← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
28,795
Relationships
31,973
Potential duplicates
0
Filter by kind
Entities (event)
↯5932ba9c
Shai-Hulud 3.0 'The Golden Path' variant discovered by researcher Charlie Eriksen propagating via @vietmoney/react-big-calendar@0.26.2; dead-man's switch absent from this variant.(2025-12:shai-hulud-teampcp-supply-chain-attack)event
↯853eefac
Shai-Hulud 2.0 peak activity: 640+ npm packages infected within days; 25,000+ data-leaking GitHub repositories created; Zapier, PostHog, and Postman developer tooling among affected parties.(2025-11:shai-hulud-teampcp-supply-chain-attack)event
↯b093d217
Original Shai-Hulud worm first detected in the npm ecosystem; earliest attributable TeamPCP supply chain operations begin. 500+ packages compromised via malicious preinstall hooks; credentials harvested from 25,000+ GitHub repositories.(2025-09:shai-hulud-teampcp-supply-chain-attack)event
↯33629f4b
npm announces a v12 security overhaul that blocks install scripts (including binding.gyp-triggered node-gyp invocations) by default, with a July 2026 CI migration deadline.(2026-06:phantom-gyp-npm-supply-chain-attack-june-2026)event
↯64d3e4e6
TeamPCP publishes the full Mini Shai-Hulud worm source code to GitHub alongside BreachForums posts encouraging independent campaigns.(2026-05:phantom-gyp-npm-supply-chain-attack-june-2026)event
↯b08ee40a
The Cloud Security Alliance publishes a research note on Miasma with extended technical analysis.(2026-06:miasma-redhat-npm-supply-chain-attack)event
↯fb549765
The earliest malicious commit containing the string 'Miasma: The Spreading Blight' appears in RedHatInsights repositories.(2026-05:miasma-redhat-npm-supply-chain-attack)event
↯2c4c2116
The PyTorch Lightning package on PyPI is compromised as part of the same campaign.(2026-04:miasma-redhat-npm-supply-chain-attack)event
↯f63701e4
The original Shai-Hulud worm emerges as the first self-replicating malware targeting the npm ecosystem; it is attributed to TeamPCP.(2025-09:miasma-redhat-npm-supply-chain-attack)event
↯cadcb90f
Researchers report total impact of 444+ packages and 1,381-2,234 poisoned versions, with over two billion monthly installs exposed.(2026-08-05:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯4dbc0903
Cyber Security Agency of Singapore issues Advisory AD-2026-009 on the attack affecting keyv and related packages.(2026-08:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯29657117
Shai-Hulud variant infects Red Hat npm packages downloaded approximately 80,000 times per week.(2026-06:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯e4f03da6
ChainDrop C2 infrastructure deployed; C2 domain npm-cache[.]com registered.(2026-05-22:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯bb607e41
A Shai-Hulud copycat worm infects at least one additional npm package.(2026-05-18:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯5598cbfa
A Mini Shai-Hulud resurgence is identified compromising over 170 npm packages and two PyPI packages across 404 malicious versions.(2026-05:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯606ab756
CERT-EU attributes the breach of the European Commission's AWS environment to TeamPCP.(2026-04-02:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯e6b4ab1d
Mini Shai-Hulud (fourth generation) begins operations according to Tenable, introducing SLSA provenance forgery, OIDC token extraction from runner memory and AI-agent persistence hooks.(2026-04:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯70b35499
TeamPCP force-pushes 76 of 77 Trivy GitHub Action tags with the SANDCLOCK credential stealer; CanisterWorm infects 66+ npm packages using ICP blockchain C2.(2026-03:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯11fc2c92
Microsoft Security Research publishes Shai-Hulud 2.0 guidance documenting an earlier wave of the campaign.(2025-12-09:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯f8b3feff
TeamPCP threat group first observed conducting cloud-native cryptomining and credential theft campaigns.(2025-11:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯97de3f88
Original Shai-Hulud worm debuts, marking the start of the systematic npm/PyPI supply-chain campaign series.(2025-09:chaindrop-mini-shai-hulud-npm-supply-chain-worm-august-2026)event
↯2b4aef34
CFTC files civil enforcement complaint against Cash FX Group S.A., Huascar Jose Lopez Castillo, The Conversion Pros, Inc., Ronald Pope, and Justin Halladay in the U.S. District Court for the Middle District of Florida, alleging a $950 million multilevel-marketing Ponzi scheme.(2026-09-25:ronald-pope)event
↯f4ed8f04
UK FCA adds CFX Legacy to its existing Cash FX Group fraud warning.(2024-08-01:ronald-pope)event
↯16e0ca1c
CFTC complaint's alleged end date for the joint fraudulent scheme. UK abandons its criminal investigation without charges.(2023-12-20:ronald-pope)event
↯80f09c9c
