Tag: supply-chain
-
SAP npm Packages Compromised by “Mini Shai-Hulud” Credential-Stealing Malware
Cybersecurity researchers are sounding the alarm about a new supply chain attack campaign targeting SAP-related npm Packages with credential-stealing malware.According to reports from Aikido Security, SafeDep, Socket, StepSecurity, and Google-owned Wiz, the campaign calling itself the mini Shai-Hulud has affected the following packages associated with SAP’s JavaScript and cloud application First seen on thehackernews.com Jump…
-
Vect 2.0 Ransomware Acts as Wiper, Thanks to Design Error
The emerging ransomware has been deployed against victims of the TeamPCP supply chain attacks, but organizations should think twice before paying for a decryptor. First seen on darkreading.com Jump to article: www.darkreading.com/threat-intelligence/vect-ransomware-wiper-design-error
-
Why a recent supply-chain attack singled out security firms Checkmarx and Bitwarden
Security firms find themselves especially exposed. First seen on arstechnica.com Jump to article: arstechnica.com/information-technology/2026/04/why-a-recent-supply-chain-attack-singled-out-security-firms-checkmarx-and-bitwarden/
-
Vimeo Confirms Data Breach After Hackers Access User Database
Tags: access, breach, cyber, data, data-breach, hacker, risk, security-incident, software, supply-chain, vulnerabilityVimeo has officially confirmed a data breach affecting its user database. The security incident did not originate with Vimeo, but rather with Anodot, a third-party analytics vendor used by the video hosting platform. This event highlights the ongoing risks associated with software supply chains, where a vulnerability in one vendor can compromise multiple downstream companies.…
-
More fake extensions linked to GlassWorm found in Open VSX code marketplace
Tags: control, marketplace, monitoring, open-source, risk, software, supply-chain, tool, update, vulnerabilityAdvice for developers: Janca said developers who want to reduce their exposure to the GlassWorm campaign should start with the basics: install fewer extensions and treat each one as a dependency with real risk attached. Disable auto-update so you control when updates are applied, and carefully evaluate each one. Use a next-generation SCA tool that covers…
-
Fresh Wave of GlassWorm VS Code Extensions Slices Through Supply Chain
Tags: supply-chainAttackers continue to scale a campaign to seed Open VSX with seemingly benign VS Code extensions that spread self-propagating malware. First seen on darkreading.com Jump to article: www.darkreading.com/application-security/fresh-glassworm-vs-code-extensions-supply-chain
-
VECT: Ransomware by design, Wiper by accident
ey Takeaways Background VECT Ransomware is a Ransomware-as-a-Service (RaaS) program that made its first appearance in December 2025 on a Russian-language cybercrime forum. After claiming their first two victims in January 2026, the group got back into the public eye due to an announcement of a partnership with TeamPCP, the actor behind several supply-chain attacks…
-
Artifact Poisoning: A Silent Threat to Enterprise Software Supply Chains
Software supply chains have quietly become one of the most critical and most vulnerable foundations of modern enterprises. Today, applications are no longer monolithic systems built entirely in-house. Instead, they are complex assemblies of open-source libraries, third-party packages, container images, APIs, and pre-built binaries pulled from multiple repositories. This interconnected ecosystem has dramatically improved speed,……
-
Ongoing supply-chain attack ‘explicitly targeting’ security, dev tools
Vendor confirms repo data exposure after Lapsus$ claims source code, secrets dump First seen on theregister.com Jump to article: www.theregister.com/2026/04/27/supply_chain_campaign_targets_security/
-
Pentagon’s Anthropic Fight Draws Rebuke From Ex-DOD Leaders
Former Officials, Tech Groups Say Anthropic Designation Is Illegal – and Dangerous. Former U.S. defense and intelligence officials argue the Pentagon’s designation of Anthropic as a supply-chain risk was politically motivated and legally flawed, warning it could erode trust in government contracting and weaken the defense AI ecosystem. First seen on govinfosecurity.com Jump to article:…
