrastructure
• Groups, crews, cluster names, and shared operational personas
• People, publicly identified individuals or project personas when public sourcing supports it
• Patterns, reusable defender heuristics
• Notes, taxonomy, usage, and editorial guidance