14 verified briefings on Supply Chain Attack. Each story includes a plain-English summary, why it matters, and the concrete action engineering teams should take.
An automated attack named Megalodon targeted 5,561 GitHub repositories in a six-hour period. Attackers used throwaway accounts to push malicious commits containing GitHub Actions workflows designed to steal secrets from CI/CD pipelines, such as API keys and other sensitive environment variables.
As Docker and Kubernetes become standard for modern infrastructure, attackers are developing sophisticated new methods to compromise them. Research highlights a growing trend of attacks, from container escapes to complex supply chain compromises, targeting these widely used technologies and the companies that rely on them.
A developer embedded a malicious prompt into the open-source library `jqwik`. The hidden instruction tricks AI coding assistants into deleting application output files. This novel supply chain attack highlights new security risks for developers who rely on AI tools for coding and debugging tasks.
A popular npm package called 'codexui-android', which claims to be a web UI for OpenAI Codex, is actually malware designed to steal developer authentication tokens. The package has over 29,000 weekly downloads and is reportedly still available from the npm repository.
Researchers have disrupted the Glassworm botnet, which targeted developers through software supply-chain attacks. The operation was notable for its resilient command-and-control infrastructure, which uniquely leveraged Solana blockchain transactions and the BitTorrent network to evade detection and takedown efforts, highlighting new threat vectors.
A malicious NuGet package, "Sicoob.Sdk," is impersonating a software development kit for a major Brazilian financial system. Versions 2.0.0 to 2.0.4 are designed to steal sensitive developer information, including client IDs and PFX certificates, posing a significant software supply chain security risk.
A supply-chain attack compromised JavaScript files used by popular WordPress plugins like OptinMonster. The malicious code created hidden admin accounts on affected sites, giving attackers full control when an administrator was logged in.
A flaw in Anthropic's Claude Code GitHub Action let attackers take over repositories by simply opening an issue. This created a serious supply chain risk, as the action itself could have been compromised and used to spread malicious code.
A developer of the open-source Java testing library `jqwik` intentionally added hidden instructions to sabotage projects built by AI coding agents. This real-world prompt injection attack highlights a new vulnerability in the software supply chain, affecting developers who rely on AI for coding assistance.
A popular GitHub Actions workflow, `actions-cool/issues-helper`, has been compromised in a supply chain attack. Attackers altered repository tags to point to malicious code designed to steal sensitive credentials from CI/CD environments and send them to an external server.
A software supply chain attack has compromised several popular npm packages within the @antv ecosystem. Attackers gained control of a maintainer's account to distribute malicious code. The affected packages include `echarts-for-react`, a library with over one million weekly downloads, posing a significant risk.
The npm registry has experienced another malware attack, this time affecting the AntV data visualization tool. The incident occurred after an attacker compromised the credentials of a maintainer for the popular `timeago.js` library, highlighting ongoing risks in the open-source software supply chain.
A compromised version of the popular Nx Console extension (v18.95.0) was published on the VS Code Marketplace. The malicious version, installed by developers, contained a credential stealer. The extension, with over 2.2 million installations, poses a significant risk to affected users and their organizations.
A recently leaked malware kit named "Shai-Hulud" is now being used in a new campaign targeting the npm registry. Attackers are publishing infected packages to steal sensitive information from developers' systems, including credentials and cryptocurrency wallets. This highlights the ongoing risk of software supply chain attacks.