← AVOID.NET
Entity Graph
Browse extracted entities, relationships, and potential duplicates.
Total entities
29,550
Relationships
32,617
Potential duplicates
0
Filter by kind
Entities
↯38b735cd
Mastra forward-rolled 142 packages to clean versions, moved the 'latest' dist-tag past all compromised releases, restoring @mastra/core latest to version 1.42.0, and disabled token bypass authentication on all packages.(2026-06-17:mastra-ai-npm-supply-chain-attack-june-2026)event
↯105336e4
Account 'sergey2016' published 'easy-day-js@1.11.21' to npm — a clean, byte-identical copy of the legitimate dayjs library, seeding the attack infrastructure without triggering alerts.(2026-06-16:mastra-ai-npm-supply-chain-attack-june-2026)event
↯2bbc088f
npm account 'ehindero' published legitimate alpha versions of @mastra/core, acquiring org-wide scope publish rights that were never subsequently revoked.(2024-01-01:mastra-ai-npm-supply-chain-attack-june-2026)event
□c1966418
Mastra AI npm Supply Chain Attack (June 2026)organization
↯b5593f99
npm announces v12 security overhaul that will block install scripts (including binding.gyp-triggered node-gyp invocations) by default, with a July 2026 migration deadline for CI environments.(2026-06-13:node-gyp-npm-supply-chain-compromise-june-2026)event
↯2b13f6e7
JFrog identifies a 'Hades' variant of the campaign extending propagation to PyPI (.pth loader injection), RubyGems (extconf.rb injection), and JFrog Artifactory, and introducing AI assistant prompt injection via jailbreak prompts in Cursor, Copilot, and Claude rule files.(2026-06-06:node-gyp-npm-supply-chain-compromise-june-2026)event
↯122116c0
Snyk, ReversingLabs, Corgea, Chainguard, and Wiz publish independent technical analyses; Cybersecurity Dive reports on the Red Hat connection; Red Hat confirms no official products were impacted.(2026-06-05:node-gyp-npm-supply-chain-compromise-june-2026)event
↯e2f9a4cb
StepSecurity publishes initial disclosure naming the technique 'Phantom Gyp' and the campaign 'Miasma'; JFrog publishes analysis tying it to the Shai-Hulud worm lineage; malicious Wave 2 package versions begin to be delisted from the npm registry.(2026-06-04:node-gyp-npm-supply-chain-compromise-june-2026)event
↯609cf681
Wave 2 begins at 23:30 UTC: four malicious versions of @vapi-ai/server-sdk published using the Phantom Gyp (binding.gyp) technique; within under two hours, 50+ additional packages in the jagreehal maintainer account and related families are compromised — 57 packages and 286+ malicious versions in total.(2026-06-03:node-gyp-npm-supply-chain-compromise-june-2026)event
↯144a2912
Wave 1: Attacker uses a compromised Red Hat employee GitHub account to inject malicious preinstall hooks into 32+ packages (96 versions) across the @redhat-cloud-services npm namespace; Wiz Research identifies the compromise; most malicious versions revoked by 14:00 UTC.(2026-06-01:node-gyp-npm-supply-chain-compromise-june-2026)event
□37158102
node-gyp npm Supply Chain Compromise (June 2026)organization
↯c1ca4d59
Aurora Labs and Near Intents co-founder Alex Shevchenko sends on-chain message to attacker stating identification and associated accounts have been traced; formal traces opened with centralized exchanges. Crypto Times fact-check finds claims of full fund recovery unverified.(2026-04-18:rhea-finance)event
↯05cc57c5
Rhea Finance releases post-mortem revising total losses upward to $18.4 million — more than double the initial estimate — and confirming the slippage protection flaw as root cause. Attacker returns approximately $3.359 million USDC and $1.564 million NEAR to lending contract.(2026-04-17:rhea-finance)event
↯326345ec
Tether CEO Paolo Ardoino announces approximately $3.29 million in USDT connected to the attacker has been frozen.(2026-04-16:rhea-finance)event
↯aab9ff64
Attacker begins exploit preparation: creates subject wallet, begins distributing funds across 423 intermediary wallets, deploys fake token contracts, and establishes eight fraudulent trading pools on Ref Finance.(2026-04-13:rhea-finance)event
↯ec484dfe
Ref Finance and Burrow Finance announce merger to form Rhea Finance, NEAR Protocol's unified DeFi liquidity hub.(2025-03-01:rhea-finance)event
⌂0c184f93
Rhea Financeprotocol
↯f511a756
Second exploit widely reported. Aztec Labs confirms the second affected contract is a deprecated Stage 2 rollup from 2022 with no admin key access. AZTEC token declines approximately 1.6%.(2026-06-18:aztec-connect-deprecated-bridge-exploits-june-2026)event
↯18a9df69
