#supply chain attack
28 stories taggedsupply chain attack · page 2 of 2.
Trojanised AsyncAPI packages slip onto npm, hitting a library downloaded 2.25 million times a week
Attackers hijacked a GitHub build pipeline on 14 July to publish five poisoned versions of AsyncAPI tools, wiring in a stealthy info-stealer that talks to its operators over Ethereum and peer-to-peer networks.
Malicious Jscrambler npm package stole developer secrets for two hours before takedown
A poisoned release of the Jscrambler npm package was downloaded almost 1,500 times, scooping up cloud keys, wallet seed phrases and browser credentials before the company pulled it.
Booby-trapped jscrambler npm release runs infostealer the moment you install it
Version 8.14.0 of a popular JavaScript protection package shipped with a hidden payload that fires during install, no code changes required from the developer.
Over 200 Fake GitHub Repositories Caught Secretly Installing Windows Malware
A criminal operation called Muck and Load built a web of 222 phoney code repositories to trick software developers into downloading password-stealing programs, spyware, and cryptominers.
Iran-Linked Hackers Hit Israeli IT Firms to Reach High-Value Targets
A group tied to Iran used a flexible, plug-in-style hacking toolkit to break into IT service providers in Israel, then moved through those companies to attack their clients.
North Korean Hackers Poisoned Over 100 Open Source Packages to Spy on Developers
A campaign called PolinRider has quietly corrupted legitimate software building blocks used by developers worldwide, planting tools that steal data and leave a hidden door open for attackers.
An AI Coding Tool Built Into Millions of Developer Setups Had a Flaw That Could Hand Hackers Your Cloud Keys
A security hole in Amazon's AI coding assistant let criminals steal cloud passwords just by getting a developer to open a poisoned folder. It's patched — but the attack method is spreading.
ShapedPlugin's Update Channel Hijacked, Pro Plugins Shipped with Backdoor
Attackers slipped malicious code into licensed Pro releases by compromising the vendor's own build pipeline — a clean supply-chain hit on WordPress installs.
War Room Debrief: How a Fictional Grocery Chain Got Crushed by APT 64
A tabletop exercise at Infosecurity Europe put ransomware, AI poisoning, and deepfake CEO videos inside a simulated supermarket attack. The blue team held the line. The red team shorted the stock anyway.
OceanLotus Turns SPECTRALVIPER on Vietnamese Investors and a Construction Firm
Two campaigns, one toolset. The Vietnam-aligned crew spent eighteen months inside a state-linked infrastructure builder before pivoting to a supply chain hit on retail stock investors.
The Hades Campaign: Malware That Deceives AI Security Systems
A sophisticated supply chain attack exploits AI analysis, targeting Python environments with silent payloads.
Miasma Campaign Infects Red Hat npm Packages
Latest supply chain attack reveals persistent threat of credential theft
SymJack: How a Rogue Symlink Turns Your AI Coding Agent Into a Supply Chain Weapon
A newly documented attack technique exploits AI coding agents through malicious repositories and disguised symlinks, silently planting attacker-controlled MCP servers deep inside developer environments.