research hub

Security research,
plainly explained

New analyses every week — vulnerabilities, exploits, and the attack patterns that matter. What the bug is, who's exposed, what to do about it before Monday.

Xinference on PyPI: TeamPCP's self-attribution marker, AWS post-exploitation scope, and why April 22 matters for the .pth timeline
May 12, 2026 Threat intel
Xinference on PyPI: TeamPCP's self-attribution marker, AWS post-exploitation scope, and why April 22 matters for the .pth timeline
Jenkins Checkmarx AST Scanner plugin backdoored (TeamPCP): trojanized JAR + runtime cli.js download from cx-plugins-releas staging repo
May 10, 2026 Threat intel
Jenkins Checkmarx AST Scanner plugin backdoored (TeamPCP): trojanized JAR + runtime cli.js download from cx-plugins-releas staging repo
litellm on PyPI: the first .pth injection in the TeamPCP chain and why the operator named it
May 7, 2026 Threat intel
litellm on PyPI: the first .pth injection in the TeamPCP chain and why the operator named it
One toolchain, six weeks, four campaigns: mapping the npm supply-chain worm cluster
May 7, 2026 Threat intel
One toolchain, six weeks, four campaigns: mapping the npm supply-chain worm cluster
CanisterWorm: the npm supply chain worm that exfiltrates through a blockchain
May 4, 2026 Threat intel
CanisterWorm: the npm supply chain worm that exfiltrates through a blockchain
Shai-Hulud closes the loop: how the worm reached intercom-client in 24 hours
May 4, 2026 Threat intel
Shai-Hulud closes the loop: how the worm reached intercom-client in 24 hours

Application security research.

ops@keepsecure.io

Quick Links
About ResearchHub Contact
Elsewhere
GitHubLinkedInX / Twitter
RSS

© 2026 keepsecure labs