Supply Chain Attacks

Malicious code was injected into @redhat-cloud-services packages, enabling credential theft across developer environments. Immediate package revocation and scans advised.

Coordinated disruption of Glassworm infrastructure; assess supply-chain risk and harden package sources.

Major retail breach affecting millions; highlights risk from third-party access and credential abuse. Prepare containment and notification playbooks.

Cross-ecosystem attack distributing credential-stealing malware; impacts developers and supply chains.

Attacker-inserted backdoors via GitHub tags affected numerous Laravel-Lang packages. Audit dependencies and rotate credentials.

VPN seizure and supply-chain risk underscore need for stronger third-party controls.

Poisoned VS Code extension led to internal repo access; reinforces dev-tool supply-chain risk.

Threat actors hijacked a popular GitHub Actions workflow, redirecting all tags to an imposter commit to harvest CI/CD credentials. Review CI workflows and revoke compromised tokens.

Two OpenAI employee devices were compromised; credential material stolen from code repositories. No user data or production systems affected.

Ransomware overlay amid 600+ manufacturing sector hits; highlights supply-chain risk and downtime impact.

ScarCruft trojanized a gaming platform to deploy backdoors on Windows and Android. Review supply chain and application trust.

Tiny package-based attack chain shows rapid compromise across popular software ecosystems.

Mini Shai-Hulud supply-chain attack breached SAP-related NPM packages to steal credentials; review dependencies and monitor for credential theft.

April 2026 Windows 11 update breaks third-party backup software; assess vendor patches and rollback options to avoid data loss.

External tooling compromise allowed unauthorized access; assess third-party risk and tighten vendor controls.

Third-party AI tool context access enabled a breach; emphasize third-party risk, credential hygiene, and cloud access reviews.