Arch Linux Halts AUR Package Adoptions Amid Security Concerns
PremiumArch Linux disables AUR package adoption after malicious takeovers and commits threatened wide user compromise via packages.
§Topic · Supply Chain Attacks
Supply Chain Attacks
Compromised packages, typosquatting campaigns, malicious dependencies, and software supply chain incidents on npm, PyPI, Go, and Rust.
All dispatchesMonday, August 3
Friday, July 31
Monday, July 20
Malicious npm Packages Exploit Blockchain to Deploy RAT in Vite Ecosystem
PremiumSeven malicious Vite npm packages (ViteVenom) use blockchain-based C2 to deliver a RAT, compromising developer supply chains.
Ernst & Young Hit by Data Breach Exposing Client Tax Documents
PremiumEY discloses breach of a third-party support ticket system, with client tax documents accessed and downloaded.
Ransomware Attack Disrupts Fairlife Production Across United States
PremiumRansomware forced Coca‑Cola's Fairlife to suspend U.S. production, impacting supply chains and operations.
Friday, July 17
Russian Hackers Exploit WebEx and Zoom to Spread Starland Malware
PremiumRussian actor UAT-11795 trojanized WebEx and Zoom installers to deploy Starland RAT, stealing credentials and crypto.
Compromised AsyncAPI npm Packages Unleash Complex Botnet Malware
PremiumFour @asyncapi npm packages were compromised to distribute a multi-stage botnet loader with credential-stealing payloads.
Cyberattack on Nichirei Logistics Shakes Japan's Food Supply Chain
PremiumCyberattack on Nichirei Logistics disrupted cold-chain operations, causing KFC and supermarket supply shortages across Japan.
Wednesday, July 15
Security Breach: AsyncAPI npm Packages Compromised via GitHub Actions
AsyncAPI packages were trojanized after attacker stole an npm publishing token via GitHub Actions, risking developer and CI compromise.
Miasma v3 Exploits npm Packages to Breach Developer Systems
Miasma v3 delivered via trojanized AsyncAPI packages creates persistent backdoors on developer machines and build servers.
Lidl Alerts Customers to Data Breach and Phishing Threats
Retailer Lidl notifies customers after a third-party supplier breach exposed stored customer data hosted externally.
Monday, July 13
Injective Labs GitHub Breach Compromises Crypto Wallet Security
PremiumCompromise of Injective Labs' GitHub published @injectivelabs/[email protected] npm package that exfiltrates crypto wallet keys and seeds.
Security Alert: Compromised Jscrambler npm Package Delivers Rust Infostealer
PremiumMalicious jscrambler npm v8.14.0 runs a preinstall hook that drops a cross-platform Rust infostealer during package install.
Friday, July 10
Monday, June 29
Friday, June 26
Wednesday, June 24
LastPass Breach Highlights Vulnerabilities in Klue Supply Chain
OAuth token theft in Klue supply chain enables access to Salesforce data; investigation ongoing.
Critical Backdoor Discovered in ShapedPlugin WordPress Pro Plugins
Supply chain compromise injected backdoor code into official Pro plugin releases; warns on software supply chain risk.
Friday, June 19
WordPress Plugin Compromise Underscores Supply Chain Vulnerabilities
PremiumWordPress plugin supply-chain compromise delivers infected releases; audit plugins and CI/CD.
Salesforce Data Compromised Through Klue OAuth Exploit
PremiumOAuth abuse via Klue integration enables CRM data exfiltration; review third-party app grants and tokens.
Get these articles delivered to your inbox.
Subscribe free