Pressure Chollima / Jade Sleet (TraderTraitor)
TraderTraitor’s developer targeting, transaction manipulation and measured persistence, with source-specific actor names and the limits of each investigation kept distinct.
Tags /
#Supply Chain
3 reports
Miasma compromises Red Hat npm packages through a trusted publishing workflow
Wiz and JFrog describe malicious Red Hat npm releases that steal developer secrets, abuse publishing identities and retain valid provenance despite compromised workflows.
The @antv and Nx Console compromises: tracking malicious packages, extensions and GitHub Actions
Malicious npm packages, Nx Console 18.95.0 and compromised GitHub Actions expose developer credentials. Installation history, persistent processes and publishing permissions define recovery.