Supply Chain Security - Security Ticks

High-Value NPM Developers Compromised in New Phishing Campaign

NPM, phishing, supply chain, Supply Chain Security / SecurityTicks

High-Value NPM Developers Compromised in New Phishing Campaign 2025-07-24 at 14:22 By Ionut Arghire Hackers have injected malware into popular NPM packages after compromising several developer accounts in a fresh phishing campaign. The post High-Value NPM Developers Compromised in New Phishing Campaign appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

React to this headline:

High-Value NPM Developers Compromised in New Phishing Campaign Read More »

React Native Aria Packages Backdoored in Supply Chain Attack

backdoor, Malware & Threats, NPM, supply chain, Supply Chain Security / SecurityTicks

React Native Aria Packages Backdoored in Supply Chain Attack 2025-06-09 at 17:22 By Ionut Arghire A threat actor published backdoored versions of 17 NPM packages from GlueStack in a fresh supply chain attack. The post React Native Aria Packages Backdoored in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek

React to this headline:

React Native Aria Packages Backdoored in Supply Chain Attack Read More »

Ongoing Campaign Uses 60 NPM Packages to Steal Data

Info stealer, Malware & Threats, NPM, open source, Socket, Supply Chain Security / SecurityTicks

Ongoing Campaign Uses 60 NPM Packages to Steal Data 2025-05-27 at 17:17 By Ionut Arghire Security firm Socket warns flags a campaign targeting NPM users with tens of malicious packages that can hijack system information. The post Ongoing Campaign Uses 60 NPM Packages to Steal Data appeared first on SecurityWeek. This article is an excerpt

React to this headline:

Ongoing Campaign Uses 60 NPM Packages to Steal Data Read More »

Chinese Hackers Hit Drone Sector in Supply Chain Attacks

China APT, drone, Featured, Nation-State, supply chain, Supply Chain Security / SecurityTicks

Chinese Hackers Hit Drone Sector in Supply Chain Attacks 2025-05-15 at 14:39 By Ionut Arghire The China-linked hacking group Earth Ammit has launched multi-wave attacks in Taiwan and South Korea to disrupt the drone sector. The post Chinese Hackers Hit Drone Sector in Supply Chain Attacks appeared first on SecurityWeek. This article is an excerpt

React to this headline:

Chinese Hackers Hit Drone Sector in Supply Chain Attacks Read More »

China’s Secret Weapon? How EV Batteries Could be Weaponized to Disrupt America

China, cyberwar, Cyberwarfare, ICS/OT, Supply Chain Security / SecurityTicks

China’s Secret Weapon? How EV Batteries Could be Weaponized to Disrupt America 2025-04-29 at 18:02 By Kevin Townsend As Xi Jinping advances his vision for China’s dominance by 2049, cybersecurity experts warn that connected technologies—like EV batteries—may quietly serve as tools of influence, espionage, and disruption. The post China’s Secret Weapon? How EV Batteries Could

React to this headline:

China’s Secret Weapon? How EV Batteries Could be Weaponized to Disrupt America Read More »

Chainguard Raises Hefty $356M Series D at $3.5 Billion Valuation

Chainguard, containers, Funding/M&A, Kleiner Perkins, Kubernetes, open source, supply chain, Supply Chain Security / SecurityTicks

Chainguard Raises Hefty $356M Series D at $3.5 Billion Valuation 2025-04-23 at 17:20 By Ryan Naraine The cash infusion brings Chainguard’s total funding to about $612 million since launching in 2021 and prices the company at $3.5 billion. The post Chainguard Raises Hefty $356M Series D at $3.5 Billion Valuation appeared first on SecurityWeek. This

React to this headline:

Chainguard Raises Hefty $356M Series D at $3.5 Billion Valuation Read More »

Huntress Documents In-The-Wild Exploitation of Critical Gladinet Vulnerabilities

CrushFTP, CVE-2025-30406, Gladinet, Malware & Threats, Supply Chain Security, Triofox / SecurityTicks

