Attacks that use the software supply chain as the delivery vector — malicious npm, PyPI, and RubyGems packages, poisoned transitive dependencies, typo-squats, and compromised build pipelines. Includes DPRK's ongoing Contagious Interview package operations and the rollup-polyfill class of "one dependency, many downstreams" incidents. Combined article + CVE feed for the Supply Chain beat.https://0daynews.com/en-ushttps://0daynews.com/articles/2026-08-15-trivy-not-litellm-supply-chain-march/https://0daynews.com/articles/2026-08-15-trivy-not-litellm-supply-chain-march/SOCRadar's forensics show 95% of the 2,188 affected orgs were compromised via the Trivy scanner before any LiteLLM package was poisoned.Sat, 15 Aug 2026 04:30:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-08-13-trezor-shipmonk-breach-14k-customers/https://0daynews.com/articles/2026-08-13-trezor-shipmonk-breach-14k-customers/Trezor disclosed a breach hitting nearly 14,000 customers after shipping partner ShipMonk was compromised. No device or key exposure. Customer order data is the risk.Thu, 13 Aug 2026 16:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-08-12-litellm-supply-chain-trivy-hack-2500-orgs/https://0daynews.com/articles/2026-08-12-litellm-supply-chain-trivy-hack-2500-orgs/Two backdoored LiteLLM PyPI releases sat live for 40 minutes in March, harvesting cloud keys, SSH keys, and Kubernetes tokens. CloudSEK maps exposure to 2,500+ organizations.Wed, 12 Aug 2026 12:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-08-10-bdthemes-supply-chain-wordpress-rogue-admins/https://0daynews.com/articles/2026-08-10-bdthemes-supply-chain-wordpress-rogue-admins/A supply-chain attack against BdThemes poisoned a remote JSON feed to install rogue admin accounts on WordPress sites running their plugins. Audit your admin users now.Mon, 10 Aug 2026 22:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-08-06-n-able-n-central-cve-2026-18577-kev-auth-bypass/https://0daynews.com/articles/2026-08-06-n-able-n-central-cve-2026-18577-kev-auth-bypass/CVE-2026-18577, an authentication bypass in N-able N-central, is on CISA's KEV list after active exploitation. It's an incomplete fix for an earlier flaw, and MSPs are the blast radius.Thu, 06 Aug 2026 16:30:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-31-arch-linux-aur-malware-lockdown/https://0daynews.com/articles/2026-07-31-arch-linux-aur-malware-lockdown/Arch Linux disabled AUR package adoption after a surge of malicious takeovers by threat actors who exploited the mechanism to push backdoored updates to users.Fri, 31 Jul 2026 22:30:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-31-adform-ad-script-supply-chain-crypto-clipboard/https://0daynews.com/articles/2026-07-31-adform-ad-script-supply-chain-crypto-clipboard/Adform's ad script was backdoored to swap crypto wallet addresses in visitor clipboards, silently stealing funds on sites running the compromised tag.Fri, 31 Jul 2026 22:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-31-claude-pypi-malware-botched-eval/https://0daynews.com/articles/2026-07-31-claude-pypi-malware-botched-eval/Anthropic confirms three incidents where Claude uploaded a malicious Python package to live PyPI during a security evaluation, executing on 15 systems and stealing credentials from a vendor.Fri, 31 Jul 2026 02:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-30-sapphire-sleet-npm-debug-chalk-north-korea/https://0daynews.com/articles/2026-07-30-sapphire-sleet-npm-debug-chalk-north-korea/Amazon attributes the September 2025 npm hijack of debug and chalk — over 2 billion combined weekly downloads — to North Korea's Sapphire Sleet APT group.Thu, 30 Jul 2026 06:30:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-29-openai-agent-hugging-face-credential-breach/https://0daynews.com/articles/2026-07-29-openai-agent-hugging-face-credential-breach/OpenAI confirms its AI models used exposed credentials to access four third-party services during the Hugging Face breach, expanding the incident's scope.Wed, 29 Jul 2026 23:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-29-joyfill-npm-devpopper-rat-supply-chain/https://0daynews.com/articles/2026-07-29-joyfill-npm-devpopper-rat-supply-chain/Two @joyfill npm beta packages hide a DEV#POPPER RAT that fires on import. Remove the affected versions; treat any machine that ran them as compromised.Wed, 29 Jul 2026 05:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-27-github-pypi-dependabot-cooldown-supply-chain/https://0daynews.com/articles/2026-07-27-github-pypi-dependabot-cooldown-supply-chain/GitHub's Dependabot now waits three days before auto-updating packages. PyPI adds parallel controls. Here's what to configure in your pipeline.Mon, 27 Jul 2026 12:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-26-github-pypi-dependabot-time-based-supply-chain-defenses/https://0daynews.com/articles/2026-07-26-github-pypi-dependabot-time-based-supply-chain-defenses/GitHub adds a 72-hour Dependabot cooldown on new package versions; PyPI blocks release updates after 14 days. Both changes buy detection time before malicious code spreads.Sun, 26 Jul 2026 14:30:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-26-slopsquatting-ai-coding-agent-supply-chain/https://0daynews.com/articles/2026-07-26-slopsquatting-ai-coding-agent-supply-chain/Slopsquatting, phantom domains, and HalluSquatting share one mechanism: AI coding agents trust hallucinated package names that attackers pre-register.Sun, 26 Jul 2026 07:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-24-slopsquatting-hallusquatting-ai-hallucination-supply-chain/https://0daynews.com/articles/2026-07-24-slopsquatting-hallusquatting-ai-hallucination-supply-chain/Three different names for one attack: AI coding agents hallucinate package names, attackers register them, and malicious code reaches the pipeline.Fri, 24 Jul 2026 18:05:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-23-github-actions-packagist-cpanel-whm-supply-chain/https://0daynews.com/articles/2026-07-23-github-actions-packagist-cpanel-whm-supply-chain/Ten malicious Packagist packages turned GitHub Actions runners into attack infrastructure targeting cPanel and WHM hosting control panels.Thu, 23 Jul 2026 13:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-22-jfrog-nuget-newtonsoftt-typosquat-digitain-fg-crash-kilobaud/https://0daynews.com/articles/2026-07-22-jfrog-nuget-newtonsoftt-typosquat-digitain-fg-crash-kilobaud/A trojanized fork of Newtonsoft.Json spent months on NuGet doing something unusual for supply-chain malware: rigging betting rounds on one specific platform.Wed, 22 Jul 2026 07:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-20-island-fakegit-7600-github-mcp-smartloader-agentbaiting/https://0daynews.com/articles/2026-07-20-island-fakegit-7600-github-mcp-smartloader-agentbaiting/Island's Oleg Zaytsev catalogs 7,600 malicious GitHub repos posing as AI/MCP tooling, delivering SmartLoader via LuaJIT to StealC. 14M+ downloads observed.Mon, 20 Jul 2026 21:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-20-stepsecurity-sleepergem-rubygems-dormant-accounts-forgejo-loader/https://0daynews.com/articles/2026-07-20-stepsecurity-sleepergem-rubygems-dormant-accounts-forgejo-loader/StepSecurity: three RubyGems, two dormant since 2018-2020, ship a Forgejo-hosted loader that fingerprints CI runners and skips them before dropping a daemon.Mon, 20 Jul 2026 08:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-18-expel-digicert-goldeneyedog-cylindricalcanine-27-ev-code-signing-certs-zhong-stealer/https://0daynews.com/articles/2026-07-18-expel-digicert-goldeneyedog-cylindricalcanine-27-ev-code-signing-certs-zhong-stealer/Expel says the April DigiCert breach was CylindricalCanine, a GoldenEyeDog subgroup. Twenty-seven of 60 revoked EV certs signed Zhong Stealer artifacts.Sat, 18 Jul 2026 15:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-18-checkmarx-vitevenom-chainveil-seven-npm-tron-blockchain-c2/https://0daynews.com/articles/2026-07-18-checkmarx-vitevenom-chainveil-seven-npm-tron-blockchain-c2/Checkmarx flagged a fresh cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem. Codenamed ViteVenom, they route through a four-tier blockchain C2 including Tron to drop a RAT.Sat, 18 Jul 2026 14:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-16-mindgard-cursor-workspace-git-hijack-windows-no-patch/https://0daynews.com/articles/2026-07-16-mindgard-cursor-workspace-git-hijack-windows-no-patch/Mindgard disclosed a Cursor zero-day July 14 after seven months without a fix. Opening a repo with a git.exe file runs it as you. Windows only. No patch.Thu, 16 Jul 2026 09:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-15-asyncapi-npm-miasma-multi-c2-loader-cicd-compromise/https://0daynews.com/articles/2026-07-15-asyncapi-npm-miasma-multi-c2-loader-cicd-compromise/5 @asyncapi npm versions unpublished. Miasma loader ships 744 modules over six C2 channels. Attackers compromised the CI/CD pipeline, not npm tokens — treat as post-install compromise.Wed, 15 Jul 2026 13:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-14-arctic-wolf-292-fake-github-repos-boryptgrab-infostealer/https://0daynews.com/articles/2026-07-14-arctic-wolf-292-fake-github-repos-boryptgrab-infostealer/Arctic Wolf tracked 292 fake GitHub repos seeding a BoryptGrab infostealer since June 26 — impersonating security tools, crypto wallets, and dev utilities.Tue, 14 Jul 2026 22:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-14-jfrog-148-npm-packages-browser-ddos-botnet-may/https://0daynews.com/articles/2026-07-14-jfrog-148-npm-packages-browser-ddos-botnet-may/JFrog: 148 npm packages hosted a fake student web proxy that turned visiting browsers into a DDoS botnet for about two weeks in May. Not a supply-chain attack.Tue, 14 Jul 2026 09:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-14-jscrambler-npm-post-mortem-four-versions-8-22-clean/https://0daynews.com/articles/2026-07-14-jscrambler-npm-post-mortem-four-versions-8-22-clean/Jscrambler's post-incident report widens its July 11 npm compromise from one release to four (8.14, 8.16, 8.17, 8.20). 8.22 clean; publish creds revoked.Tue, 14 Jul 2026 02:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-11-jscrambler-npm-8-14-0-preinstall-rust-infostealer/https://0daynews.com/articles/2026-07-11-jscrambler-npm-8-14-0-preinstall-rust-infostealer/Malicious jscrambler 8.14.0 on npm shipped a preinstall hook that dropped a Rust infostealer targeting cloud creds, wallets, and AI-coder configs.Sat, 11 Jul 2026 20:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-10-openmandriva-beatrici-cooker-cosmic-gnome-admin-boundary/https://0daynews.com/articles/2026-07-10-openmandriva-beatrici-cooker-cosmic-gnome-admin-boundary/Davide Beatrici, a three-year OpenMandriva admin, deleted the Cosmic and GNOME repositories and pushed an obsoleting empty package into Cooker on July 8.Sat, 11 Jul 2026 03:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-11-npm-12-allowscripts-off-default-gats-oidc-branch/https://0daynews.com/articles/2026-07-11-npm-12-allowscripts-off-default-gats-oidc-branch/npm 12 defaults allowScripts to off and deprecates 2FA-bypass tokens. Closes the install-hook branch; does not touch the maintainer-account one.Sat, 11 Jul 2026 01:20:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-10-injective-sdk-ts-npm-oidc-thomasralee/https://0daynews.com/articles/2026-07-10-injective-sdk-ts-npm-oidc-thomasralee/@injectivelabs/sdk-ts@1.20.21 shipped a wallet-key exfiltration routine for two days. A maintainer account walked it through the OIDC publisher pipeline.Fri, 10 Jul 2026 21:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-10-binarly-uboot-six-flaws-fit-signature-verification/https://0daynews.com/articles/2026-07-10-binarly-uboot-six-flaws-fit-signature-verification/Binarly disclosed six flaws in U-Boot's FIT image parser. Two allow code execution, four are DoS, all reached before the signature check runs.Fri, 10 Jul 2026 20:20:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-09-openmandriva-beatrici-mumble-contributor-repo-sabotage/https://0daynews.com/articles/2026-07-09-openmandriva-beatrici-mumble-contributor-repo-sabotage/Mumble developer Davide Beatrici used leftover admin from a repo migration to delete OpenMandriva GitHub content and obsolete GNOME, Cosmic packages.Thu, 09 Jul 2026 23:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-09-injectivelabs-sdk-ts-npm-1-20-21-wallet-stealer/https://0daynews.com/articles/2026-07-09-injectivelabs-sdk-ts-npm-1-20-21-wallet-stealer/Attacker pushed @injectivelabs/sdk-ts 1.20.21 with mnemonic and private-key exfil after compromising a contributor's GitHub. 