Supply-Chain

Ledger Confirms Spy Implant in Wallets Sold by CryptoBilis

Ledger Confirms Spy Implant in Wallets Sold by CryptoBilis

Oct 12, 2026 · 1 min read

FakeGit Returns With 17,610 Fake GitHub Repos Pushing SmartLoader

FakeGit Returns With 17,610 Fake GitHub Repos Pushing SmartLoader

Oct 9, 2026 · 2 min read

Cheap Android Phones Ship With Midnight Mimosa Ad-Fraud Malware

Cheap Android Phones Ship With Midnight Mimosa Ad-Fraud Malware

Oct 8, 2026 · 2 min read

Tensorlake npm Package Hijacked to Spread Shai-Hulud Worm

Tensorlake npm Package Hijacked to Spread Shai-Hulud Worm

Oct 8, 2026 · 2 min read

Frontline Education Breach Exposes School Employee SSNs

Frontline Education Breach Exposes School Employee SSNs

Oct 2, 2026 · 1 min read

North Korean Hackers Plant Malware in HashiCorp Terraform Registry

North Korean Hackers Plant Malware in HashiCorp Terraform Registry

Sep 24, 2026 · 1 min read

GitLab's Issue Email Token Lets Anyone Push Code as You

GitLab's Issue Email Token Lets Anyone Push Code as You

Sep 24, 2026 · 1 min read

Fake Twilio Bug-Bounty npm Package Steals Developer Credentials

Fake Twilio Bug-Bounty npm Package Steals Developer Credentials

Sep 23, 2026 · 1 min read

BigCommerce Merchants Hit by Ribon App Data Breach

BigCommerce Merchants Hit by Ribon App Data Breach

Sep 21, 2026 · 1 min read

North Korea's Jade Sleet Hits Indian IT Firm With New macOS Backdoors

North Korea's Jade Sleet Hits Indian IT Firm With New macOS Backdoors

Sep 21, 2026 · 1 min read

npm Malware Hides in Runtime to Bypass npm v12 Security Controls

npm Malware Hides in Runtime to Bypass npm v12 Security Controls

Sep 20, 2026 · 1 min read

LLM-Built PhantomRaven Stealer Targets Developer Credentials via npm

LLM-Built PhantomRaven Stealer Targets Developer Credentials via npm

Sep 19, 2026 · 1 min read

WeaselBiscuit Malware in 13 npm Packages Targets Chrome Extensions

WeaselBiscuit Malware in 13 npm Packages Targets Chrome Extensions

Sep 18, 2026 · 1 min read

Plugin4Shell: AI Coding Agents Can Be Fed Malicious Plugins

Plugin4Shell: AI Coding Agents Can Be Fed Malicious Plugins

Sep 18, 2026 · 2 min read

Brevo Supply-Chain Attack Pushed ClickFix Malware to 100K Sites

Brevo Supply-Chain Attack Pushed ClickFix Malware to 100K Sites

Sep 17, 2026 · 2 min read

WordPress Plugin Supply Chain Attack Backdoors 1,500 Sites

WordPress Plugin Supply Chain Attack Backdoors 1,500 Sites

Sep 15, 2026 · 1 min read

Red Heron Exploits Gitea RCE to Compromise 13 Organizations

Red Heron Exploits Gitea RCE to Compromise 13 Organizations

Sep 15, 2026 · 1 min read

OpenAI Agent Swarm Behind RubyGems Attack and RubyDoc Server Breach

OpenAI Agent Swarm Behind RubyGems Attack and RubyDoc Server Breach

Sep 12, 2026 · 1 min read

Trezor Breach Reaches 81,000 After ShipMonk Fails to Delete Data

Trezor Breach Reaches 81,000 After ShipMonk Fails to Delete Data

Sep 8, 2026 · 1 min read

EtherHiding: 5,400 Hacked Sites Deliver ClickFix via Blockchain

EtherHiding: 5,400 Hacked Sites Deliver ClickFix via Blockchain

Sep 5, 2026 · 1 min read

Malicious PHP Packages Exploit Unpatched iPhones, Steal Crypto Seeds

Malicious PHP Packages Exploit Unpatched iPhones, Steal Crypto Seeds

Sep 2, 2026 · 1 min read

Critical JFrog Artifactory Flaw Exploited One Day After Patch

Critical JFrog Artifactory Flaw Exploited One Day After Patch

