Safe Dep | lazarus.day

Safe Dep

https://safedep.io

0

Named Actors
11

Published Reports
1

Years Active
11

Avg Reports/Year

Published Reports

Top Tags

Top Actors

Cluster Coverage

2026-09-30

Safe Dep

PolinRider Switches to Ethereum C2 in 30+ Repositories

#PolinRider #GitHub #T1027 #T1036 #T1059.007 #T1102.001 #T1497 #T1552 #T1555.003 #T1564 #T1567

2026-09-01

Safe Dep

A malicious npm package hidden three dependencies deep: the ulid-xyz delivery chain

#NPM #FamousChollima

2026-08-20

Safe Dep

Malicious Rust Crate arrayref Runs a Build-Time Payload

#arrayref

2026-07-29

Safe Dep

Joyfill npm Packages Compromised with Blockchain C2 Loader

#NPM #SupplyChain #PolinRider #Joyfill

2026-07-09

Safe Dep

nodemon-sudo: an npm Backdoor With No Install Script

#NPM #SupplyChain

2026-06-17

Safe Dep

Mastra npm Scope Takeover: 143 Packages Drop a RAT

#Mastra #NPM #SupplyChain

2026-06-12

Safe Dep

astro.config.mjs Supply Chain Attack via Blockchain C2

#PolinRider #SupplyChain #GitHub #T1195 #T1195.002 #T1059.007 #T1027 #T1102 #T1105

2026-05-28

Safe Dep

Inside MicrosoftSystem64: A Supply Chain RAT Exfiltrating to HuggingFace

#FamousChollima #NPM #T1195 #T1195.002 #T1102 #T1102.002 #T1567 #T1567.002 #T1056 #T1056.001 #T1113 #T1005 #T1552 #T1552.004 #T1059 #T1059.001 #T1059.003 #T1547 #T1547.001 #T1053 #T1053.005 #T1543 #T1543.001 #T1543.004 #HuggingFace #T1119

2026-04-15

Safe Dep

Malicious npm Package js-logger-pack Ships a Multi-Platform WebSocket Stealer

#NPM #HuggingFace #T1195.002 #T1056.001 #T1552.001 #T1555 #T1105 #T1547

2026-04-02

Safe Dep

Malicious npm Package express-session-js Drops Full RAT Payload

#ContagiousInterview #NPM

2026-03-31

Safe Dep

axios Compromised: npm Supply Chain Attack via Dependency Injection

#Axios #NPM