Data Breaches
The attackers used a compromised BigCommerce application key held by Ribon to access customer data.
Hi, what are you looking for?
SecurityWeek
All posts tagged "supply chain attack"
Application Security
Posing as the legitimate sorted-btree package, indexed-btree hides a malware trigger in its prototype method.
Supply Chain Security
It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North...
Data Breaches
The cybersecurity firm believes the data breach was the result of the May 2026 TanStack supply chain attack.
Malware & Threats
Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts.
Malware & Threats
Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server.
Supply Chain Security
Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published.
Supply Chain Security
LiteLLM was compromised through the Trivy hack and abused to distribute information-stealing malware to its users.
Malware & Threats
The malware was designed to steal and exfiltrate secrets, and to propagate itself via stolen NPM and GitHub credentials.
Malware & Threats
A threat actor poisoned several Jscrambler NPM package versions to drop a cross-platform credential stealer.
Supply Chain Security
The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer to developers.
Artificial Intelligence
Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, potentially turning malicious repositories into supply chain attack vectors.
Data Breaches
Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact.
Supply Chain Security
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.
Data Breaches
HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers.
Supply Chain Security
The hackers exfiltrated data from Salesforce instances of Klue customers, such as Huntress and Recorded Future.
Malware & Threats
Arch Linux suspended account registrations in response to the wave of malicious packages being uploaded to AUR.
Malware & Threats
The most recent variants of the self-propagating attacks are named Miasma and Hades.
Supply Chain Security
Hackers published 96 malicious package versions, injected with a credential-stealing worm similar to Mini Shai-Hulud.
Artificial Intelligence
Malicious repositories and disguised symlinks can trick AI coding agents into silently installing attacker-controlled MCP servers capable of stealing secrets, compromising CI pipelines, and...
Artificial Intelligence
Debates over the plausibility of these doomsday scenarios have heated up since several executives endorsed slowing the technology’s development for safety reasons.
Vulnerabilities
CISO Conversations
ICS/OT
Only 21% of industrial security leaders report a complete OT asset inventory, even as 88% call their programs mature.
Vulnerabilities
Vulnerabilities
Artificial Intelligence
Vulnerabilities
