Index live· 1,284 files · 148 editions

Search the index

Search files, actors, editions, indicators and standards2 results

Try

Results for “Package compromise”Newest first

A Worm in the Registry, Wearing a Vendor’s Name

A credential-stealing worm in a major vendor’s npm namespace. The namespace is the trust signal, and it delivered the reviewer’s assumption too.

UnattributedPackage compromiseCloudSupply chain

Sev 46 June 2026TargetRed Hat-associated npm packagesActorUnattributed

Enterprise Packages, Consumer Registry, No Separation

The most heavily governed system in the organisation, with a dependency path that has no governance attached to it.

UnattributedPackage compromiseCloudSupply chain

Sev 38 April 2026TargetSAP-related npm packagesActorUnattributed

ForensicPost

Independent reporting on digital forensics and incident response.

SectionsBreaches Ransomware Nation-state Cloud

DataCase files Data export Actor index Glossary Methodology

ContactSecure tips Corrections The desk Ethics

© 2026 ForensicPost Media · the desk · newsletterGlossaryNo search logging