supply chain attacks

Claude Code extension poisoned with persistent SSH backdoor

AI, Anthropic, backdoor, Claude Code, cybercrime, macOS, News, supply chain attacks /

Claude Code extension poisoned with persistent SSH backdoor 2026-10-30 at 13:15 By Sinisa Markovic A tampered build of Anthropic’s Claude Code extension for VS Code-compatible editors planted an SSH backdoor on developers’ machines, researchers at macOS security firm Phorion have found. The company spotted the malicious package, version 2.1.313, on Open VSX, an open-source marketplace […]

Claude Code extension poisoned with persistent SSH backdoor Read More »

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials

Aikido Security, CloudSEK, Don't miss, Hot stuff, Hudson Rock, Malware, News, open source, Socket, supply chain attacks, supply chain compromise, Wiz /

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials 2026-10-22 at 16:10 By Sinisa Markovic A malicious release of LiteLLM pushed to PyPI and Docker registries on Wednesday carried malware built to harvest cloud logins, developer secrets and API keys for AI services from anyone who installed it. “LiteLLM got […]

LiteLLM hit by second supply chain attack this year, users urged to rotate credentials Read More »

OpenAI’s GPT-6 Astra ran supply chain attacks despite being told not to

agentic AI, AI, Anthropic, monitoring, News, OpenAI, security testing, supply chain attacks /

OpenAI’s GPT-6 Astra ran supply chain attacks despite being told not to 2026-09-29 at 14:41 By Sinisa Markovic OpenAI’s GPT-6 Astra carried out supply chain attacks on software outside the scope of a security test, according to the UK AI Security Institute (AISI). Anatomy of an unsanctioned simulated supply-chain attack (Source: AISI) AISI tested the […]

OpenAI’s GPT-6 Astra ran supply chain attacks despite being told not to Read More »

Two alleged TeamPCP hackers arrested over global supply chain attacks

Aikido Security, Australia, cybercrime, FBI, law enforcement, News, supply chain attacks /

Two alleged TeamPCP hackers arrested over global supply chain attacks 2026-08-27 at 16:59 By Sinisa Markovic Two men from Western Australia have been charged after police allege they were part of TeamPCP, a cybercrime group that planted malicious code in open-source software, then used it to break into organizations around the world. The Australian Federal […]

Two alleged TeamPCP hackers arrested over global supply chain attacks Read More »

AI supply chain risk is showing up in developer workflows first

agentic AI, AI, CXO, DevSecOps, Don't miss, Features, Hot stuff, News, strategy, supply chain attacks, tips, Zentera Systems, zero trust /

AI supply chain risk is showing up in developer workflows first 2026-08-25 at 09:00 By Mirko Zorz In this Help Net Security interview, Dr. Jaushin Lee, CEO of Zentera Systems, discusses where AI supply chain risk shows up. He says most incidents still hit developer workflows and open-source package repositories, while poisoned model weights and […]

AI supply chain risk is showing up in developer workflows first Read More »

The cybercrime supply chain has five stages, each with a price

CXO, cybercrime, cybersecurity, Don't miss, News, Ransomware, strategy, supply chain attacks, tips, Video /

The cybercrime supply chain has five stages, each with a price 2026-08-25 at 08:00 By Help Net Security In this Help Net Security video, Chris Nyhuis, CEO at Vigilant, explains why the picture of a lone ransomware attacker is about 15 years out of date. He walks through the cybercrime supply chain and the five […]

The cybercrime supply chain has five stages, each with a price Read More »

Turning software supply chain security into a daily habit

cybersecurity, News, strategy, supply chain attacks, Threat Intelligence, tips, Video /

Turning software supply chain security into a daily habit 2026-07-10 at 08:30 By Help Net Security In this Help Net Security video, Anastasia Tikhonova, Global Threat Research Lead at Group-IB, explains how to operationalize software supply chain risk. Instead of filing an SBOM away as a compliance document, she argues teams should use it every […]

Turning software supply chain security into a daily habit Read More »

GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise

Don't miss, GitHub, Grafana, Hot stuff, News, open source, supply chain attacks, supply chain compromise /

GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise 2026-05-21 at 16:56 By Zeljka Zorz GitHub CISO Alexis Wales has named the malicious VS Code extension behind the breach they suffered at the hands of the threat group TeamPCP: Nx Console, a popular developer tool with 2.2 million installs. A malicious version of […]

GitHub, Grafana Labs breaches traced back to TanStack supply chain compromise Read More »

North Korean hackers trojanize gaming platform to spy on ethnic Koreans in China

attack, cybercrime, ESET, Malware, News, North Korea, online gaming, supply chain attacks, threats /

North Korean hackers trojanize gaming platform to spy on ethnic Koreans in China 2026-05-05 at 13:21 By Sinisa Markovic A gaming platform built for ethnic Koreans in China has been serving backdoored Windows and Android software to its users since late 2024. The platform, sqgame[.]net, hosts traditional card and board games for a community that […]

North Korean hackers trojanize gaming platform to spy on ethnic Koreans in China Read More »

North Korean hackers linked to Axios npm supply chain compromise

Arctic Wolf Networks, backdoor, cybercrime, Don't miss, Google Cloud, Hot stuff, Mandiant, News, North Korea, supply chain attacks, supply chain compromise /

North Korean hackers linked to Axios npm supply chain compromise 2026-04-01 at 18:56 By Zeljka Zorz The software supply chain attack that resulted in the compromise of npm packages of Axios, an extremely popular HTTP client library, is believed to be the work of financially-motivated North Korean attackers. Links to UNC1069 On March 31, 2026, […]

North Korean hackers linked to Axios npm supply chain compromise Read More »