Sep 2, 2026 · 1 min read

Hackers Hijack BGP Routes to Push Malicious Virtualizor Updates

Hackers Hijack BGP Routes to Push Malicious Virtualizor Updates

Sep 1, 2026 · 1 min read

North Korean IT Worker Scheme Targets Healthcare and Sales

North Korean IT Worker Scheme Targets Healthcare and Sales

Sep 1, 2026 · 1 min read

19 Chrome and Edge Extensions Caught Stealing Crypto Wallet Secrets

19 Chrome and Edge Extensions Caught Stealing Crypto Wallet Secrets

Aug 28, 2026 · 1 min read

Two Alleged TeamPCP Hackers Arrested in Australia

Two Alleged TeamPCP Hackers Arrested in Australia

Aug 27, 2026 · 1 min read

Hackers Turn npm Into Free Phishing Host via Mirror Abuse

Hackers Turn npm Into Free Phishing Host via Mirror Abuse

Aug 26, 2026 · 1 min read

14 Trojanized npm Packages Hide AI-Powered Linux Backdoor

14 Trojanized npm Packages Hide AI-Powered Linux Backdoor

Aug 22, 2026 · 1 min read

Over 9,300 Leaked AWS Keys Are Still Active and Valid

Over 9,300 Leaked AWS Keys Are Still Active and Valid

Aug 21, 2026 · 1 min read

Rust arrayref Crate Poisoned With Infostealer in Supply Chain Attack

Rust arrayref Crate Poisoned With Infostealer in Supply Chain Attack

Aug 20, 2026 · 1 min read

Fake RubyGems Packages Steal Browser Credentials and Crypto Wallets

Fake RubyGems Packages Steal Browser Credentials and Crypto Wallets

Aug 18, 2026 · 1 min read

Trezor Data Breach Exposes Nearly 14,000 Customers via ShipMonk

Trezor Data Breach Exposes Nearly 14,000 Customers via ShipMonk

Aug 13, 2026 · 1 min read

LiteLLM Supply Chain Attack Exposed Credentials at 2,100+ Orgs

LiteLLM Supply Chain Attack Exposed Credentials at 2,100+ Orgs

Aug 12, 2026 · 1 min read

Malicious MCP Servers Can Trick AI Coding Agents Into Leaking Your Secrets

Malicious MCP Servers Can Trick AI Coding Agents Into Leaking Your Secrets

Aug 12, 2026 · 1 min read

Fake Solidity VS Code Extensions Steal Crypto Wallets and Dev Keys

Fake Solidity VS Code Extensions Steal Crypto Wallets and Dev Keys

Aug 11, 2026 · 1 min read

BdThemes Plugin Supply-Chain Attack Creates Rogue WordPress Admins

BdThemes Plugin Supply-Chain Attack Creates Rogue WordPress Admins

Aug 10, 2026 · 1 min read

LexisNexis Shuts Down Three Services After Suspicious Server Activity

LexisNexis Shuts Down Three Services After Suspicious Server Activity

Aug 10, 2026 · 1 min read

Valve Notifies Steam Hardware Customers of Data Breach via Shipper

Valve Notifies Steam Hardware Customers of Data Breach via Shipper

Aug 10, 2026 · 1 min read

Head Mare Hackers Trojanize TrueConf Installers With Backdoors

Head Mare Hackers Trojanize TrueConf Installers With Backdoors

Aug 8, 2026 · 1 min read

Claude Code and Gemini CLI Flaws Leak CI Workflow Secrets

Claude Code and Gemini CLI Flaws Leak CI Workflow Secrets

Aug 7, 2026 · 1 min read

800 Malicious npm Packages Drop Cross-Platform RAT and Infostealer

800 Malicious npm Packages Drop Cross-Platform RAT and Infostealer

Aug 7, 2026 · 1 min read

Zbtlink Routers Ship With Factory Backdoor for Remote Root

Zbtlink Routers Ship With Factory Backdoor for Remote Root

Aug 6, 2026 · 1 min read

77 fake VS Code extensions stole developer data on Open VSX

77 fake VS Code extensions stole developer data on Open VSX

Aug 5, 2026 · 1 min read

XCSSET v40 Backdoors Xcode Projects to Hijack Chrome and Telegram

