Tag: supply-chain
-
LiteLLM Compromised in Supply Chain Attack Delivering Credential Stealer and Backdoor
The popular LiteLLM Python package has been compromised as part of a software supply chain attack that delivered a credential stealer and a backdoor, according to reports from SafeDep, Socket, StepSecurity, and Upwind.The compromise affects LiteLLM 1.107.0, distributed through PyPI wheels and Docker images. The Python package has since been quarantined on Python Package Index…
-
Rust 1.100 Will Let Developers Block Fresh Cargo Packages to Reduce Malware Supply Chain Risks
Rust 1.100, scheduled for November 12, 2026, will introduce stable support for Cargo dependency cooldowns, allowing developers to reject newly published package versions until they reach a configurable minimum age. The feature gives security researchers, maintainers, and registries time to identify malicious releases before automated updates spread them across development environments and CI pipelines access.…
-
DevGuard: Open-source vulnerability management for the software supply chain
DevGuard is a free, open source vulnerability management platform that collects a software project’s security findings in one place, ranks them by risk, and tracks them. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/21/devguard-open-source-vulnerability-management/
-
Pluto Security Raises $42M for Agentic Workspace Defense
Startup Uses Endpoint Telemetry to Understand Agent Intent and Enforce Policies. Pluto Security emerged from stealth with $42 million to protect enterprise agentic AI workflows, using endpoint telemetry and local models to identify agent intent, detect prompt injection and supply chain risks, and automatically enforce security controls across tools, applications and sandboxes. First seen on…
-
ConnectWise customers hit by supply-chain attack linked to compromised API secret
Hundreds of customers are confirmed impacted, as attackers use a sensitive credential to break into connected Microsoft 365 applications unimpeded. First seen on cyberscoop.com Jump to article: cyberscoop.com/connectwise-cloud-backup-supply-chain-attack/
-
AOMEI Backupper servers hijacked for minutes at a time to push backdoor
An unknown number of AOMEI Backupper users had their computers infected with a backdoor through an unusually stealthy supply chain attack, security researchers discovered. … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/10/20/aomei-backupper-compromised-supply-chain/
-
Hackers Compromise OVHcloud GitHub Repository to Distribute Secret-Stealing Malware
OVHcloud has reported a supply-chain attack involving its command-line interface (CLI) repository. An attacker exploited a developer’s GitHub account to distribute a malicious binary designed to steal sensitive information from users’ disks. CEO Octave Klaba confirmed the incident on October 19, 2026, after a customer reported it. The company identified the compromised release at 14:47…
-
Google Uncovers Hackers Hijacking Legitimate Software Updates to Deploy Hidden Backdoors
Tags: backdoor, cyber, endpoint, google, hacker, infrastructure, software, supply-chain, technology, threat, updateA software supply chain campaign that hijacked AOMEI Technology’s update infrastructure to distribute hidden backdoors. Tracked as UNC7017, the attackers briefly altered server configurations between April and July 2026, then restored legitimate content before conventional security checks could reliably capture the compromise. ManageEngine’s Threat Analysis Lab initially detected suspicious activity through endpoint telemetry on May…
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147
-
Hackers Turn Aomei Update Servers Into Malware Channels
Five- to 10-Minute Attack Windows Complicated Detection and Forensic Analysis. Google linked a stealthy AOMEI supply chain attack to UNC7017, which briefly hijacked Backupper and AnyViewer update configurations to deliver Crossroad and Shinyroad malware across more than 10 countries without exploiting software vulnerabilities or compromising build pipelines. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/hackers-turn-aomei-update-servers-into-malware-channels-a-33147
-
WordPress SEO plugin Rank Math compromised to backdoor websites
Some downloads of the Rank Math PRO WordPress plugin from the vendor’s official website carried malware that planted hidden backdoors in a supply-chain attack last week. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/wordpress-seo-plugin-rank-math-compromised-to-backdoor-websites/
-
DHS Bans DeepSeek From Federal Civilian Agencies
Supply-Chain Order Sweeps in Vendor Tools Running on DeepSeek Models. Federal civilian agencies must scrub DeepSeek and any vendor tools running on its models from their networks under a U.S. Department of Homeland Security supply-chain order signed months before it surfaced Monday. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/dhs-bans-deepseek-from-federal-civilian-agencies-a-33146
-
GhostAction Attackers Plant Credential Stealer Disguised as Font in 94 GitHub Repositories
The threat actor behind the GhostAction supply chain attack has expanded beyond injecting malicious GitHub Actions workflows into compromised projects to phish open-source developers and deliver a stealer malware disguised within a fake font file.The latest evolution, detailed by OpenSourceMalware, signals that the attackers are actively refining their modus operandi in response to steps First…
-
Hackers breach Microsoft 365 tenants via ConnectWise supply-chain attack