Huntress Documents In-The-Wild Exploitation of Critical Gladinet Vulnerabilities 2025-04-14 at 20:31 By Ryan Naraine The flaw, tagged as CVE-2025-30406, was added to CISA’s Known Exploited Vulnerabilities (KEV) catalog in early April. The post Huntress Documents In-The-Wild Exploitation of Critical Gladinet Vulnerabilities appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

React to this headline:

Huntress Documents In-The-Wild Exploitation of Critical Gladinet Vulnerabilities Read More »

AI Hallucinations Create a New Software Supply Chain Threat

AI, Featured, Gen-AI, supply chain, Supply Chain Security / SecurityTicks

AI Hallucinations Create a New Software Supply Chain Threat 2025-04-14 at 16:07 By Ionut Arghire Researchers uncover new software supply chain threat from LLM-generated package hallucinations. The post AI Hallucinations Create a New Software Supply Chain Threat appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React to this headline:

React to this headline:

AI Hallucinations Create a New Software Supply Chain Threat Read More »

Malicious NPM Packages Target Cryptocurrency, PayPal Users

cybercrime, Supply Chain Security / SecurityTicks

Malicious NPM Packages Target Cryptocurrency, PayPal Users 2025-04-14 at 13:45 By Ionut Arghire Threat actors are publishing malicious NPM packages to steal PayPal credentials and hijack cryptocurrency transfers. The post Malicious NPM Packages Target Cryptocurrency, PayPal Users appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source React to this headline:

React to this headline:

Malicious NPM Packages Target Cryptocurrency, PayPal Users Read More »

Compromised SpotBugs Token Led to GitHub Actions Supply Chain Hack

Application Security, GitHub actions, supply chain, Supply Chain Security / SecurityTicks

Compromised SpotBugs Token Led to GitHub Actions Supply Chain Hack 2025-04-04 at 12:49 By Ionut Arghire Evidence shows a SpotBugs token compromised in December 2024 was used in the March 2025 GitHub Actions supply chain attack. The post Compromised SpotBugs Token Led to GitHub Actions Supply Chain Hack appeared first on SecurityWeek. This article is

React to this headline:

Compromised SpotBugs Token Led to GitHub Actions Supply Chain Hack Read More »

Impact, Root Cause of GitHub Actions Supply Chain Hack Revealed

Featured, GitHub, GitHub actions, supply chain, Supply Chain Security / SecurityTicks

Impact, Root Cause of GitHub Actions Supply Chain Hack Revealed 2025-03-21 at 12:17 By Eduard Kovacs More details have come to light on the recent supply chain attack targeting GitHub Actions, including its root cause. The post Impact, Root Cause of GitHub Actions Supply Chain Hack Revealed appeared first on SecurityWeek. This article is an

React to this headline:

Impact, Root Cause of GitHub Actions Supply Chain Hack Revealed Read More »

Virtual Event Today: Supply Chain & Third-Party Risk Security Summit

event, Supply Chain Security / SecurityTicks

Virtual Event Today: Supply Chain & Third-Party Risk Security Summit 2025-03-19 at 16:31 By SecurityWeek News Join the virtual event as we explore of the critical nature of software and vendor supply chain security issues. The post Virtual Event Today: Supply Chain & Third-Party Risk Security Summit appeared first on SecurityWeek. This article is an

React to this headline:

Virtual Event Today: Supply Chain & Third-Party Risk Security Summit Read More »

100 Car Dealerships Hit by Supply Chain Attack

ClickFix, Malware, Malware & Threats, supply chain, Supply Chain Security / SecurityTicks

100 Car Dealerships Hit by Supply Chain Attack 2025-03-17 at 14:17 By Ionut Arghire The websites of over 100 auto dealerships were found serving malicious ClickFix code in a supply chain compromise. The post 100 Car Dealerships Hit by Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original

React to this headline:

100 Car Dealerships Hit by Supply Chain Attack Read More »

Popular GitHub Action Targeted in Supply Chain Attack

Application Security, Featured, GitHub, GitHub actions, supply chain, Supply Chain Security / SecurityTicks

