Tag: supply-chain
-
Malicious npm Package Steals GitHub, Cloud, and CI/CD Secrets and Spreads to Other Packages
A supply-chain compromise affecting the popular npm package @7nohe/openapi-react-query-codegen is exposing developer workstations and CI/CD runners to a credential-stealing, self-propagating payload. On August 28, 2026, attackers published ten malicious versions across every maintained release branch of the OpenAPI-to-TanStack Query code generator, which records roughly 150,000 weekly downloads. The releases appeared in two publishing waves approximately…
-
NIS2 compliance: Fixing IAM and access control before the 2026 audit
The NIS2 Directive places direct obligations on organizations across supply chain risk management, incident reporting, and board-level accountability. October brings a new … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/09/01/nis2-credential-compliance-before-audit/
-
BSidesCharm 2026 Hidden Exposure Crisis How Supply Chain Leakage Is Becoming The Norm
Tags: supply-chainPresenter: Charles Adams IV & Teddy Katayama Our thanks to BSidesCharm for publishing their Creators, Authors and Presenter’s outstanding BSidesCharm 2026 content on the Organizations’ YouTube Channel. Permalink First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/bsidescharm-2026-hidden-exposure-crisis-how-supply-chain-leakage-is-becoming-the-norm/
-
ATM Flaws Reveal Key Weaknesses in the Software Supply Chain
A security researcher discovered nine vulnerabilities impacting ATM encryption and authentication software. But the problems extend far beyond your local cash machine. First seen on wired.com Jump to article: www.wired.com/story/atm-flaws-reveal-key-weaknesses-in-the-software-supply-chain/
-
Shai-Hulud Trinitite Worm Infects Popular TanStack Query npm Package to Steal Developer Secrets
A new Shai-Hulud supply-chain attack dubbed Trinitite has compromised the npm package @7nohe/openapi-react-query-codegen, a TanStack Query code-generation library with more than 150,000 weekly downloads. The malicious releases deploy an evolved Mini Shai-Hulud worm designed to steal developer, cloud, CI/CD, package-registry, Kubernetes, Vault, and source-control credentials before using recovered access to spread through additional packages. While…
-
Arrests Hinder TeamPCP, But the Threat is Still Out There, Researchers Say
Two members of TeamPCPwere arrested, hampering the operations of the notorious threat group behind a series of high-profile supply-chain attacks. However, while researchers applauded the law enforcement action, they warned that the danger is still out there. First seen on securityboulevard.com Jump to article: securityboulevard.com/2026/08/arrests-hinder-teampcp-but-the-threat-is-still-out-there-researchers-say/
-
Judge Orders Pentagon to Reverse Anthropic Blacklisting
Court Says DOD’s Designation Was Illegal First Amendment Retaliation. The U.S. federal judge told the Department of Defense to cancel the supply chain designation it levied against Anthropic in a decision giving the artificial intelligence giant almost everything it asked for in a lawsuit against the Pentagon. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/judge-orders-pentagon-to-reverse-anthropic-blacklisting-a-32684
-
Authorities arrest 2 alleged members of prolific hacking group TeamPCP
The group infected more than 1,000 organizations in a relentless supply-chain attack campaign. First seen on arstechnica.com Jump to article: arstechnica.com/security/2026/08/authorities-arrest-2-alleged-members-of-prolific-hacking-group-teampcp/
-
Shai-Hulud hackers: two men charged over TeamPCP’s global supply chain crime spree that hit OpenAI, and thousands more
More than 1,000 organisations, 500,000 stolen credentials, and one self-propagating worm named after a Dune sandworm – two men now face charges over TeamPCP’s global hacking spree. First seen on bitdefender.com Jump to article: www.bitdefender.com/en-us/blog/hotforsecurity/shai-hulud-hackers-charged-teampcps
-
TeamPCP: Zwei junge Männer nach folgenschweren Supply-Chain-Attacken verhaftet