XCSSET v40 Backdoors Xcode Projects to Hijack Chrome and Telegram

Aug 4, 2026 · 1 min read

ChainDrop npm Worm Hits 1,300 Packages and 2 Billion Monthly Downloads

ChainDrop npm Worm Hits 1,300 Packages and 2 Billion Monthly Downloads

Aug 4, 2026 · 1 min read

18 Malicious npm Packages Target Alibaba Developers With RAT Malware

18 Malicious npm Packages Target Alibaba Developers With RAT Malware

Aug 4, 2026 · 1 min read

Hugging Face Diffusers Flaws Let Model Repos Execute Arbitrary Code

Hugging Face Diffusers Flaws Let Model Repos Execute Arbitrary Code

Aug 3, 2026 · 1 min read

Ad Giant Adform's Script Hijacked to Steal Crypto Wallet Funds

Ad Giant Adform's Script Hijacked to Steal Crypto Wallet Funds

Jul 31, 2026 · 1 min read

Arch Linux Freezes AUR Adoptions After Malware Takeover Wave

Arch Linux Freezes AUR Adoptions After Malware Takeover Wave

Jul 31, 2026 · 1 min read

North Korea Hijacked debug and chalk npm Packages

North Korea Hijacked debug and chalk npm Packages

Jul 31, 2026 · 1 min read

Claude AI Escaped Its Sandbox and Uploaded Malware to PyPI

Claude AI Escaped Its Sandbox and Uploaded Malware to PyPI

Jul 31, 2026 · 1 min read

Compromised joyfill npm Packages Install RAT on Import

Compromised joyfill npm Packages Install RAT on Import

Jul 29, 2026 · 1 min read

CubePilot drone controller maker hit by DNS hijacking attack

CubePilot drone controller maker hit by DNS hijacking attack

Jul 28, 2026 · 1 min read

OpenAI Models Exploited Artifactory Zero-Days, Breached Hugging Face

OpenAI Models Exploited Artifactory Zero-Days, Breached Hugging Face

Jul 28, 2026 · 1 min read

GitHub adds 3-day wait on Dependabot to block poisoned packages

GitHub adds 3-day wait on Dependabot to block poisoned packages

Jul 28, 2026 · 1 min read

FastJson zero-day RCE hits US businesses — no fix yet

FastJson zero-day RCE hits US businesses — no fix yet

Jul 28, 2026 · 1 min read

ShinyHunters Claim Ernst & Young Breach, Threaten Tax Data Leak

ShinyHunters Claim Ernst & Young Breach, Threaten Tax Data Leak

Jul 27, 2026 · 2 min read

AI Agent Hacked Hugging Face, Stole Internal Credentials

AI Agent Hacked Hugging Face, Stole Internal Credentials

Jul 20, 2026 · 1 min read

Hackers Breached DigiCert and Stole Code-Signing Certificates

Hackers Breached DigiCert and Stole Code-Signing Certificates

Jul 17, 2026 · 1 min read

jscrambler npm Package Poisoned to Steal Developer Credentials

jscrambler npm Package Poisoned to Steal Developer Credentials

Jul 12, 2026 · 1 min read

Polymarket Users Lost $3 Million in a Supply Chain Attack

Polymarket Users Lost $3 Million in a Supply Chain Attack

Jun 27, 2026 · 1 min read

Miasma Worm Infected 73 Microsoft Code Repositories

Miasma Worm Infected 73 Microsoft Code Repositories

Jun 7, 2026 · 1 min read

Fake Login Popups Hit Toshiba and Muji Sites in Polyfill Attack

Fake Login Popups Hit Toshiba and Muji Sites in Polyfill Attack

Jun 6, 2026 · 1 min read

Fake Banking Package Steals Credentials via NuGet and npm

Fake Banking Package Steals Credentials via NuGet and npm

May 30, 2026 · 1 min read

Supply chain attack hijacks developer packages to steal credentials

Supply chain attack hijacks developer packages to steal credentials

May 24, 2026 · 1 min read

When Valid Attestations Aren't Enough: TanStack, OpenAI's Laptops, and the Case for Structural Pre-Flight Checks

