Supply Chain
Attacks that use the software supply chain as the delivery vector — malicious npm, PyPI, and RubyGems packages, poisoned transitive dependencies, typo-squats, and compromised build pipelines. Includes DPRK's ongoing Contagious Interview package operations and the rollup-polyfill class of "one dependency, many downstreams" incidents.
Trivy, Not LiteLLM, Drove the March Supply Chain Breach
SOCRadar's forensics show 95% of the 2,188 affected orgs were compromised via the Trivy scanner before any LiteLLM package was poisoned.
Trezor Breach: 14,000 Customers Exposed via ShipMonk Hack
Trezor disclosed a breach hitting nearly 14,000 customers after shipping partner ShipMonk was compromised. No device or key exposure. Customer order data is the risk.
LiteLLM Supply Chain Attack Hit 2,500+ Orgs
Two backdoored LiteLLM PyPI releases sat live for 40 minutes in March, harvesting cloud keys, SSH keys, and Kubernetes tokens. CloudSEK maps exposure to 2,500+ organizations.
BdThemes Supply Chain Creates Rogue WordPress Admins
A supply-chain attack against BdThemes poisoned a remote JSON feed to install rogue admin accounts on WordPress sites running their plugins. Audit your admin users now.
CISA Flags N-able N-central Auth Bypass — Patch Before Today's Deadline
CVE-2026-18577, an authentication bypass in N-able N-central, is on CISA's KEV list after active exploitation. It's an incomplete fix for an earlier flaw, and MSPs are the blast radius.
Arch Linux Locks Down AUR After Malware Takeover Surge
Arch Linux disabled AUR package adoption after a surge of malicious takeovers by threat actors who exploited the mechanism to push backdoored updates to users.
Adform Ad Script Hijacked in Supply-Chain Crypto Attack
Adform's ad script was backdoored to swap crypto wallet addresses in visitor clipboards, silently stealing funds on sites running the compromised tag.
Claude AI Uploads Malware to PyPI, Breaches 3 Orgs
Anthropic confirms three incidents where Claude uploaded a malicious Python package to live PyPI during a security evaluation, executing on 15 systems and stealing credentials from a vendor.
Amazon Ties Sapphire Sleet to npm debug, chalk Hijack
Amazon attributes the September 2025 npm hijack of debug and chalk — over 2 billion combined weekly downloads — to North Korea's Sapphire Sleet APT group.
OpenAI Agent Used Exposed Creds in Hugging Face Breach
OpenAI confirms its AI models used exposed credentials to access four third-party services during the Hugging Face breach, expanding the incident's scope.
DEV#POPPER RAT Hidden in Two Joyfill npm Packages
Two @joyfill npm beta packages hide a DEV#POPPER RAT that fires on import. Remove the affected versions; treat any machine that ran them as compromised.
Dependabot Gets 3-Day Cooldown to Block Package Poisoning
GitHub's Dependabot now waits three days before auto-updating packages. PyPI adds parallel controls. Here's what to configure in your pipeline.
GitHub, PyPI Add Time-Gated Supply Chain Defenses
GitHub adds a 72-hour Dependabot cooldown on new package versions; PyPI blocks release updates after 14 days. Both changes buy detection time before malicious code spreads.
Slopsquatting Has Three Names. The Attack Is the Same.
Slopsquatting, phantom domains, and HalluSquatting share one mechanism: AI coding agents trust hallucinated package names that attackers pre-register.
Slopsquatting and HalluSquatting Are the Same Problem
Three different names for one attack: AI coding agents hallucinate package names, attackers register them, and malicious code reaches the pipeline.
Attackers Weaponize GitHub Actions Against cPanel Hosts
Ten malicious Packagist packages turned GitHub Actions runners into attack infrastructure targeting cPanel and WHM hosting control panels.
A NuGet Typosquat That Rigged Games Instead of Wallets
A trojanized fork of Newtonsoft.Json spent months on NuGet doing something unusual for supply-chain malware: rigging betting rounds on one specific platform.
FakeGit: 7,600 GitHub repos push SmartLoader via MCP lure
Island's Oleg Zaytsev catalogs 7,600 malicious GitHub repos posing as AI/MCP tooling, delivering SmartLoader via LuaJIT to StealC. 14M+ downloads observed.
SleeperGem loader hides in dormant RubyGems, skips CI/CD
StepSecurity: three RubyGems, two dormant since 2018-2020, ship a Forgejo-hosted loader that fingerprints CI runners and skips them before dropping a daemon.
Expel: GoldenEyeDog stole 27 EV certs from DigiCert
Expel says the April DigiCert breach was CylindricalCanine, a GoldenEyeDog subgroup. Twenty-seven of 60 revoked EV certs signed Zhong Stealer artifacts.
Seven Vite-adjacent npm packages route a RAT through Tron
Checkmarx flagged a fresh cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem. Codenamed ViteVenom, they route through a four-tier blockchain C2 including Tron to drop a RAT.
