Tag: supply-chain
-
Malicious npm Package Targets Atomic Wallet, Exodus Users by Swapping Crypto Addresses
Threat actors are continuing to upload malicious packages to the npm registry so as to tamper with already-installed local versions of legitimate libraries to execute malicious code in what’s seen as a sneakier attempt to stage a software supply chain attack.The newly discovered package, named pdf-to-office, masquerades as a utility for converting PDF files to…
-
Ponemon-Studie zu Risiken in der Lieferkette – Warum Fremdzugriffe zum Sicherheitsrisiko werden
First seen on security-insider.de Jump to article: www.security-insider.de/cyberattacken-security-risks-lieferketten-a-c85054da1a033d2715866a6fc666402b/
-
CodeSecure and FOSSA Partner to Deliver Single Integrated Platform for Binary and Open Source Analysis
Consolidated capabilities enable customers to create comprehensive software bill of materials and eliminate security blindspots across the software development lifecycle BETHESDA, Md., Apr. 9, 2025 CodeSecure, a leading global provider of application security testing (AST) solutions, and FOSSA, the complete software supply chain platform, today announced a strategic partnership and native product integration that”¦ First…
-
2025 SC Awards Finalists: Best Supply Chain Security Solution
Tags: supply-chainFirst seen on scworld.com Jump to article: www.scworld.com/news/2025-sc-awards-finalists-best-supply-chain-security-solution
-
Survey: Widespread software supply chain risks persist amid tool overload, limited visibility
First seen on scworld.com Jump to article: www.scworld.com/brief/survey-widespread-software-supply-chain-risks-persist-amid-tool-overload-limited-visibility
-
Beyond Bits and Bytes: How Quantum AI Could Solve Humanity’s Biggest Problems
1. The Dead Weight of Classical Thinking Classical computers were never built to understand the world”, they were built to count. And they’ve done it well. Transistors, logic gates, memory”, all sharp-edged tools in a tidy box. But humanity’s problems aren’t tidy. Climate chaos, drug discovery, supply chains knotted like pub brawls”, all a bit…
-
Lazarus Expands NPM Campaign With Trojan Loaders
North Korea’s Lazarus Deploys Malicious NPM Packages to Steal Data. North Korea’s Lazarus Group expanded a malicious campaign of uploading malicious code to the JavaScript runtime environment npm repository, publishing 11 packages embedded with Trojan loaders. Researchers identified 11 malicious packages in the repository, a hotspot for supply chain attacks. First seen on govinfosecurity.com Jump…
-
Tariff Wars: The Technology Impact
How CIOs and CISOs Can Navigate With Balance Tariff wars may hit technology leaders hard in 2025 as the Trump administration’s 10% import tax, plus reciprocal tariffs, spikes costs. CIOs and CISOs face supply chain disruption and heightened cyber risks. But they can adapt with cloud shifts, smart deals and better advocacy. First seen on…
-
That massive GitHub supply chain attack? It all started with a stolen SpotBugs token
But this mystery isn’t over yet, Unit 42 opines First seen on theregister.com Jump to article: www.theregister.com/2025/04/07/github_supply_chain_attack/
-
PoisonSeed targets Mailchimp, Mailgun, and Zoho to phish high-value accounts
Activities align with CryptoChameleon: While many threat researchers have linked PoisonSeed actors to Scattered Spider, Silent Push believes the alignment is more accurate with the CryptoChameleon advanced phishing kit from 2024.The mailchimp-sso[.]com domain, which is the basis of the association made with Scattered Spider, was registered on Porkbun from the previous attack up until March…
-
How Trump’s tariffs are shaking up the cybersecurity sector
Tags: antivirus, ceo, china, cisa, country, cyber, cyberattack, cybersecurity, defense, finance, government, Hardware, infrastructure, microsoft, network, service, supply-chain, technology, threat, vulnerabilityCustomer cutbacks and increased costs are major concerns: In addition to the macroeconomic fears and worries over retaliatory measures, US cybersecurity companies are vulnerable to losing revenue under the new tariffs as customers reduce their cybersecurity budgets to cope with their own tariff-induced financial pressures.”What’s happening is that people are looking at cybersecurity through the…
-
Malicious Python Packages Target Popular Cryptocurrency Library to Steal Sensitive Data
In a recent development, the ReversingLabs research team has uncovered a sophisticated software supply chain attack targeting developers of cryptocurrency applications. The attack involved the creation of two malicious Python packages, bitcoinlibdbfix and bitcoinlib-dev, which were uploaded to the Python Package Index (PyPI) with the intent to exfiltrate sensitive database files. Fake Fix for Bitcoinlib…
-
Exposed SpotBugs token caused GitHub supply chain intrusion, report finds
First seen on scworld.com Jump to article: www.scworld.com/brief/exposed-spotbugs-token-caused-github-supply-chain-intrusion-report-finds
-
PoisonSeed Targets CRM and Bulk Email Providers in New Supply Chain Phishing Attack
A sophisticated phishing campaign, dubbed >>PoisonSeed,
-
Malicious PyPI Package Targets E-commerce Sites with Automated Carding Script
