Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
5 / 5 results
highbug_reportVulnerabilityMalicious Arch Linux packages impersonate yay and paru AUR helpers
Arch Linux users who installed typosquatted packages from AUR (Arch User Repository) uploaded by user "marchos1as" between October 13-15, 2026. Malicious packages include "yyay" and similar variants impersonating legitimate AUR helpers yay and paru.
highbug_reportVulnerability13 malicious npm packages deliver WeaselBiscuit stealer targeting Chrome data
13 npm packages (@biz44/id10-client, @biz44/id12-client, @biz44/id44-client, @biz44/id79-client, @biz44/id95-client, @biz44/id99-client, @biz44/process-runtime-utils, @biz44/runtime-utils, engin1, id79-client, process-lhpm, process-mite, process-tail…
criticalbug_reportVulnerabilityNearly 800 malicious npm packages deliver cross-platform RAT via typosquatting
npm registry: ~800 packages using typosquatting and AI-generated names. Targets all Node.js developers on Windows, macOS (x64/ARM64), and Linux (x64/ARM64). Delivers WEL1DROPPER leading to Sliver C2 framework and platform-specific infostealers.
highbug_reportVulnerabilityMalicious npm packages deliver Windows RAT to JavaScript developers
Three npm packages (aes-decode-runner-pro, postcss-minify-selector, postcss-minify-selector-parser) published within the past month. Total downloads: 145-615 per package. Affects Windows-based development environments using npm package manager.
criticalbug_reportVulnerability400+ Arch User Repository packages compromised with rootkit and infostealer
Arch Linux users who installed or updated packages from the Arch User Repository (AUR). Over 400 AUR packages confirmed compromised. Specific package names and versions not yet disclosed.