Zwei mutmaßliche Mitglieder der Hackergruppe TeamPCP sind verhaftet worden. Sie sollen für Schadcode-Attacken auf zahlreiche Softwareprojekte verantwortlich sein. First seen on golem.de Jump to article: www.golem.de/news/teampcp-festnahmen-und-razzien-nach-supply-chain-attacken-2608-212384.html
-
TeamPCP: Festnahmen und Razzien nach Supply-Chain-Attacken
Zwei mutmaßliche Mitglieder der Hackergruppe TeamPCP sind verhaftet worden. Sie sollen für folgenschwere Angriffe auf Softwareprojekte verantwortlich sein. First seen on golem.de Jump to article: www.golem.de/news/teampcp-festnahmen-und-razzien-nach-supply-chain-attacken-2608-212384.html
-
Two Australian Men Charged in TeamPCP Supply Chain Attacks
Alleged Global Supply Chain Campaign Compromised More Than 1,000 Organizations. Australian authorities charged two men accused of leading TeamPCP, a cybercrime group linked to supply chain attacks that potentially compromised more than 1,000 organizations, exposed 500,000 credentials and drove global cleanup costs into the hundreds of millions. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/two-australian-men-charged-in-teampcp-supply-chain-attacks-a-32675
-
Two Arrested in Australia Over TeamPCP Supply Chain Attacks
Two Australian men were arrested over alleged TeamPCP supply chain attacks that stole more than 500,000 credentials. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/two-arrested-in-australia-over-teampcp-supply-chain-attacks/
-
Two alleged TeamPCP members arrested and charged after months of software supply-chain chaos
The two men face 14 charges combined. Private researchers traced one suspect through leaked passwords and a decade-old gaming profile. First seen on cyberscoop.com Jump to article: cyberscoop.com/teampcp-cybercrime-arrests-supply-chain-attacks/
-
Two alleged TeamPCP hackers arrested over global supply chain attacks
Two men from Western Australia have been charged after police allege they were part of TeamPCP, a cybercrime group that planted malicious code in open-source software, then … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/27/alleged-teampcp-hackers-arrested-australia/
-
Two Alleged ‘TeamPCP’ Hackers Arrested in Australia
Tags: attack, cybercrime, data, extortion, group, hacker, identity, malicious, open-source, software, supply-chainAuthorities in Australia have arrested two men believed to be members of TeamPCP, a prolific cybercrime and data extortion group blamed for perpetrating the longest running spree of software supply chain attacks ever. In a statement released today, the Australian Federal Police (AFP) said two unnamed suspects from Western Australia, aged 21 and 23, were…
-
Australia charges two men for TeamPCP supply-chain hacking spree
Two men in Australia were charged Wednesday over their alleged membership in TeamPCP, the cybercrime group blamed for one of the most damaging hacking campaigns of the past year. First seen on therecord.media Jump to article: therecord.media/australia-teampcp-hackers-arrested
-
Australia arrests alleged TeamPCP hackers behind supply-chain attacks
Australian authorities have arrested and charged two young men accused of belonging to TeamPCP, a hacking group linked to a string of far-reaching developer supply chain attacks. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/australia-arrests-alleged-teampcp-hackers-behind-supply-chain-attacks/
-
Alleged TeamPCP Hackers Charged in Australia Over Major Supply Chain Attacks
The Australian Federal Police (AFP) has charged two Western Australian men with a combined total of 14 offences over their alleged role in TeamPCP, the cybercrime group behind the March 2026 compromise of the open-source security scanners Trivy and Checkmarx KICS and the AI gateway LiteLLM.Louis Michael Gaebler, 23, and Ruben Ian Thomson, 21, appeared…
-
Stop Building a 2003 SOC with AI: Local Context, Failure Modes and Your Path (Part 3)