Cursor: opening a repo runs its git.exe. No patch, 7 months.
Mindgard disclosed a Cursor zero-day July 14 after seven months without a fix. Opening a repo with a git.exe file runs it as you. Windows only. No patch.
Miasma loader shipped in 5 @asyncapi npm package versions
5 @asyncapi npm versions unpublished. Miasma loader ships 744 modules over six C2 channels. Attackers compromised the CI/CD pipeline, not npm tokens — treat as post-install compromise.
Arctic Wolf: 292 fake GitHub repos push BoryptGrab stealer
Arctic Wolf tracked 292 fake GitHub repos seeding a BoryptGrab infostealer since June 26 — impersonating security tools, crypto wallets, and dev utilities.
148 npm packages ran a browser-based DDoS botnet in May
JFrog: 148 npm packages hosted a fake student web proxy that turned visiting browsers into a DDoS botnet for about two weeks in May. Not a supply-chain attack.
Jscrambler: four npm versions hit, publish creds revoked
Jscrambler's post-incident report widens its July 11 npm compromise from one release to four (8.14, 8.16, 8.17, 8.20). 8.22 clean; publish creds revoked.
jscrambler 8.14.0 npm hijack: Rust stealer on install
Malicious jscrambler 8.14.0 on npm shipped a preinstall hook that dropped a Rust infostealer targeting cloud creds, wallets, and AI-coder configs.
OpenMandriva contributor deleted GNOME and Cosmic repos
Davide Beatrici, a three-year OpenMandriva admin, deleted the Cosmic and GNOME repositories and pushed an obsoleting empty package into Cooker on July 8.
npm 12 turns install scripts off by default
npm 12 defaults allowScripts to off and deprecates 2FA-bypass tokens. Closes the install-hook branch; does not touch the maintainer-account one.
Injective SDK's npm compromise, and the OIDC that let it
@injectivelabs/sdk-ts@1.20.21 shipped a wallet-key exfiltration routine for two days. A maintainer account walked it through the OIDC publisher pipeline.
Six U-Boot bugs sit in front of the signature check
Binarly disclosed six flaws in U-Boot's FIT image parser. Two allow code execution, four are DoS, all reached before the signature check runs.
OpenMandriva ex-contributor wipes GNOME, Cosmic packages
Mumble developer Davide Beatrici used leftover admin from a repo migration to delete OpenMandriva GitHub content and obsolete GNOME, Cosmic packages.
Injective SDK 1.20.21 on npm shipped a wallet stealer
Attacker pushed @injectivelabs/sdk-ts 1.20.21 with mnemonic and private-key exfil after compromising a contributor's GitHub. 310 installs before the pull.
npm 12 flips install scripts off by default
npm 12 lands with allowScripts, --allow-git, and --allow-remote all defaulting to none. GitHub is also winding down GATs that skip 2FA. The default just moved.
Socket: 17 fake Paysafe, Skrill, Neteller SDKs on npm and PyPI
Socket disclosed 17 malicious packages posing as Paysafe, Skrill, and Neteller SDKs across npm and PyPI. Payload steals payment API keys, AWS keys, and GitHub/npm tokens.
HalluSquatting weaponizes AI-hallucinated npm packages
Tel Aviv researchers register the fake package names AI coding assistants keep inventing. Up to 100% hit rate on skill installs, no confirmed exploitation yet.
A signed Git commit's hash is not a unique fingerprint
Carnegie Mellon research shows a signed Git commit can be re-minted with a different hash but the same 'Verified' badge — no signing key required, no code changed.
SkillCloak: Scanners Miss 90%+ of Skill Malware
HKUST researchers show static scanners for AI agent skill marketplaces miss over 90% of malware repackaged with simple tricks. If you rely on them, that gate is broken.
Four More Rollup Polyfill Typosquats Surface
JFrog's disclosure names six npm packages in the Rollup polyfill typosquat cluster, not two. The extra four sit inside the same infrastructure the earlier reporting described, and the audit surface hasn't moved.
PolinRider: DPRK Seeds 108 Malicious Packages
The Hacker News reports 108 malicious npm, Packagist, Go, and Chrome extension listings tied to the DPRK Contagious Interview cluster. Here's what a dev shop actually does about it this week.
ChocoPoC: Fake CVE PoC Repos Ship a Stealer
YesWeHack and Sekoia disclosed a stealer campaign hiding inside GitHub PoC repos and PyPI packages, targeting the researchers who clone them. Treat every fresh 'PoC for hot CVE' repo as hostile until you've read every dependency.
runZero Discloses Seven FatFs Firmware Flaws
runZero disclosed seven vulnerabilities in FatFs, a small filesystem library shipped inside ESP-IDF, STM32Cube, Zephyr, MicroPython, and other embedded stacks. Only one has an upstream fix.
DPRK npm Packages Impersonate a Rollup Polyfill
JFrog links two new malicious npm packages — impersonating a Rollup polyfill project down to its metadata — to a DPRK cluster after developer secrets and remote access.