Netcrook
#Sapphire Sleet
One Hijacked npm Identity Can Poison an Entire Dependency Chain
A maintainer-account takeover tied to poisoned Mastra packages shows how package registries can become malware delivery systems when publisher trust is broken.
When a Package Registry Turns into a Blind Spot for AI Builders
Microsoft’s attribution of a Mastra AI-related npm compromise to Sapphire Sleet shows how a software supply chain incident can ripple through developer tooling long before anyone notices a malicious build.
Fake Updates, Real Risk: The macOS Lure That Turns Trust Into Execution
A macOS targeting campaign shows how a convincing prompt can matter more than a technical exploit when attackers are trying to make the victim run the payload themselves.
Macs, Wallets, and SSH Keys: The Quiet Theft Path North Korean Operators Keep Chasing
A macOS-focused intrusion campaign attributed to Sapphire Sleet puts the spotlight on a familiar cybercrime prize: secrets that can be reused far beyond one laptop.
Mac Targets, Crypto Secrets: A North Korea-Linked Hunt for Wallets and SSH Keys
A newly reported macOS campaign tied to Sapphire Sleet puts financial and crypto organizations in the crosshairs, with secrets rather than splashy malware as the prize.