Axios npm packages backdoored in supply chain attack

Don't miss, Hot stuff, JavaScript, News, Step Security, supply chain attacks, supply chain compromise, Wiz /

Axios npm packages backdoored in supply chain attack 2026-03-31 at 15:43 By Zeljka Zorz An unknown attacker has compromised the GitHub and npm accounts of the main developer of Axios, a widely used HTTP client library, and published npm packages backdoored with a malicious dependency that triggered the installation of droppers and remote access trojans. […]

Axios npm packages backdoored in supply chain attack Read More »

TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware

Aikido Security, Don't miss, Endor Labs, Hot stuff, Linux, macOS, Malware, News, open source, PyPI, SafeDep, supply chain attacks, supply chain compromise, Windows /

TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware 2026-03-27 at 15:46 By Zeljka Zorz TeamPCP continues is supply chain compromise rampage, with telnyx on PyPI being the latest maliciously modified package. What happened? Telnyx is a widely used software development kit (SDK) for the Telnyx AI Voice Agent service. According to Endor Labs researchers, […]

TeamPCP strikes again: Backdoored Telnyx PyPI package delivers malware Read More »

LiteLLM PyPI packages compromised in expanding TeamPCP supply chain attacks

Aikido Security, Aqua Security, Checkmarx, Don't miss, Hot stuff, Malware, News, open source, PyPI, Sonatype, supply chain attacks, supply chain compromise, Wiz /

LiteLLM PyPI packages compromised in expanding TeamPCP supply chain attacks 2026-03-25 at 14:01 By Zeljka Zorz A slew of supply chain attacks against popular open source tools and packages appears to have been orchestrated by TeamPCP, a cybercriminal group that rose to prominence in late 2025. The latest victim of the group is BerryAI’s popular […]

LiteLLM PyPI packages compromised in expanding TeamPCP supply chain attacks Read More »

Open-source attacks move through normal development workflows

attacks, Don't miss, News, open source, report, ReversingLabs, supply chain, supply chain attacks, vulnerability management /

Open-source attacks move through normal development workflows 2026-02-03 at 08:18 By Anamarija Pogorelec Software development relies on a steady flow of third-party code, automated updates, and fast release cycles. That environment has made the software supply chain a routine point of entry for attackers, with malicious activity blending into normal build and deployment processes. A […]

Open-source attacks move through normal development workflows Read More »

UK announces grand plan to secure online public services

Don't miss, Government, Hot stuff, News, Orange Cyberdefense, Proofpoint, public sector, supply chain attacks, UK /

UK announces grand plan to secure online public services 2026-01-07 at 15:32 By Zeljka Zorz The UK has announced a new Government Cyber Action Plan aimed at making online public services more secure and resilient, and has allocated £210 million (approximately $283 million) to implement it. Setting up a Government Cyber Unit “Cyber attacks can […]

UK announces grand plan to secure online public services Read More »

Shadow AI is breaking corporate security from within

Artificial Intelligence, Compliance, cybersecurity, IO, News, report, supply chain attacks, third party compromise /

Shadow AI is breaking corporate security from within 2025-09-18 at 08:26 By Anamarija Pogorelec Cybersecurity leaders know the attack surface has been growing for years, but the latest State of Information Security Report 2025 from IO shows how fast new risks are converging. Drawing on responses from more than 3,000 security professionals in the UK […]

Shadow AI is breaking corporate security from within Read More »

Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack

Aikido Security, Don't miss, Hot stuff, JavaScript, News, Node.js, open source, ReversingLabs, StepSecurity, supply chain attacks, Wiz, worms /

Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack 2025-09-17 at 01:18 By Zeljka Zorz A potentially monumental supply chain attack is underway, thanks to a self-replicating worm-like payload that has been compromising packages published on the npm Registry. The worm has been dubbed “Shai-hulud” as it steals credentials from victims who […]

Self-replicating worm hits 180+ npm packages in (largely) automated supply chain attack Read More »

Breaches are up, budgets are too, so why isn’t healthcare safer?

cyber resilience, cyber risk, cybersecurity, healthcare, News, report, resilience, security ROI, supply chain attacks, supply chain compromise /

Breaches are up, budgets are too, so why isn’t healthcare safer? 2025-08-11 at 07:11 By Sinisa Markovic A new report from Resilience outlines a growing cyber crisis in the U.S. healthcare sector, where ransomware attacks, vendor compromise, and human error continue to cause widespread disruption. In 2023, breaches exposed 168 million records, and the first […]

Breaches are up, budgets are too, so why isn’t healthcare safer? Read More »

CoinMarketCap, Cointelegraph compromised to serve pop-ups to drain crypto wallets

Blockaid, C/side, Cryptocurrency, Don't miss, Hot stuff, JavaScript, News, supply chain attacks /

CoinMarketCap, Cointelegraph compromised to serve pop-ups to drain crypto wallets 2025-06-23 at 16:38 By Zeljka Zorz The CoinMarketCap and CoinTelegraph websites have been compromised over the weekend to serve clever phishing pop-ups to visitors, asking them to verify/connect their crypto wallets. The CoinMarketCap compromise CoinMarketCap (aka CMC) is a website popular with crypto investors as […]

CoinMarketCap, Cointelegraph compromised to serve pop-ups to drain crypto wallets Read More »

What is a supply chain attack in crypto and how to prevent it?

supply chain attacks /

What is a supply chain attack in crypto and how to prevent it? 2025-06-11 at 18:02 By Cointelegraph by Dilip Kumar Patairya Supply chain attacks in crypto exploit trusted dependencies, emerging as a major threat to crypto projects, which now have to stay vigilant on such threats. This article is an excerpt from Cointelegraph.com News […]

What is a supply chain attack in crypto and how to prevent it? Read More »

Scroll to Top