Supply Chain Attacks

Malware Data Breaches Software Vulnerabilities npm npm Ecosystem Threat Actors Hacking Targeted Industries Malware Distribution Risk Mitigation

3 ARTICLES

4w ago

GitHub Tightens npm Trusted Publishing After Slug-Based Hijack Flaw

The company changed how registry trust is validated to stop attackers from claiming freed GitHub repository names to publish malicious package versions.

3 ARTICLES

last mo.

Microsoft Details NeedyMantis Malware Used to Maintain Long-Term Network Access

4 ARTICLES

last mo.

Brevo Breach Used Cloudflare Worker to Inject Malware on More Than 100,000 Sites

9 ARTICLES

2mo ago

Typosquatted Rust Crate Delivered Build‑Time Backdoor

5 ARTICLES

3mo ago

LiteLLM Supply‑Chain Breach May Have Exposed Thousands After 40‑Minute Malicious PyPI Window

4 ARTICLES

3mo ago

Mozilla Revokes Exposed Firefox and Thunderbird GPG Subkey and Publishes Replacement

4 ARTICLES

3mo ago

OpenAI Orders Mac App Updates After TanStack Supply-Chain Breach Exposes Signing Certificates

3 ARTICLES

6mo ago

RansomHouse Claims Trellix Breach, Posts Screenshots

9 ARTICLES

6mo ago

DAEMON Tools Confirms Supply-Chain Breach, Releases Clean Lite 12.6

7 ARTICLES

6mo ago

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

14 ARTICLES

6mo ago

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

9 ARTICLES

7mo ago

OpenAI Requires macOS App Updates After Axios Supply-Chain Compromise

7 ARTICLES

7mo ago

Meta Halts Work With Mercor After Breach Tied to LiteLLM Supply-Chain Attack

4 ARTICLES

7mo ago

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

13 ARTICLES

7mo ago

Trivy Supply-Chain Hack Widens as Malicious Images Pulled and 1,000+ Victims Emerge

4 ARTICLES

8mo ago

Microsoft Warns of Fake Next.js Repos That Backdoor Developers’ Machines

26 ARTICLES

9mo ago

Notepad++ Confirms Hosting-Level Update Hijack as Rapid7 Ties Operation to China’s Lotus Blossom

Supply Chain Attacks

GitHub Tightens npm Trusted Publishing After Slug-Based Hijack Flaw

Microsoft Details NeedyMantis Malware Used to Maintain Long-Term Network Access

Brevo Breach Used Cloudflare Worker to Inject Malware on More Than 100,000 Sites

Typosquatted Rust Crate Delivered Build‑Time Backdoor

LiteLLM Supply‑Chain Breach May Have Exposed Thousands After 40‑Minute Malicious PyPI Window

Mozilla Revokes Exposed Firefox and Thunderbird GPG Subkey and Publishes Replacement

BdThemes Promotional Feed Hijacked to Seed Rogue WordPress Administrators

Klue Supply-Chain Breach Exposes Salesforce CRM Data

Icarus Extortion Group Used Klue OAuth Breach to Steal Salesforce CRM Data

OpenAI Orders Mac App Updates After TanStack Supply-Chain Breach Exposes Signing Certificates

Never miss stories about

Supply Chain Attacks

RansomHouse Claims Trellix Breach, Posts Screenshots

DAEMON Tools Confirms Supply-Chain Breach, Releases Clean Lite 12.6

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

OpenAI Requires macOS App Updates After Axios Supply-Chain Compromise

Meta Halts Work With Mercor After Breach Tied to LiteLLM Supply-Chain Attack

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

Trivy Supply-Chain Hack Widens as Malicious Images Pulled and 1,000+ Victims Emerge

Microsoft Warns of Fake Next.js Repos That Backdoor Developers’ Machines

Notepad++ Confirms Hosting-Level Update Hijack as Rapid7 Ties Operation to China’s Lotus Blossom

Never miss stories about

Supply Chain Attacks