#supply-chain-attack
#supply-chain-attack

1 week ago

Information security

Malware Injected into 6 npm Packages After Maintainer Tokens Stolen in Phishing Attack

3 weeks ago

Privacy technologies

Malicious Pull Request Targets 6,000+ Developers via Vulnerable Ethcode VS Code Extension

Node JS

North Korea-linked Supply Chain Attack Targets Developers with 35 Malicious npm Packages

Growth hacking

New Supply Chain Malware Operation Hits npm and PyPI Ecosystems, Targeting Millions Globally

Cryptocurrency

2 months ago

Malicious Go Modules Deliver Disk-Wiping Linux Malware in Advanced Supply Chain Attack

Three malicious Go modules can destroy Linux systems by overwriting primary disks, indicating significant supply-chain attack risks.

Privacy technologies

THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More

The recent supply chain breach began as a targeted attack on Coinbase, highlighting vulnerabilities in open-source projects.

1 week ago

Information security

Malware Injected into 6 npm Packages After Maintainer Tokens Stolen in Phishing Attack

3 weeks ago

Privacy technologies

Malicious Pull Request Targets 6,000+ Developers via Vulnerable Ethcode VS Code Extension

Node JS

North Korea-linked Supply Chain Attack Targets Developers with 35 Malicious npm Packages

Growth hacking

New Supply Chain Malware Operation Hits npm and PyPI Ecosystems, Targeting Millions Globally

Cryptocurrency

2 months ago

Malicious Go Modules Deliver Disk-Wiping Linux Malware in Advanced Supply Chain Attack

Three malicious Go modules can destroy Linux systems by overwriting primary disks, indicating significant supply-chain attack risks.

Privacy technologies

THN Weekly Recap: GitHub Supply Chain Attack, AI Malware, BYOVD Tactics, and More

The recent supply chain breach began as a targeted attack on Coinbase, highlighting vulnerabilities in open-source projects.

DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer Endpoints

DragonForce ransomware exploited vulnerabilities in a Managed Service Provider's SimpleHelp tool for data exfiltration and ransomware deployment.

fromArs Technica

2 months ago

Hundreds of e-commerce sites hacked in supply-chain attack

The widespread supply chain attack targeted at least 500 e-commerce sites, compromising sensitive customer data by executing malicious code via visited browsers.

E-Commerce

Node JS

Ripple's xrpl.js npm Package Backdoored to Steal Private Keys in Major Supply Chain Attack

XRPL.js, a popular JavaScript library, was compromised in a supply chain attack aimed at harvesting users' private keys.

Software development

fromInfoQ

Google Go Module Mirror Served Backdoor for 3+ Years

Research uncovered a major supply chain attack in the Go ecosystem involving a backdoored package.

The attack exploited caching in the Go Module Proxy, emphasizing security vulnerabilities in module management.

#github-actions

fromInfoQ

DevOps

Compromised GitHub Action Highlights Risks in CI/CD Supply Chains

GitHub Supply Chain Breach: Coinbase Attack Exposes 218 Repositories, Leaks CI/CD Secrets

A supply chain attack involving GitHub Actions led to the leakage of secrets across multiple repositories, but the impact was less severe than initially feared.

fromInfoQ

DevOps

Compromised GitHub Action Highlights Risks in CI/CD Supply Chains

GitHub Supply Chain Breach: Coinbase Attack Exposes 218 Repositories, Leaks CI/CD Secrets

A supply chain attack involving GitHub Actions led to the leakage of secrets across multiple repositories, but the impact was less severe than initially feared.

Stolen SpotBugs tokens sparked the massive GitHub attack

The GitHub supply chain attack originated from a leaked token in SpotBugs, revealing vulnerabilities in CI workflows.

Growth hacking

SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack

fromTheregister

Stolen SpotBugs tokens sparked the massive GitHub attack

The GitHub supply chain attack originated from a leaked token in SpotBugs, revealing vulnerabilities in CI workflows.

Growth hacking

SpotBugs Access Token Theft Identified as Root Cause of GitHub Supply Chain Attack

GitHub supply chain attack spills secrets from 23K projects

A supply chain attack affected the tj-actions/changed-files GitHub Action, leading to potential leakage of sensitive information from projects.

fromArs Technica