In Part 1 of this series, we dumped a pile of uncomfortable questions on you and promised answers. In Part 2 of the series, we talked about why 1990s-2000s alert triage must die. The core thesis, if you recall: if you add AI agents into a legacy, swivel-chair SOC structure, you are essentially building a robotic…
-
The Toolchain Is the Target: Securing Software Development in the Agentic Era
JFrog finds AI development tools are expanding the software supply chain and creating new attack paths for organizations. First seen on esecurityplanet.com Jump to article: www.esecurityplanet.com/threats/the-toolchain-is-the-target-securing-software-development-in-the-agentic-era/
-
Ab dem 11. September steht Europas Software-Lieferkette unter einer 24-Stunden Meldefrist
Ab dem 11. September 2026 gilt die Anwendung von Artikel 14 des Cyber-Resilience-Act (CRA). Dann müssen Software-Hersteller aktiv schwerwiegende Sicherheitsvorfälle und ausgenutzte Schwachstellen über die Single-Reporting-Platform der <> melden. Diese Plattform ist zwar noch nicht geöffnet. Dennoch können fast alle Entscheidungen, die für eine reibungslose Erstellung des ersten Berichts gemäß den von ENISA im Juli…
-
Is Cyber Facing an Affordability Crisis?
As breach costs reach record highs and defense spending nears $240 billion, small businesses are dangerously exposed, threatening supply chain security. First seen on darkreading.com Jump to article: www.darkreading.com/cybersecurity-operations/is-cyber-facing-an-affordability-crisis-
-
91 Spring CVEs Impact Over 209,000 Software Components Across the Supply Chain
Broadcom has disclosed 91 Common Vulnerabilities and Exposures (CVEs) affecting the Spring Framework and related projects, triggering a software supply chain remediation event that Sonatype estimates impacts 209,569 software components. The advisory issued on August 20 highlights the widening gap between AI-accelerated vulnerability discovery and organizations’ ability to identify, fix, rebuild, and deploy affected software.…
-
91 Spring CVEs Impact Over 209,000 Software Components Across the Supply Chain
Broadcom has disclosed 91 Common Vulnerabilities and Exposures (CVEs) affecting the Spring Framework and related projects, triggering a software supply chain remediation event that Sonatype estimates impacts 209,569 software components. The advisory issued on August 20 highlights the widening gap between AI-accelerated vulnerability discovery and organizations’ ability to identify, fix, rebuild, and deploy affected software.…
-
AI supply chain risk is showing up in developer workflows first
In this Help Net Security interview, Dr. Jaushin Lee, CEO of Zentera Systems, discusses where AI supply chain risk shows up. He says most incidents still hit developer … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/25/jaushin-lee-ai-zentera-systems-supply-chain-risk/
-
The cybercrime supply chain has five stages, each with a price
In this Help Net Security video, Chris Nyhuis, CEO at Vigilant, explains why the picture of a lone ransomware attacker is about 15 years out of date. He walks through the … First seen on helpnetsecurity.com Jump to article: www.helpnetsecurity.com/2026/08/25/cybercrime-supply-chain-video/
-
Open VSX Unblocks 3 IDs Used in 77-Extension Evil-Twin Malware Campaign
Open VSX has removed three extension identifiers from its malicious-extension list after the legitimate projects they impersonated began reclaiming their names. The move restores publishing access for the affected maintainers but highlights a supply-chain tracking gap: a single extension ID can represent both a removed malicious artifact and a later legitimate release. Between August 16…
-
RedC2 Turns Compromised Linux Machines Into SOCKS5 Proxies for Internal Network Pivoting
A cluster of trojanized npm packages is delivering the RedC2 4.0 Linux implant, providing operators with a pathway from a seemingly harmless dependency import to internal network pivoting via SOCKS5 proxies and TCP forwarding. The campaign disguises malicious code inside functional calendar and streak-calculation utilities, underscoring how supply-chain abuse can bypass controls focused only on…