CFX Legacy (cfxlegacy.com) launches, a rebranded portal built on The Conversion Pros' infrastructure, which BehindMLM alleges Pope was operating to serve residual Cash FX investors.(2023-07-27:ronald-pope)event
↯93bb5583
Dominican Republic issues a Cash FX Group fraud warning; Lopez allegedly disappears.(2021-11-01:ronald-pope)event
↯ba6ab59b
Pope allegedly records a YouTube video stating he has personally reviewed Cash FX trade reports and that the trades are real, a statement the CFTC alleges was false.(2020-09-28:ronald-pope)event
↯ddc18583
UK Financial Conduct Authority issues first fraud warning for Cash FX Group, stating it was not authorised to operate in the UK.(2019-12-01:ronald-pope)event
↯e4f2c062
Pope allegedly travels from Nevada to Orlando, Florida to help plan the launch of Cash FX Group.(2019-08-01:ronald-pope)event
↯8600a57a
CFTC complaint's alleged start date for the joint fraudulent scheme involving Pope, Lopez, The Conversion Pros, Cash FX Group, and Halladay.(2019-06-28:ronald-pope)event
↯208b1311
According to the CFTC complaint, Lopez recruits Pope to assist in building the Cash FX Group scheme's technical infrastructure.(2019-05-01:ronald-pope)event
↯34cbbae3
Ronald Pope founds The Conversion Pros, Inc., a cloud-based marketing tools platform, later incorporated in Nevada.(2015-11-01:ronald-pope)event
↯e30fb107
SecondFi (formerly Yoroi), EMURGO's Cardano wallet platform, discloses a private-key generation flaw. Attackers drain 16.1 million ADA (~$2.4 million) from 374 wallets between June 21–23; up to 129 million ADA ($20M+) reported at risk.(2026-06-23:cardano-ada)event
↯de5d6627
SEC and CFTC jointly classify ADA as a 'digital commodity,' reversing the 2023 security classification.(2026-03-17:cardano-ada)event
↯3695a2f3
Cardano mainnet experiences a chain partition for approximately 14.5 hours after a malformed transaction exploits a deserialization bug. No user funds compromised. Patched node released within hours.(2025-11-21:cardano-ada)event
↯9166b67e
Independent forensic audit by McDermott Will & Emery and BDO concludes in a 150-page report that fraud allegations against Hoskinson and IOG 'do not have any basis.'(2025-09-02:cardano-ada)event
↯aa7446f5
Chang hard fork activates; Cardano enters the Voltaire governance era with on-chain voting via dReps.(2025-09-01:cardano-ada)event
↯0b9e6e29
X user Masato Alexander alleges Charles Hoskinson misappropriated 318 million ADA (~$619 million) via genesis keys. Hoskinson denies the allegations and announces an independent audit.(2025-05-07:cardano-ada)event
↯76f8f978
Robinhood delists ADA citing regulatory risk from SEC's security classification.(2023-06-27:cardano-ada)event
↯0c40ebd2
SEC names ADA as an unregistered security in lawsuits filed against Binance and Coinbase. IOG rejects the classification.(2023-06-09:cardano-ada)event
↯a038eec3
Cardano mainnet launched; ADA token begins trading.(2017-09-01:cardano-ada)event
↯50448dbf
Cardano project conceived by Charles Hoskinson and Jeremy Wood following their departure from Ethereum.(2015-01-01:cardano-ada)event
↯15fa9452
MetaMask discloses an ongoing security incident affecting part of its infrastructure at approximately 23:35 UTC. The company states wallets face no immediate threat and begins exiting affected Ethereum validators from Lido.(2026-09-30:metamask)event
↯a0b3e36a
ConsenSys announces corporate restructuring: the existing ConsenSys Software Inc. entity will be rebranded as MetaMask (consumer wallet) and a new entity will retain the ConsenSys name (protocols and institutional infrastructure). Separation expected by end of 2026.(2026-09-09:metamask)event
↯0ccbd56c
On-chain investigator ZachXBT documents a phishing campaign impersonating MetaMask that reportedly drained more than $9 million across 400-plus wallet addresses on Ethereum, Polygon, Arbitrum, and Base. The campaign involved fake MetaMask upgrade prompts directing users to token-drainer contracts.(2026-05-28:metamask)event
↯ec8e99ae
Kiln, a comparable Ethereum staking infrastructure provider, begins a full precautionary validator exit after a security breach linked to the $41 million SwissBorg Solana hack. This established an industry precedent for precautionary mass exits following node-operator infrastructure compromises.(2025-09-10:metamask)event
↯31980f32
ConsenSys and the SEC announce an agreement in principle to dismiss the enforcement case. No court ruling on the merits was issued; the case was voluntarily dismissed.(2025-02-27:metamask)event
↯302190ba
ConsenSys announces a further 20% workforce reduction (approximately 160 employees), citing macroeconomic pressures, regulatory uncertainty, and SEC litigation costs.(2024-10-01:metamask)event
↯0a6f9c83
SEC files a complaint against ConsenSys alleging it operated as an unregistered broker via MetaMask Swaps and made unregistered offerings via MetaMask Staking.(2024-06-28:metamask)event
↯8b72ac73
ConsenSys files a preemptive lawsuit against the SEC challenging its jurisdiction over Ethereum.(2024-04-01:metamask)event
Data refreshes every 5 minutes · All metrics derived from Supabase