Popular GitHub Action Targeted in Supply Chain Attack 2025-03-17 at 12:04 By Eduard Kovacs The tj-actions/changed-files GitHub Action, which is used in 23,000 repositories, has been targeted in a supply chain attack. The post Popular GitHub Action Targeted in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original

React to this headline:

UK Government Report Calls for Stronger Open Source Supply Chain Security Practices

open source, supply chain, Supply Chain Security / SecurityTicks

UK Government Report Calls for Stronger Open Source Supply Chain Security Practices 2025-03-11 at 19:05 By Kevin Townsend Report from the Department for Science, Innovation & Technology (DSIT) finds weaknesses in current practices. The post UK Government Report Calls for Stronger Open Source Supply Chain Security Practices appeared first on SecurityWeek. This article is an

React to this headline:

UK Government Report Calls for Stronger Open Source Supply Chain Security Practices Read More »

Endor Labs and Allies Launch Opengrep, Reviving True OSS for SAST

Application Security, open source, Opengrep, Supply Chain Security / SecurityTicks

Endor Labs and Allies Launch Opengrep, Reviving True OSS for SAST 2025-01-27 at 17:20 By Kevin Townsend Opengrep is a new consortium-backed fork of Semgrep, intended to be and remain a true genuine OSS SAST tool. The post Endor Labs and Allies Launch Opengrep, Reviving True OSS for SAST appeared first on SecurityWeek. This article

React to this headline:

Endor Labs and Allies Launch Opengrep, Reviving True OSS for SAST Read More »

Zero-Day Breach at Rackspace Sparks Vendor Blame Game

Data Breaches, Featured, Rackspace, Ransomware, ScienceLogic, SL1, Supply Chain Security, Zero-Day / SecurityTicks

Zero-Day Breach at Rackspace Sparks Vendor Blame Game 2024-10-02 at 21:01 By Ryan Naraine A breach at Rackspace exposes the fragility of the software supply chain, triggering a blame game among vendors over an exploited zero-day. The post Zero-Day Breach at Rackspace Sparks Vendor Blame Game appeared first on SecurityWeek. This article is an excerpt

React to this headline:

Zero-Day Breach at Rackspace Sparks Vendor Blame Game Read More »

Fortifying the Weakest Link: How to Safeguard Against Supply Chain Cyberattacks

Risk Management, supply chain, Supply Chain Security / SecurityTicks

Fortifying the Weakest Link: How to Safeguard Against Supply Chain Cyberattacks 2024-09-26 at 15:01 By Torsten George As organizations have fortified their defenses against direct network attacks, hackers have shifted their focus to exploiting vulnerabilities in the supply chain to gain backdoor access to systems. The post Fortifying the Weakest Link: How to Safeguard Against

React to this headline:

Fortifying the Weakest Link: How to Safeguard Against Supply Chain Cyberattacks Read More »

Software Supply Chain Security Firm Lineaje Raises $20M in Series A Funding

Cybersecurity Funding, funding, Lineaje, supply chain, Supply Chain Security / SecurityTicks

Software Supply Chain Security Firm Lineaje Raises $20M in Series A Funding 2024-07-30 at 17:01 By Eduard Kovacs Software supply chain security startup Lineaje has raised $20 million in a Series A funding round that brings the total to $27 million. The post Software Supply Chain Security Firm Lineaje Raises $20M in Series A Funding

React to this headline:

Software Supply Chain Security Firm Lineaje Raises $20M in Series A Funding Read More »

Chainguard Raises $140 Million, Expands Tech to Secure AI Workloads

Chainguard, container, Funding/M&A, open source, Sequioa, Series C, Supply Chain Security / SecurityTicks

Chainguard Raises $140 Million, Expands Tech to Secure AI Workloads 2024-07-25 at 19:49 By Ryan Naraine Software supply chain security startup Chainguard raises a $140 million Series C round that values the company at $1.2 billion. The post Chainguard Raises $140 Million, Expands Tech to Secure AI Workloads appeared first on SecurityWeek. This article is

React to this headline:

Chainguard Raises $140 Million, Expands Tech to Secure AI Workloads Read More »