Malicious npm Packages Target OpenSearch and Elasticsearch Users
A single attacker has published 14 malicious npm packages impersonating popular libraries, raising concerns about supply chain security.
Tag supply chain attack
TrapDoor Supply Chain Attack Distributes Credential-Stealing Malware
A coordinated supply chain attack named TrapDoor has been identified, targeting npm, PyPI, and Crates.io to spread credential-stealing malware through numerous malicious packages.
Megalodon Campaign Targets Over 5,500 GitHub Repositories
A new automated malware campaign named Megalodon has compromised more than 5,500 GitHub repositories, raising concerns over supply chain security.
Grafana Labs Confirms GitHub Breach Linked to TanStack npm Attack
Grafana Labs has reported a breach of its GitHub environment, revealing source code and internal information but confirming no compromise of customer production systems.
OpenAI Faces Supply Chain Compromise Linked to TanStack npm Incident
OpenAI has disclosed a security incident involving the theft of internal credentials due to compromised employee devices, part of a broader supply chain attack affecting npm ecosystems.
Ransomware or Wiper? The Vect Incident Explained
Recent findings reveal that Vect's ransomware is actually a data wiper, rendering recovery impossible for affected organizations.
Checkmarx: Ongoing Supply Chain Attack Targets Security Tools, Exposes Sensitive Data
Checkmarx confirms data exposure linked to a supply chain attack, with Lapsus$ claiming responsibility for the breach.
Malicious KICS Docker Images and VS Code Extensions Compromise Checkmarx Supply Chain
Recent findings reveal that malicious Docker images and Visual Studio Code extensions have compromised Checkmarx's software supply chain, posing significant risks to users.
OpenAI Revokes macOS App Certificate Following Axios Supply Chain Incident
OpenAI has taken precautionary measures by revoking its macOS app certificate after a supply chain attack involving the Axios library. The company confirmed that no user data was compromised.
Supply Chain Vulnerability Exposed by Context Hub’s AI Documentation Service
A recent proof-of-concept attack highlights significant supply chain vulnerabilities in Context Hub, a service designed to assist AI coding agents with API documentation.
