Technology ❯ Cybersecurity

Supply Chain Attacks

Malware Software Vulnerabilities npm Data Breaches Threat Actors npm Ecosystem Targeted Industries Domain Exploitation NPM Ecosystem Malware Distribution

Coordinated npm Attack Used GitHub Actions Flaws to Push Malicious TanStack Releases

The breach highlights weak points in GitHub Actions workflows that let attackers turn trusted builds into delivery channels.

Stories older than 24h

RansomHouse Claims Trellix Breach, Posts Screenshots

DAEMON Tools Confirms Supply-Chain Breach, Releases Clean Lite 12.6

Malware-Laced Updates Hit SAP-Linked npm Packages, Steal Developer and CI Secrets

Bitwarden CLI npm Release Briefly Backdoored in Supply-Chain Campaign

OpenAI Requires macOS App Updates After Axios Supply-Chain Compromise

Meta Halts Work With Mercor After Breach Tied to LiteLLM Supply-Chain Attack

TeamPCP Poisons Telnyx Python SDK on PyPI With WAV‑Hidden Infostealer

Trivy Supply-Chain Hack Widens as Malicious Images Pulled and 1,000+ Victims Emerge

Microsoft Warns of Fake Next.js Repos That Backdoor Developers’ Machines

Notepad++ Confirms Hosting-Level Update Hijack as Rapid7 Ties Operation to China’s Lotus Blossom

Malicious npm 'Lotusbail' Package Steals WhatsApp Data and Plants Persistent Backdoor

Google Details 'BadAudio' Malware Behind APT24’s Multi‑Year Espionage

ESET Details 'EdgeStepper' Implant Used by China-Aligned PlushDaemon to Hijack Software Updates

Nx npm Packages Compromised in 'S1ngularity' Attack With Second-Wave Exploitation Emerging

PyPI Starts Daily Expired-Domain Checks, Unverifies 1,800 Emails to Block Account Takeovers

Phishing Campaign Targets Mozilla and PyPI Developer Accounts

LottieFiles Supply Chain Attack Drains Users' Crypto Wallets