Application Security
A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored package versions.
Hi, what are you looking for?
SecurityWeek
All posts tagged "supply chain attack"
Application Security
After validating stolen credentials using TruffleHog, the hacking group started AWS services enumeration and lateral movement activities.
Malware & Threats
Two malicious versions of the popular SDK were uploaded to the PyPI registry, targeting Windows, macOS, and Linux.
Application Security
The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.
Supply Chain Security
Hackers published a malicious scanner release and replaced tags to point to information-stealer malware.
Malware & Threats
The malicious code propagates like a worm, poisons AI assistants, exfiltrates secrets, and contains a destructive dead switch.
Nation-State
The vulnerability in TeamT5 ThreatSonar Anti-Ransomware was recently added to CISA’s KEV catalog.
Artificial Intelligence
While this campaign targets crypto wallets and steals money, the methodology has far wider potential that could be used by other attackers.
Supply Chain Security
The likely state-sponsored threat actor had access to the hosting provider for months and targeted only certain Notepad++ customers.
Malware & Threats
Hackers compromised a MicroWorld Technologies update server and fed a malicious file to eScan customers.
Supply Chain Security
The protections against NPM supply chain attacks could be bypassed, leading to arbitrary code execution.
Application Security
The worm exposed Trust Wallet’s Developer GitHub secrets, allowing attackers to publish a backdoor extension and steal funds from 2,520 wallets.
Malware & Threats
The ‘download’ button on the official EmEditor website served a malicious installer.
Artificial Intelligence
Australia disclosed that an OpenAI agent gained unauthorized access to non-public government information.
Artificial Intelligence
Vulnerabilities
Artificial Intelligence
The startup’s runtime enforcement platform evaluates AI agents in real time to provide visibility and control over their actions.
Artificial Intelligence
Cybersecurity Funding
