Security research
& threat intel.
Analysis of supply-chain attacks, platform breaches, and emerging threats from the CyberXYZ detection engine.
Three folders. Everything we publish.
IDE extensionsEvery write-up, newest first.
CyberXYZ research: 285 PhantomSub packages on npm not in any earlier report
285 npm packages in the PhantomSub WhatsApp campaign that SafeDep, Xygeni and OX did not name and OSV did not have, found by CyberXYZ; 246 were on npm before SafeDep's 10 August write-up. The method, the variants in the code, the OpenSSF reports, and the full list of packages and IOCs.
GitHub
663 uploads in eight days: a live Shai-Hulud victim, caught on our check's first day
One developer's GitHub account kept uploading the worm's stolen data, about 80 times a day, until 20 October. What the uploads show, what they cannot, how our hourly check caught it, and a one-line check for your own account.
GitHub Actions
The long tail of Mini Shai-Hulud: 24 more repositories the first reports missed
A GH Archive hunt and a workflow sweep found the worm on 24 repositories no public report named. Who has cleaned up, and how to check every branch.
GitHub Actions
Mini Shai-Hulud in ant-design/pro-components: six branches in seven seconds
A bug report woke a hijacked GitHub Action, which pushed the worm to six branches as github-actions[bot]. The run logs, the branches the clean-up missed, IOCs and fixes.
Go
Hunting Go for 90 days: 9.3 million module versions and the campaign we missed
Lookalikes, burst accounts and rewritten tags across the Go module index, the Graphalgo campaign that got past us, and popular dependencies that now live only in Google's cache.
Go
RubyGems
BufferZoneCorp: Go and Ruby malware that hijacks GitHub Actions
Seventeen packages steal keys, plant SSH backdoors and rewire CI. Gone from the registries, still live on GitHub when we checked.
dotenv-async: npm malware that hides PowerShell in a JPEG
A new, previously unreported package in an ongoing dotenv lookalike campaign. On import it pulls a PowerShell command out of a bundled image and runs a Windows second stage.
The build that should have failed: faker 6.6.6 and the gate that refuses it
A gutted npm package, four years as latest and 1.9 million downloads a week. Why CI keeps installing it, and what CyberXYZ Gate does to that build before the install.
Vulnerable by inheritance: eight speaker models and the RCE they never named
pyannote's models name one clean package. One hop below it, lightning 2.6.5 carried a checkpoint-loading RCE no manifest mentions, until 2.6.6 fixed it on Sep 10, 2026.
Built for the AI Supply Chain: Go Blocked at Install, and Secure AI Models
AI runs on PyPI, npm, Go, and model hubs. We watch all of them, read the source, and block at install.
binding.gyp: The npm Vector That Skips Postinstall
@immobiliarelabs Backstage plugins trojanized via a node-gyp command expansion. How the evasion works, the IOCs, and how to detect it.
Hades Campaign: PyPI Worm Hits AI and Bioinformatics Devs
A .pth startup hook runs a Bun-based credential stealer across 38 PyPI projects. Attack chain, verified IOCs, and our detection timeline.
Mini Shai Hulud Returns: AntV npm Ecosystem Attack
TeamPCP pushed 639 malicious versions across 323 npm packages via the compromised account atool on May 19. Credential exfiltration, Sigstore forgery, and IOCs.
Vercel Security Incident: Context.ai OAuth Compromise
Full analysis of the Vercel breach via Context.ai OAuth compromise, including verified IOCs and remediation steps for affected teams.
Axios npm Attack: North Korean RAT via Compromised Maintainer
Malicious axios versions 1.14.1 and 0.30.4 deployed cross-platform RATs. Full IOCs, MITRE ATT&CK mapping, and remediation steps.
Watch it block a real attack. Then run it on your own installs.
Book 15 minutes. We run real packages through CyberXYZ while you watch, including axios 1.14.1, a hijacked release that dropped remote-control malware in March 2026, and show you exactly what your team would see. Then we connect one laptop or one pipeline for a 30-day proof of value.
What happens next
- 01A 15-minute callReal packages, real verdicts, and your questions.
- 02Connect one laptop or one pipelineOne setup command, or one line in CI. Under an hour.
- 03A 30-day proof of value on your own installsEvery signal, no card.
Not ready for a call?
Check any package, free, and see the verdict we would give it.
Thanks! We'll be in touch.
Check your inbox. We'll reach out within 24 hours.