Vulnetix
Try Vulnetix Request Demo
Threat intelligence · Vulnetix Research Lab

Malware Campaigns & Threat Actors

Every supply-chain malware campaign we track, and the actors behind them. Each campaign gets an impact-and-mitigations teardown; each actor a motivations-and-tradecraft profile. Where our data is partial, we show the indicators of compromise and say so — nothing is invented.

Block these before they install

684

Campaigns tracked

55,866

Threat actors

336,122

Indicators retained

275,001

Malicious records

Two tiers of campaigns

186 curated campaigns are hand-researched and actor-attributed — each its own story, with a teardown written specifically for it. 498 catalogued campaigns are coordinated malicious-package batches auto-grouped from our 275,001-record malware feed (a shared scope, mass-publish stem, or typosquat family).

Curated campaigns

The hand-researched, actor-attributed campaigns in the Vulnetix malware corpus:

STIX feeds for your own controls

We publish the malicious domains, IPs and URLs from this intelligence as free, machine-readable STIX 2.1 bundles split per ecosystem and refreshed every 15 minutes. Start with the generic DNS and URL bundles, or use the interactive page to pick a registry-specific feed.

Download Generic DNS STIX · Download Generic URLs STIX

Caught after they shipped — block them at the gate

Every indicator above was catalogued after the package shipped. The Vulnetix Package Firewall checks each install against this same malware intelligence, across 25+ registries, before the dependency reaches your build. Where Aikido SafeChain, Socket, JFrog Curation and DevGuard each draw on narrower feeds, Vulnetix aggregates OSSF Malicious Packages, OSV.dev, GitHub Advisory and first-party research into one of the largest de-duplicated malware corpora in the industry — then adds Safe Harbour autofix.

Block these before they install →