-
Entwickler-Tools als neue Angriffsfläche
Aktuelle Angriffe auf den Infrastruktur-Scanner <> und den Kommandozeilen-Client von Bitwarden zeigen eine neue Qualität von Supply-Chain-Attacken. Die Angreifer verteilten trojanisierte Versionen über offizielle Kanäle wie npm, Docker-Hub und Github-Actions. Sie unterwanderten damit das Vertrauen, das Entwickler in etablierte Distributionswege setzen. Neben klassischen Zugangsdaten wie Github-Tokens, SSH-Schlüsseln und Cloud-Credentials gerieten auch Konfigurationen von KI-Entwicklungsassistenten […]…
-
Checkmarx Confirms GitHub Repository Data Posted on Dark Web After March 23 Attack
Checkmarx has disclosed that its ongoing investigation tied to the supply chain security incident has revealed that a cybercriminal group published data related to the company on the dark web.”Based on current evidence, we believe this data originated from Checkmarx’s GitHub repository, and that access to that repository was facilitated through the initial supply chain…
-
âš¡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are.Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds.…
-
âš¡ Weekly Recap: Fast16 Malware, XChat Launch, Federal Backdoor, AI Employee Tracking & More
Everything is dumb again. This week feels broken in a very familiar way. Old tricks are back. New tools are doing shady crap. Supply chains got hit. Fake help desks worked. Weird research showed how easy some attacks still are.Most of it feels like stuff we should have fixed years ago. Bad extensions. Stolen creds.…
-
Supply-Chain-Angriffe auf Entwickler-Tools: Checkmarx und Bitwarden im Fokus
Im Kern der Angriffe steht die Manipulation von Build- und Distributionsprozessen. Angreifer konnten Schadcode in legitime Entwickler-Tools einschleusen First seen on infopoint-security.de Jump to article: www.infopoint-security.de/supply-chain-angriffe-auf-entwickler-tools-checkmarx-und-bitwarden-im-fokus/a44790/
-
Cyberkriminelle zielen auf den Fertigungssektor ab
Ein Bericht von Check-Point-Exposure-Management zur Bedrohungslage in der Fertigungsindustrie zeigt eine drastische Zunahme von Ransomware, Angriffen auf die Lieferkette und OT-bezogenen Cybervorfällen. Mit der zunehmenden Verbreitung intelligenter Fabriken und vernetzter Lieferketten ändern Angreifer ihre Taktiken, um Störungen, finanziellen Druck und geopolitische Auswirkungen zu maximieren. Die Fertigungsindustrie ist mittlerweile weltweit die am stärksten von Ransomware betroffene…
-
AI is reshaping DevSecOps to bring security closer to the code
Tags: access, ai, api, application-security, attack, authentication, automation, breach, business, cloud, communications, compliance, container, control, data, data-breach, detection, exploit, governance, infrastructure, injection, least-privilege, risk, service, skills, software, sql, strategy, supply-chain, threat, tool, training, vulnerabilityExplicit security requirements elevate AI benefits: While deploying AI with DevSecOps is helping to shift the emphasis on security to earlier in the development lifecycle, this requires “explicit instruction to do it right,” says Noe Ramos, vice president of AI operations at business software provider Agiloft.”AI coding assistants accelerate development meaningfully, but they optimize for…
-
Critical Gemini CLI Flaw Raises Supply Chain Security Concerns
Google has rolled out urgent security updates for its Gemini CLI and the accompanying GitHub Action to address a critical vulnerability. Tracked as GHSA-wpqr-6v78-jr5g, this flaw exposes continuous integration and continuous deployment (CI/CD) pipelines to Remote Code Execution (RCE) attacks. Improper handling of workspace trust and tool allowlisting allows malicious actors to compromise automated workflows,…
-
Securing the Machine: Michigan’s Automotive CISOs
Few industries present a more complex cybersecurity challenge than automotive. The modern vehicle is a networked platform. The manufacturing floor is a convergence of IT and operational technology. The supply chain spans dozens of countries and thousands of vendors. And the competitive pressure to digitize, electrify, and connect everything runs directly against the security instinct…The…
-
