Supply Chain Security
Published within a 15-minute window, the malicious tags introduced backdoors to exfiltrate CI secrets.
Hi, what are you looking for?
SecurityWeek
All posts tagged "supply chain attack"
Application Security
Fake automated commits injected GitHub Actions workflows containing payloads to steal credentials, CI secrets, keys, and tokens.
Data Breaches
Hackers accessed Grafana’s GitHub repositories after a token compromised in the TanStack attack was not rotated.
Malware & Threats
A compromised maintainer account was used to publish malicious package versions across the @antv namespace.
Artificial Intelligence
Two employee devices were compromised in the attack, and credential material was stolen from OpenAI code repositories.
Malware & Threats
Over 400 malicious versions of 170 packages were published as part of the new Mini Shai-Hulud campaign.
Supply Chain Security
A malicious version of the plugin was published to the Jenkins Marketplace late last week.
Malware & Threats
The software developer has identified the impacted systems, removed potentially compromised files, and validated installation packages.
Malware & Threats
While trojanized Daemon Tools versions were installed worldwide, a sophisticated backdoor was dropped only on a dozen systems.
Supply Chain Security
The compromised Lightning and Intercom packages have a combined monthly download count of nearly 10 million.
Malware & Threats
The Mini Shai-Hulud attack introduced a preinstall hook to fetch and execute a Bun binary and bypass security monitoring.
Artificial Intelligence
An attacker could have planted a malicious configuration to execute commands outside the sandbox.
Data Breaches
The hackers exfiltrated the data from Checkmarx’s GitHub environment on March 30, a week after publishing malicious code.
Supply Chain Security
Tied to a fresh Checkmarx supply chain attack claimed by TeamPCP, the incident references the Shai-Hulud worm.
Artificial Intelligence
The AI giant is taking action after determining that a macOS code signing certificate may have been compromised.
Malware & Threats
Download links were replaced by a Russian-speaking threat actor to distribute a recently emerged malware named STX RAT.
Malware & Threats
Hackers published 36 NPM packages posing as Strapi plugins to execute shells, escape containers, and harvest credentials.
Supply Chain Security
The threat actor behind the Axios supply chain attack has been aiming at other maintainers in its social engineering campaign.
Data Breaches
Hackers stole over 300GB of data from the Commission’s AWS environment, including personal information.
Supply Chain Security
The AI recruiting firm is investigating the incident as Lapsus$ claimed the theft of 4TB of Mercor data.
Artificial Intelligence
Debates over the plausibility of these doomsday scenarios have heated up since several executives endorsed slowing the technology’s development for safety reasons.
Vulnerabilities
CISO Conversations
ICS/OT
Only 21% of industrial security leaders report a complete OT asset inventory, even as 88% call their programs mature.
Vulnerabilities
Vulnerabilities
Artificial Intelligence
Vulnerabilities