Second exploit: attacker (EOA 0x6952...8e97f, funded with 0.134 ETH from HitBTC) drained approximately $2.21 million (1,158 ETH, 150,000 DAI, 0.4696 renBTC) from the deprecated Aztec Private Rollup Bridge RollupProcessor contract (0x737901bea3eeb88459df9ef1be8ff3ae1b42a2ba) by exploiting the unauthenticated escapeHatch() function.(2026-06-17:aztec-connect-deprecated-bridge-exploits-june-2026)event
↯9c354ce8
BlockSec, CertiK, and SlowMist publish analyses of the first exploit. SlowMist reports stolen funds remain unmoved in attacker's wallet.(2026-06-15:aztec-connect-deprecated-bridge-exploits-june-2026)event
↯5daf4067
Aztec Foundation posts official statement on X confirming the exploit and disavowing any connection to the current Aztec network or AZTEC ERC-20 token.(2026-06-14:aztec-connect-deprecated-bridge-exploits-june-2026)event
↯c8c298d4
Aztec Connect off-chain sequencer fully shut down. On-chain RollupProcessor contract continued to hold residual user funds.(2024-03-31:aztec-connect-deprecated-bridge-exploits-june-2026)event
↯243b3f9e
Aztec Labs deprecated Aztec Connect, halting new deposits. Admin keys had been renounced; the contract remained immutable and unupgradeable.(2023-03-31:aztec-connect-deprecated-bridge-exploits-june-2026)event
↯c4576260
Aztec Connect launched as a privacy-focused zk-rollup bridge on Ethereum, allowing private DeFi transactions.(2022-07-01:aztec-connect-deprecated-bridge-exploits-june-2026)event
↯4c271aea
Aztec Private Rollup Bridge officially closed. Smart contracts remained live and immutable on-chain.(2022-01-01:aztec-connect-deprecated-bridge-exploits-june-2026)event
↯448539dc
Aztec's original Private Rollup Bridge (the product later exploited in the second June 2026 incident) launched on Ethereum mainnet.(2021-01-01:aztec-connect-deprecated-bridge-exploits-june-2026)event
□7f02c757
Aztec Connect Deprecated Bridge Exploits (June 2026)organization
◎6b2d8fea
castlecrypto.ggdomain
◎8d54be37
pricepredictions.comdomain
↯ef4b9f6b
CryptoRank reports the 5 billion SYS token recovery and burn as completed. Team states that no other assets or user funds were compromised beyond the bridge's unauthorized minting event.(2026-06-16:syscoin-bridge-exploit-june-2026)event
↯0935ad32
Syscoin publishes full technical postmortem. Recovered tokens permanently burned via OP_RETURN transaction on Syscoin's block explorer. Bridge remains paused pending final validation of the patch.(2026-06-15:syscoin-bridge-exploit-june-2026)event
↯bee3288f
Syscoin notifies exchanges that native SYS deposits and withdrawals can safely resume. Attacker has returned all 5 billion SYS tokens to the designated recovery address by this date.(2026-06-10:syscoin-bridge-exploit-june-2026)event
↯5daaf1d9
Syscoin posts recovery address on-chain and makes contact with the attacker, warning of exchange escalation and legal action if tokens are not returned.(2026-06-09:syscoin-bridge-exploit-june-2026)event
♦4e345943
Syscoin Bridge Exploit (June 2026)token
◎ff061416
socprime.comdomain
◎627c25a2
chainguard.devdomain
↯4019b126
Miasma worm propagates to 73 Microsoft GitHub repositories across Azure, Azure-Samples, Microsoft, and MicrosoftDocs organizations using previously stolen contributor credentials. GitHub disables affected repositories in a 105-second automated sweep.(2026-06-05:phantom-gyp-npm-supply-chain-attack-june-2026)event
↯bd127217
Vapi learns of StepSecurity's public disclosure of the broader Miasma attack connecting the @vapi-ai incident to the wider Phantom Gyp campaign.(2026-06-04:phantom-gyp-npm-supply-chain-attack-june-2026)event
↯60fd6baa
At approximately 19:20 PT (02:20 UTC June 4), Vapi removes the four malicious @vapi-ai/server-sdk versions and rolls back compromised repository changes. Zero downloads confirmed for the affected versions.(2026-06-03:phantom-gyp-npm-supply-chain-attack-june-2026)event
↯75a51e9c
Miasma worm compromises 32 packages across 96 malicious versions in the @redhat-cloud-services npm namespace within 72 seconds. Combined weekly downloads approximately 116,991.(2026-06-01:phantom-gyp-npm-supply-chain-attack-june-2026)event
↯fa12aa28
TeamPCP publishes full Mini Shai-Hulud worm source code to GitHub alongside BreachForums posts encouraging independent campaigns, open-sourcing the attack toolkit.(2026-05-12:phantom-gyp-npm-supply-chain-attack-june-2026)event
↯a6c6538c
First Shai-Hulud self-replicating npm worm observed; associated with threat actor group TeamPCP.(2025-09:phantom-gyp-npm-supply-chain-attack-june-2026)event
□f914f017
Phantom Gyp npm Supply Chain Attack (June 2026)organization
Data refreshes within about 10 minutes · All metrics derived from Supabase