Over 400 malicious versions of 170 packages were published as part of the new Mini Shai-Hulud campaign.

The post TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack appeared first on SecurityWeek.

A malicious version of the plugin was published to the Jenkins Marketplace late last week.

The post Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek.

The software developer has identified the impacted systems, removed potentially compromised files, and validated installation packages.

The post Vendor Says Daemon Tools Supply Chain Attack Contained appeared first on SecurityWeek.

While trojanized Daemon Tools versions were installed worldwide, a sophisticated backdoor was dropped only on a dozen systems.

The post Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack appeared first on SecurityWeek.

The compromised Lightning and Intercom packages have a combined monthly download count of nearly 10 million.

The post 1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom appeared first on SecurityWeek.

The Mini Shai-Hulud attack introduced a preinstall hook to fetch and execute a Bun binary and bypass security monitoring.

The post SAP NPM Packages Targeted in Supply Chain Attack appeared first on SecurityWeek.

An attacker could have planted a malicious configuration to execute commands outside the sandbox.

The post Critical Gemini CLI Flaw Enabled Host Code Execution, Supply Chain Attacks appeared first on SecurityWeek.

The hackers exfiltrated the data from Checkmarx’s GitHub environment on March 30, a week after publishing malicious code.

The post Checkmarx Confirms Data Stolen in Supply Chain Attack appeared first on SecurityWeek.

Tied to a fresh Checkmarx supply chain attack claimed by TeamPCP, the incident references the Shai-Hulud worm.

The post Bitwarden NPM Package Hit in Supply Chain Attack appeared first on SecurityWeek.

The AI giant is taking action after determining that a macOS code signing certificate may have been compromised.

The post OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack appeared first on SecurityWeek.

Download links were replaced by a Russian-speaking threat actor to distribute a recently emerged malware named STX RAT.

The post CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads appeared first on SecurityWeek.

Hackers published 36 NPM packages posing as Strapi plugins to execute shells, escape containers, and harvest credentials.

The post Guardarian Users Targeted With Malicious Strapi NPM Packages appeared first on SecurityWeek.

The threat actor behind the Axios supply chain attack has been aiming at other maintainers in its social engineering campaign.

The post North Korean Hackers Target High-Profile Node.js Maintainers appeared first on SecurityWeek.

Hackers stole over 300GB of data from the Commission’s AWS environment, including personal information.

The post European Commission Confirms Data Breach Linked to Trivy Supply Chain Attack appeared first on SecurityWeek.

The AI recruiting firm is investigating the incident as Lapsus$ claimed the theft of 4TB of Mercor data.

The post Mercor Hit by LiteLLM Supply Chain Attack appeared first on SecurityWeek.

A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored package versions.

The post Axios NPM Package Breached in North Korean Supply Chain Attack appeared first on SecurityWeek.

After validating stolen credentials using TruffleHog, the hacking group started AWS services enumeration and lateral movement activities.

The post TeamPCP Moves From OSS to AWS Environments appeared first on SecurityWeek.

Two malicious versions of the popular SDK were uploaded to the PyPI registry, targeting Windows, macOS, and Linux.

The post Telnyx Targeted in Growing TeamPCP Supply Chain Attack appeared first on SecurityWeek.

The hackers compromised GitHub Action tags, then shifted to NPM, Docker Hub, VS Code, and PyPI, and teamed with Lapsus$.

The post From Trivy to Broad OSS Compromise: TeamPCP Hits Docker Hub, VS Code, PyPI appeared first on SecurityWeek.