Skip to main content
Francesco Cipollone on Muck Rack

Francesco Cipollone

London
As seen in: Cyber Security & Cloud Podcast, Medium, Color Research & Application, Nature, MDPI, Taylor & Francis Online, EIN Presswire
Appsec and cloudsec crazy, CEO & founder and @sec_phoenix and @nsc42ltd board of @csaukchapter London host of @podcast_cyber
Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work. Claim your profile

Get in touch with Francesco

Contact Francesco, search articles and posts on X, monitor coverage, and track replies from one place.

Learn more about Muck Rack

Actions

Share this page

Is this you?

As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile

Articles

Miasma/Hades Variant Hits LeoPlatform: npm Worm Runs binding.gyp Under Bun to Steal Cloud Credentials

|
By Francesco Cipollone
| phoenix.security
Skip to content Between June 24 and June 26 several researchers reported a new variant in the Miasma lineage spreading across npm, with open-source malware tracking from OpenSourceMalware confirming the package set and affected versions. The npm maintainer account czirker, which owns the LeoPlatform (leo-* and rstreams-*) package family, was compromised: every package under the account was republished with a malicious index.js.
Open in Who Shared Issue with article?

Mini Shai-Hulud Resurfaces (No CVE): GitHub Worm Re-Probe new repo after Floods 1,600 Repos Across 21 Compromised Accounts

|
By Francesco Cipollone
| phoenix.security
Skip to content Mini Shai-Hulud is a self-propagating supply chain worm in the broader Shai-Hulud lineage that harvests developer and CI secrets, then publishes the stolen material into freshly created public GitHub repositories carrying the description marker “A Mini Shai-Hulud has Appeared.” It was first tracked across npm and PyPI in May 2026 and attributed to TeamPCP. A scan run on 19 June 2026 shows the worm is active again rather than dormant.
Open in Who Shared Issue with article?

IronWorm (No CVE): Rust-Built npm Worm Ships an eBPF Rootkit, Tor C2, and a Self-Propagating Supply Chain Implant Across 37 Packages

|
By Francesco Cipollone
| phoenix.security
IronWorm is an npm supply chain worm — a self-propagating Rust-built implant distributed through 37 packages that carries an eBPF rootkit, Tor-based command and control, and a CI self-replication engine that requires no stored credentials.
Open in Who Shared Issue with article?
See all 17 articles