The malware was designed to steal and exfiltrate secrets, and to propagate itself via stolen NPM and GitHub credentials.

The post Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack appeared first on SecurityWeek.

A threat actor poisoned several Jscrambler NPM package versions to drop a cross-platform credential stealer.

The post Multiple Jscrambler Packages Impacted by Supply Chain Attack appeared first on SecurityWeek.

The PolinRider campaign has compromised more than 100 legitimate open source packages and repositories to deliver a backdoor and information stealer to developers.

The post North Korean Hackers Target Open Source Developers in Supply Chain Attacks  appeared first on SecurityWeek.

Decades-old Bash shell tricks can bypass safeguards in most open source AI coding agents, potentially turning malicious repositories into supply chain attack vectors.

The post Decades-Old Bash Tricks Expose AI Coding Agents to Supply Chain Attacks appeared first on SecurityWeek.

Roughly two dozen companies have notified their customers of the Klue-Salesforce incident impact.

The post More Klue Breach Victims Identified as Hackers Get Hacked appeared first on SecurityWeek.