Technology ❯ Cybersecurity ❯ Supply Chain Security ❯ Malware

Credential Theft

TeamPCP Worm Poisons Hundreds of npm and PyPI Packages With Signed Malicious Releases

Attackers hijacked GitHub Actions using OIDC tokens to ship signed releases that stole developer and cloud secrets.

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

Nx npm Packages Compromised in 'S1ngularity' Attack With Second-Wave Exploitation Emerging