Cybersecurity researchers from Socket have exposed a malicious Python package on PyPI, named disgrasya, designed to automate credit card fraud on WooCommerce-based e-commerce sites. Unlike conventional supply chain attacks that rely on deception or typosquatting, disgrasya was overtly malicious, leveraging PyPI as a distribution platform to reach a broad audience of fraudsters. The package specifically…
-
SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack
The cascading supply chain attack that initially targeted Coinbase before becoming more widespread to single out users of the “tj-actions/changed-files” GitHub Action has been traced further back to the theft of a personal access token (PAT) related to SpotBugs.”The attackers obtained initial access by taking advantage of the GitHub Actions workflow of SpotBugs, a popular…
-
Tj-actions Supply Chain Attack Traced Back to Single GitHub Token Compromise
The threat actors initially attempted to compromise projects associated with the Coinbase cryptocurrency exchange, said Palo Alto Networks First seen on infosecurity-magazine.com Jump to article: www.infosecurity-magazine.com/news/tj-actions-supply-chain-attack/
-
Compromised SpotBugs Token Led to GitHub Actions Supply Chain Hack
Evidence shows a SpotBugs token compromised in December 2024 was used in the March 2025 GitHub Actions supply chain attack. The post Compromised SpotBugs Token Led to GitHub Actions Supply Chain Hack appeared first on SecurityWeek. First seen on securityweek.com Jump to article: www.securityweek.com/compromised-spotbugs-token-led-to-github-actions-supply-chain-hack/
-
Oracle quietly admits data breach, days after lawsuit accused it of cover-up
Tags: access, attack, authentication, breach, cloud, compliance, credentials, crime, cve, cybersecurity, data, data-breach, endpoint, exploit, finance, fraud, hacker, identity, infrastructure, intelligence, law, oracle, resilience, risk, service, strategy, supply-chain, technology, theft, threat, vulnerabilityLawsuit challenges Oracle’s response: The reports of Oracle’s acknowledgement of the breach come just days after the company was hit with a class action lawsuit over its handling of the security breach.The lawsuit specifically addresses a major security breach discovered in March that reportedly compromised 6 million records containing sensitive authentication-related data from Oracle Cloud…
-
Recent GitHub supply chain attack traced to leaked SpotBugs token
A cascading supply chain attack on GitHub that targeted Coinbase in March has now been traced back to a single token stolen from a SpotBugs workflow, which allowed a threat actor to compromise multiple GitHub projects. First seen on bleepingcomputer.com Jump to article: www.bleepingcomputer.com/news/security/recent-github-supply-chain-attack-traced-to-leaked-spotbugs-token/
-
Cyber threats against software supply chain fueled by AI
First seen on scworld.com Jump to article: www.scworld.com/brief/cyber-threats-against-software-supply-chain-fueled-by-ai
-
Microsoft’s AI tool catches critical GRUB2, U-boot bootloader flaws
Tags: access, ai, control, cybersecurity, exploit, firmware, flaw, Hardware, microsoft, mitigation, monitoring, risk, soc, supply-chain, tool, update, vulnerability, vulnerability-management, zero-dayAI-powered discovery changes the cybersecurity landscape: Microsoft’s Security Copilot tool significantly accelerated the vulnerability identification process, with a particular focus on filesystem implementations due to their high vulnerability potential.”Using Security Copilot, we were able to identify potential security issues in bootloader functionalities, focusing on filesystems due to their high vulnerability potential,” the blog stated. “This…
-
Oracle Health warnt vor Datenleck
Tags: access, ceo, cloud, computer, cyberattack, cybersecurity, cyersecurity, data-breach, hacker, Internet, login, oracle, password, supply-chain, usaHacker haben sich Zugriff auf Daten von Oracle Health verschafft.Während Oracle den Datenverstoß, der in der vergangenen Woche ans Licht kam, öffentlich abstreitet, informierte die Tochtergesellschaft Oracle Health kürzlich betroffene Kunden über ein Datenleck. Betroffen waren Daten von alten Datenmigrations-Server von Cerner, wie aus einem Bericht von Bleeping Computer hervorgeht. Oracle hatte den IT-Dienstleister für…
-
UK Government Previews Cybersecurity Legislation
Government Says Managed Service Providers Need More Regulation. The British government pledged to introduce stricter rules surrounding incident reporting and supply chain vulnerability patching through legislation it previewed in July 2024. The proposed Cyber Security and Resilience Bill will bring under its scope managed service providers. First seen on govinfosecurity.com Jump to article: www.govinfosecurity.com/uk-government-previews-cybersecurity-legislation-a-27897
-
Altgeräte bedrohen Sicherheit in Unternehmen
Tags: access, apache, authentication, botnet, bug, cisco, cloud, cve, cyberattack, dns, endpoint, firewall, Hardware, intelligence, Internet, ivanti, lazarus, linux, macOS, network, open-source, password, radius, ransomware, risk, router, sans, service, software, supply-chain, threat, update, vulnerabilitySchwachstellen in alten Netzwerkgeräten stellen ein erhebliches Sicherheitsrisiko für Unternehmen dar.Eine Analyse von Ciscos Threat-Intelligence-Team Talos zeigt, zwei der drei häufigsten Schwachstellen, auf die es Angreifer im Jahr 2024 abgesehen hatten, waren in alten Netzwerkgeräten zu finden. Das Problem ist, dass Hersteller dazu keine Patches mehr herausgeben.’Dies unterstreicht, wie wichtig es ist, veraltete Komponenten des…