A malicious dependency the attackers added to over 140 Mastra packages fetches a payload targeting cryptocurrency extensions.

The post North Korean Hackers Blamed for Mastra NPM Supply Chain Attack appeared first on SecurityWeek.

HackerOne, Huntress, Jamf, OneTrust, Recorded Future, Snyk, and Tanium are among the affected Klue customers.

The post More Cybersecurity Firms Disclose Impact From Klue Hack appeared first on SecurityWeek.

The hackers exfiltrated data from Salesforce instances of Klue customers, such as Huntress and Recorded Future.

The post Cybersecurity Firms Impacted by Klue Supply Chain Attack appeared first on SecurityWeek.

The most recent variants of the self-propagating attacks are named Miasma and Hades.

The post Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks appeared first on SecurityWeek.

Hackers published 96 malicious package versions, injected with a credential-stealing worm similar to Mini Shai-Hulud.

The post Supply Chain Attack Hits 32 Red Hat NPM Packages appeared first on SecurityWeek.

Malicious repositories and disguised symlinks can trick AI coding agents into silently installing attacker-controlled MCP servers capable of stealing secrets, compromising CI pipelines, and deploying malicious code.

The post ‘SymJack’ Attack Turns AI Coding Agents Into Supply Chain Attack Delivery Systems appeared first on SecurityWeek.

Published within a 15-minute window, the malicious tags introduced backdoors to exfiltrate CI secrets.

The post Laravel-Lang Packages Poisoned for Malware Delivery appeared first on SecurityWeek.

Fake automated commits injected GitHub Actions workflows containing payloads to steal credentials, CI secrets, keys, and tokens.

The post Over 5,500 GitHub Repositories Infected in ‘Megalodon’ Supply Chain Attack appeared first on SecurityWeek.

Hackers accessed Grafana’s GitHub repositories after a token compromised in the TanStack attack was not rotated.

The post Grafana Says Codebase and Other Data Stolen via TanStack Supply Chain Attack appeared first on SecurityWeek.

A compromised maintainer account was used to publish malicious package versions across the @antv namespace.

The post Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack appeared first on SecurityWeek.

Two employee devices were compromised in the attack, and credential material was stolen from OpenAI code repositories.

The post OpenAI Hit by TanStack Supply Chain Attack appeared first on SecurityWeek.

Over 400 malicious versions of 170 packages were published as part of the new Mini Shai-Hulud campaign.

The post TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack appeared first on SecurityWeek.

A malicious version of the plugin was published to the Jenkins Marketplace late last week.

The post Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek.

The software developer has identified the impacted systems, removed potentially compromised files, and validated installation packages.

The post Vendor Says Daemon Tools Supply Chain Attack Contained appeared first on SecurityWeek.

While trojanized Daemon Tools versions were installed worldwide, a sophisticated backdoor was dropped only on a dozen systems.

The post Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack appeared first on SecurityWeek.

The compromised Lightning and Intercom packages have a combined monthly download count of nearly 10 million.

The post 1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom appeared first on SecurityWeek.

The Mini Shai-Hulud attack introduced a preinstall hook to fetch and execute a Bun binary and bypass security monitoring.

The post SAP NPM Packages Targeted in Supply Chain Attack appeared first on SecurityWeek.

An attacker could have planted a malicious configuration to execute commands outside the sandbox.

The post Critical Gemini CLI Flaw Enabled Host Code Execution, Supply Chain Attacks appeared first on SecurityWeek.

The hackers exfiltrated the data from Checkmarx’s GitHub environment on March 30, a week after publishing malicious code.

The post Checkmarx Confirms Data Stolen in Supply Chain Attack appeared first on SecurityWeek.

The ShinyHunters cybercrime group claimed to have stolen 9 million records containing personal information from Medtronic.

The post Medtronic Hack Confirmed After ShinyHunters Threatens Data Leak appeared first on SecurityWeek.