New US House privacy bills raise hard questions about enterprise data collection
Tags: access, ai, awareness, banking, business, cio, ciso, compliance, credentials, data, finance, framework, governance, group, identity, insurance, Internet, jobs, law, privacy, regulation, risk, service, strategy, supply-chainWhere privacy law overlaps with AI governance: The SECURE Data Act does not contain broad, standalone AI governance rules, but it still touches AI in meaningful ways.The bill includes opt-outs for fully automated profiling used for decisions with legal or similarly significant effects. That language can clearly implicate some uses of AI, particularly in hiring,…
-
Flurry of Supply-Chain Software Library Attacks
Continuous Integration Has Its Downsides. As supply-chain attacks against widely-used, open-source software repositories continue, experts are urging developers to not only rely on code integrity tools, but also to introduce a delay before merging new repos, since unfolding attacks tend to get spotted in days, if not hours or minutes. First seen on govinfosecurity.com Jump…
-
Xinference PyPI Supply Chain Poisoning Warning
Overview Recently, NSFOCUS CERT detected that Xinference had suffered supply chain poisoning in its PyPI warehouse. The attacker stole the PyPI release permission credentials of Xinference maintainers and released three consecutive malicious versions implanted with Trojans on April 22, GMT+8. When triggered by the user, it will collect cloud credentials, SSH keys, API tokens, Sensitive……
-
Supply-Chain-Angriff auf Passwortmanager: NPM-Paket von Bitwarden kompromittiert
Angreifer haben erfolgreich Schadcode in das NPM-Paket des Bitwarden-CLI eingeschleust. Dahinter steckt eine größere Angriffskampagne. First seen on golem.de Jump to article: www.golem.de/news/supply-chain-angriff-auf-passwortmanager-npm-paket-von-bitwarden-kompromittiert-2604-207974.html
-
Checkmarx supply chain attack impacts Bitwarden npm distribution path
Bitwarden CLI was hit by the Checkmarx supply chain attack. Version 2026.4.0 shipped malicious code in bw1.js via a compromised GitHub Action. Bitwarden CLI has been compromised as part of the ongoing Checkmarx supply chain campaign, researchers warn. The affected version, @bitwarden/cli 2026.4.0, contained malicious code hidden in the bw1.js file. The breach likely stemmed…
-
Npm Supply Chain Malware Attack Targets Developers With Worm-Like Propagation
Malicious npm packages spread via worm-like propagation and steal developer credentials First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/npm-supply-chain-worm-canister/
-
Bitwarden CLI Compromised After Malicious GitHub Actions Workflow
Cybersecurity researchers at Socket have uncovered a major supply chain compromise affecting the Bitwarden CLI. Attackers successfully abused a GitHub Action in Bitwarden’s CI/CD pipeline to inject malicious code into the popular password manager’s npm package. This breach is part of the broader, ongoing Checkmarx supply chain campaign. Bitwarden CLI Compromised The compromised package, identified…
-
Cloudsmith Raises $72M for Software Supply-Chain Security
Recent Package Compromises Pushed Software Component Trust to the Security Agenda. Cloudsmith raised a $72 million Series C led by TCV to expand policy enforcement, auditability and real-time package risk analysis as CISOs focus more closely on software supply-chain threats tied to open-source dependencies, AI-assisted development and compromised artifacts. First seen on govinfosecurity.com Jump to…
-
Bitwarden CLI Compromise Linked to Ongoing Checkmarx Supply Chain Campaign
A compromise of the popular Bitwarden password manager is linked to the ongoing Checkmarx supply chain campaign, with bad actor injecting malicious code in a version of its CLI. However, while there are some overlaps in such areas a tools that suggest TeamPCP was behind the attack, there are differences in operation that make attribution…
-
Checkmarx Supply Chain Attack Exploits Docker Images and CI/CD Pipelines
A Checkmarx supply chain attack used malicious Docker images and extensions to steal credentials and spread through CI/CD pipelines. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/checkmarx-supply-chain-attack-exploits-docker-images-and-ci-cd-pipelines/