Data Breaches
Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact.
Hi, what are you looking for?
SecurityWeek
All posts tagged "supply chain attack"
Supply Chain Security
A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.
Data Breaches
HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers.
Supply Chain Security
The hackers exfiltrated data from Salesforce instances of Klue customers, such as Huntress and Recorded Future.
Malware & Threats
Arch Linux suspended account registrations in response to the wave of malicious packages being uploaded to AUR.
Malware & Threats
The most recent variants of the self-propagating attacks are named Miasma and Hades.
Supply Chain Security
Hackers published 96 malicious package versions, injected with a credential-stealing worm similar to Mini Shai-Hulud.
Artificial Intelligence
Malicious repositories and disguised symlinks can trick AI coding agents into silently installing attacker-controlled MCP servers capable of stealing secrets, compromising CI pipelines, and...
Supply Chain Security
Published within a 15-minute window, the malicious tags introduced backdoors to exfiltrate CI secrets.
Application Security
Fake automated commits injected GitHub Actions workflows containing payloads to steal credentials, CI secrets, keys, and tokens.
Data Breaches
Hackers accessed Grafana’s GitHub repositories after a token compromised in the TanStack attack was not rotated.
Malware & Threats
A compromised maintainer account was used to publish malicious package versions across the @antv namespace.
Artificial Intelligence
Two employee devices were compromised in the attack, and credential material was stolen from OpenAI code repositories.
Malware & Threats
Over 400 malicious versions of 170 packages were published as part of the new Mini Shai-Hulud campaign.
Supply Chain Security
A malicious version of the plugin was published to the Jenkins Marketplace late last week.
Malware & Threats
The software developer has identified the impacted systems, removed potentially compromised files, and validated installation packages.
Malware & Threats
While trojanized Daemon Tools versions were installed worldwide, a sophisticated backdoor was dropped only on a dozen systems.
Supply Chain Security
The compromised Lightning and Intercom packages have a combined monthly download count of nearly 10 million.
Malware & Threats
The Mini Shai-Hulud attack introduced a preinstall hook to fetch and execute a Bun binary and bypass security monitoring.
Artificial Intelligence
An attacker could have planted a malicious configuration to execute commands outside the sandbox.
CISO Strategy
Designed for cybersecurity leaders, this immersive two-day virtual event is your premier destination to discuss, share, and learn innovative risk management and defense strategies...
Vulnerabilities
Vulnerabilities
Artificial Intelligence
Supply Chain Security
SBOM pioneer Allan Friedman joined the SecurityWeek Podcast to discuss why knowing what is inside software is only the beginning, how AI is complicating...
Artificial Intelligence
Cybersecurity Funding
Vulnerabilities
Supply Chain Security