When Valid Attestations Aren't Enough: TanStack, OpenAI's Laptops, and the Case for Structural Pre-Flight Checks

May 18, 2026 · 12 min read

macOS Users: Update OpenAI Apps After Supply Chain Attack

macOS Users: Update OpenAI Apps After Supply Chain Attack

May 17, 2026 · 1 min read

AI Chatbots Are Making Up Links and Hackers Are Pouncing

AI Chatbots Are Making Up Links and Hackers Are Pouncing

May 14, 2026 · 1 min read

JDownloader Website Hacked to Spread Remote-Access Malware

JDownloader Website Hacked to Spread Remote-Access Malware

May 10, 2026 · 1 min read

GitHub Is Stumbling — What That Means for the Apps You Use

GitHub Is Stumbling — What That Means for the Apps You Use

May 7, 2026 · 4 min read

Trellix Security Firm Hit by Source Code Repository Hack

Trellix Security Firm Hit by Source Code Repository Hack

May 6, 2026 · 1 min read

Google Adds Binary Transparency to Protect Android Apps

Google Adds Binary Transparency to Protect Android Apps

May 6, 2026 · 1 min read

DAEMON Tools Installers Hijacked to Spread Malware

DAEMON Tools Installers Hijacked to Spread Malware

May 5, 2026 · 1 min read

CPUID Website Hijacked: Software Downloads Replaced with STX RAT Malware

CPUID Website Hijacked: Software Downloads Replaced with STX RAT Malware

Apr 14, 2026 · 1 min read

React2Shell exploit hits 766 Next.js servers in 24 hours — mass credential theft campaign confirmed (CVE-2025-55182)

React2Shell exploit hits 766 Next.js servers in 24 hours — mass credential theft campaign confirmed (CVE-2025-55182)

Apr 7, 2026 · 3 min read

The Claude Code Source Leak: What Happened, What Was Exposed, and What It Means for You

The Claude Code Source Leak: What Happened, What Was Exposed, and What It Means for You

Apr 7, 2026 · 12 min read

CERT-EU confirms European Commission cloud breach linked to Trivy supply-chain compromise

CERT-EU confirms European Commission cloud breach linked to Trivy supply-chain compromise

Apr 3, 2026 · 1 min read

TrueConf CVE-2026-3502 zero-day abused to push malicious updates from trusted servers

TrueConf CVE-2026-3502 zero-day abused to push malicious updates from trusted servers

Apr 1, 2026 · 1 min read

BuildKit patches two high-severity build-context escape flaws (CVE-2026-33747, CVE-2026-33748)

BuildKit patches two high-severity build-context escape flaws (CVE-2026-33747, CVE-2026-33748)

Mar 26, 2026 · 1 min read

CISA adds Trivy CVE-2026-33634 to KEV after supply-chain compromise

CISA adds Trivy CVE-2026-33634 to KEV after supply-chain compromise

Mar 26, 2026 · 1 min read

Trivy GitHub Action tags hijacked in supply-chain breach

Trivy GitHub Action tags hijacked in supply-chain breach

Mar 20, 2026 · 1 min read

GlassWorm campaign abuses Open VSX extension dependencies in supply-chain attacks

GlassWorm campaign abuses Open VSX extension dependencies in supply-chain attacks

Mar 14, 2026 · 1 min read

Iran-linked Handala claims disruptive wiper attack on medtech giant Stryker

Mar 13, 2026 · 1 min read

1 2 3 4 5 6 7 8 9