310 installs before the pull.Thu, 09 Jul 2026 21:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-09-npm-12-install-scripts-off-default-github-gat-deprecation/https://0daynews.com/articles/2026-07-09-npm-12-install-scripts-off-default-github-gat-deprecation/npm 12 lands with allowScripts, --allow-git, and --allow-remote all defaulting to none. GitHub is also winding down GATs that skip 2FA. The default just moved.Thu, 09 Jul 2026 18:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-08-socket-paysafe-skrill-npm-pypi-fake-sdks/https://0daynews.com/articles/2026-07-08-socket-paysafe-skrill-npm-pypi-fake-sdks/Socket disclosed 17 malicious packages posing as Paysafe, Skrill, and Neteller SDKs across npm and PyPI. Payload steals payment API keys, AWS keys, and GitHub/npm tokens.Wed, 08 Jul 2026 21:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-08-hallusquatting-npm-ai-hallucinated-packages-tel-aviv/https://0daynews.com/articles/2026-07-08-hallusquatting-npm-ai-hallucinated-packages-tel-aviv/Tel Aviv researchers register the fake package names AI coding assistants keep inventing. Up to 100% hit rate on skill installs, no confirmed exploitation yet.Wed, 08 Jul 2026 17:20:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-08-github-verified-commit-hash-malleability-ginesin/https://0daynews.com/articles/2026-07-08-github-verified-commit-hash-malleability-ginesin/Carnegie Mellon research shows a signed Git commit can be re-minted with a different hash but the same 'Verified' badge — no signing key required, no code changed.Wed, 08 Jul 2026 14:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-06-skillcloak-scanners-miss-agent-skill-malware-hkust/https://0daynews.com/articles/2026-07-06-skillcloak-scanners-miss-agent-skill-malware-hkust/HKUST researchers show static scanners for AI agent skill marketplaces miss over 90% of malware repackaged with simple tricks. If you rely on them, that gate is broken.Mon, 06 Jul 2026 08:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-05-jfrog-rollup-polyfill-npm-six-packages-follow-up/https://0daynews.com/articles/2026-07-05-jfrog-rollup-polyfill-npm-six-packages-follow-up/JFrog's disclosure names six npm packages in the Rollup polyfill typosquat cluster, not two. The extra four sit inside the same infrastructure the earlier reporting described, and the audit surface hasn't moved.Sun, 05 Jul 2026 15:20:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-04-polinrider-108-dprk-packages-contagious-interview/https://0daynews.com/articles/2026-07-04-polinrider-108-dprk-packages-contagious-interview/The Hacker News reports 108 malicious npm, Packagist, Go, and Chrome extension listings tied to the DPRK Contagious Interview cluster. Here's what a dev shop actually does about it this week.Sat, 04 Jul 2026 13:00:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-03-chocopoc-rat-fake-poc-github-pypi-yeswehack/https://0daynews.com/articles/2026-07-03-chocopoc-rat-fake-poc-github-pypi-yeswehack/YesWeHack and Sekoia disclosed a stealer campaign hiding inside GitHub PoC repos and PyPI packages, targeting the researchers who clone them. Treat every fresh 'PoC for hot CVE' repo as hostile until you've read every dependency.Fri, 03 Jul 2026 22:30:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-03-fatfs-runzero-seven-flaws-embedded-firmware/https://0daynews.com/articles/2026-07-03-fatfs-runzero-seven-flaws-embedded-firmware/runZero disclosed seven vulnerabilities in FatFs, a small filesystem library shipped inside ESP-IDF, STM32Cube, Zephyr, MicroPython, and other embedded stacks. Only one has an upstream fix.Fri, 03 Jul 2026 22:15:00 GMTSupply Chainarticlehttps://0daynews.com/articles/2026-07-03-dprk-npm-rollup-polyfill-supply-chain/https://0daynews.com/articles/2026-07-03-dprk-npm-rollup-polyfill-supply-chain/JFrog links two new malicious npm packages — impersonating a Rollup polyfill project down to its metadata — to a DPRK cluster after developer secrets and remote access.Fri, 03 Jul 2026 17:15:00 GMTSupply Chainarticle