Xygeni Logo White
Start Free
Book a demo

Category: Attacks Analysis

Must-Read Posts

Risky Business: Self-Deleting npm Packages Explained

Risky Business: The Anti-Proctoring Packages That Delete Themselves

Risky Business: packages that delete themselves within minutes. Xygeni tracked 16 npm packages, 3 payloads, one shared technique. Dive in!
12 min read
types of cyber threats

Cyber Threats Explained: The Main Types Security Teams Should Know

Dive in to discover the main types of cyber threats security teams face today: malware, secrets leakage, supply chain and AI code attacks.
7 min read
npm worm playbook

The npm Worm Playbook: Same Attack, Three Times in Eight Months

What is an npm worm? Inside the biggest npm worm incidents, the pattern that repeats, and the cooldown window most defenses still miss.
8 min read
JavacDoor, Maven Malware That Runs at Compile Time

JavacDoor: A Maven Artifact That Ran During Compilation, Not Installation

A Maven jar with zero install hooks and zero imports still ran a live C2 payload, just by sitting on the compiler's path. Dive in!
10 min read
Npm Supply Chain Attacks

Npm Supply Chain Attacks: Biggest Incidents & How to Stop Them

A timeline of the biggest npm supply chain attacks, from Shai-Hulud to chalk/debug, and the controls that stop the next npm package attack.
7 min read
How AI Agents Can Automate a Ransomware Attack

How AI Agents Can Automate a Ransomware Attack: What JadePuffer Just Proved

JadePuffer showed an AI agent can run a ransomware attack start to finish. Here's how it happened, and how to stop agentic threats early.
9 min read
QuietPolyfill, an NPM dropper that resurrected

QuietPolyfill: An NPM dropper that resurrected

QuietPolyfill: an npm dropper that triggers on import, bypassing --ignore-scripts entirely, and came back a day later. Take a look!
14 min read
rogue by design

Rogue by Design: How a Sandboxed Pre-Release Model Jailbroke Itself and Hacked Hugging Face to Cheat an Exam

An OpenAI model escaped its sandbox and breached Hugging Face on its own, to cheat a benchmark exam. No human attacker. Here's how.
23 min read
PointBlank: PyPI RAT Hides C2 in a JSON-Bin Service

PointBlank: a fully-featured Python RAT that ran its command channel through a free note-hosting service

A PyPI package called gcli-control shipped a full Windows RAT openly & ran its command channel through npoint.io instead of a server it owned
8 min read
Slopsquatting Evolution

Slopsquatting evolution: From AI Curiosity to Agent RCE

How slopsquatting attacks evolved from a research curiosity in 2023 to autonomous-agent remote code execution in 2026 & what it means.
7 min read
PhantomSync: npm Crypto Packages Hide Wallet Stealer

PhantomSync: eight crypto-developer npm packages hide a delayed, self-persisting dropper

PhantomSync: 8 npm crypto packages hide a delayed dropper that steals wallet keys and exfiltrates via IPFS. IOCs and detection guide.
11 min read
FauxUV: Fake PyPI uv Packages Open Jupyter to the Web

FauxUV: fake PyPI uv helpers that open an unauthenticated Jupyter server to the internet

FauxUV: fake PyPI uv helper packages install a passwordless JupyterLab server, then expose it to the internet via reverse tunnel.
5 min read
Load More