ConnectWise has shut down customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after hackers accessed application identities and compromised Microsoft 365 tenants. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/hackers-breach-microsoft-365-tenants-via-connectwise-supply-chain-attack/
-
MALFEX npm Package ‘imgdecode’ Hides Shellcode Loader in Windows Native Addon
Cybersecurity researchers have discovered a malicious npm package that’s part of a recently disclosed software supply chain attack campaign dubbed MALFEX.The package, named “imgdecode,” was uploaded to the package registry on September 30, 2026, by a user named “malfexteste8.” It has been downloaded 979 times as of writing and is still available on npm as…
-
Ledger asks sellers across Asia to halt sales after supply-chain attack
Ledger has asked resellers and distributors of its wallets in Indonesia, Singapore, Thailand, the Philippines, Vietnam, Malaysia, and Hong Kong to suspend device sales and remove products from shelves while it investigates device tampering. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/ledger-asks-sellers-across-asia-to-halt-sales-after-supply-chain-attack/
-
Karaoke Giant Reveals Data Breach Impacting Eight Million
Daiichi Kosho says a supply chain breach has exposed personal data on over eight million karaoke customers First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/karaoke-giant-data-breach-eight/
-
12 Best Software Supply Chain Security Tools Compared (2026): Features Pricing
Chainguard leads the eliminate-the-problem lane with hardened zero-CVE images, Sonatype the block-at-ingestion lane, and Scribe/Lineaje the provenance-attestation frontier. Selecting the best container registry security tools helps organizations establish baseline protection across four distinct attack surfaces dependencies, pipelines, artifacts, and base images because software supply chain security is a comprehensive strategy wearing a category name. Quick…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
Hackers Hijack Tensorlake Package to Spread Shai-Hulud Supply Chain Malware
Tags: breach, credentials, crypto, cyber, hacker, malicious, malware, software, supply-chain, threatA threat actor published a malicious version of the tensorlake npm package on October 8, 2026, embedding a new variant of the self-replicating Shai-Hulud supply-chain worm. The compromised release, tensorlake version 0.5.144, can steal developer secrets, target browser-stored cryptocurrency credentials, and use stolen publishing credentials to spread through connected software supply chains. The incident highlights…
-
12 Best SCA Tools Compared (2026): Features Pricing
Snyk is the best developer-platform SCA, Sonatype the repository-firewall powerhouse, and Socket the malicious-package specialist the CVE-scanners aren’t. Twelve options priced across free-floor, developer, registry, compliance, and supply-chain-posture lanes because dependency risk now spans three threats (known CVEs, malicious packages, license exposure) and no single lane covers all three. Quick Verdict: Best SCA at a…
-
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
The npm package known as “tensorlake,” a TypeScript software development kit (SDK) for Tensorlake applications, sandboxes, and cloud services, was compromised as part of a ChainDrop / Shai-Hulud supply chain attack.The malicious version 0.5.144 “contains obfuscated malware that harvests credentials, exfiltrates secrets, establishes persistence, and executes remotely supplied code,” Socket said First seen on thehackernews.com…
-
Malicious npm Packages Steal Browser Passwords, Discord Tokens and Crypto Wallets.
MALFEX, a persistent npm supply-chain campaign distributing Windows malware through eight malicious packages. Linked to an apparent single operator active since August 2023, the campaign delivers Overlord RAT, the movinlike information stealer, and a separate downloader concealed inside an ASCII-art utility. The largest contributor, function-flag, accounted for 37,419 downloads and has contained malicious code since…
-
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since…
-
Eight Malicious npm Packages Downloaded 40,767 Times Deliver Overlord RAT and Stealer
Cybersecurity researchers have disclosed details of a long-running npm supply chain malware campaign that pushes information stealers and remote access trojans (RAT) to compromised hosts.The campaign has been codenamed MALFEX by CloudSEK and Checkmarx. The activity is assessed to be the work of a lone threat actor who appears to have published 12 packages since…
-
Danish CPR Breach Highlights Challenge of Supply Chain Risk
A breach of 8.8 million citizens on the Danish Central Register of Persons (CPR) occurred via third-party access First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/danish-cpr-breach-supply-chain-risk/
-
IBM’s AI-powered vulnerability clearinghouse finds hundreds of Java flaws
The tech giant’s announcement underscores the insufficiency of companies’ existing software supply-chain security practices. First seen on cybersecuritydive.com Jump to article: www.cybersecuritydive.com/news/ibm-ai-vulnerability-java-lightwell/832249/
-
Google Pauses OSS Product Bug Bounty Rewards After Surge in Invalid Automated Reports
Google has stopped accepting product vulnerability reports through its bug bounty program for its open-source software.The change, in effect since October 1, means researchers can no longer submit security flaws in the code of projects such as Go, Angular, and Protocol Buffers there for a reward. Reports about supply chain compromises are still accepted, and…