Supply Chain Security

Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign

Application Security, data theft, GitHub, Supply Chain Security, Wfx-Loot /

Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign 2026-11-12 at 15:39 By Eduard Kovacs Using thousands of hijacked accounts, the wfx-loot campaign planted a CI secret stealer that ran in over 1,800 GitHub repositories. The post Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign appeared first on SecurityWeek. This article is an excerpt […]

Attacker Targets 60,000 GitHub Repositories in Credential Theft Campaign Read More »

Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next

podcast, SBOM, Supply Chain Security /

Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next 2026-11-10 at 18:45 By Brian Schleifer SBOM pioneer Allan Friedman joined the SecurityWeek Podcast to discuss why knowing what is inside software is only the beginning, how AI is complicating software supply chain visibility, and what organizations should be doing with […]

Software Transparency Is Changing: Allan Friedman on SBOM, AI BOMs and What Comes Next Read More »

Over a Dozen Organizations Hit in Qubole Supply Chain Attack

Qubole, supply chain attack, Supply Chain Security /

Over a Dozen Organizations Hit in Qubole Supply Chain Attack 2026-11-10 at 15:27 By Ionut Arghire Hackers used compromised Qubole IAM credentials to steal customer files, secrets, keys, environment variables, and credentials. The post Over a Dozen Organizations Hit in Qubole Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek […]

Over a Dozen Organizations Hit in Qubole Supply Chain Attack Read More »

Malicious cPGuard Updates Served in OpsShield Supply Chain Attack

data breach, Data Breaches, OpsShield, supply chain attack, Supply Chain Security /

Malicious cPGuard Updates Served in OpsShield Supply Chain Attack 2026-11-04 at 12:54 By Ionut Arghire Using compromised credentials, the attackers accessed OpsShield’s update servers and poisoned multiple cPGuard versions. The post Malicious cPGuard Updates Served in OpsShield Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Malicious cPGuard Updates Served in OpsShield Supply Chain Attack Read More »

Malicious Claude Code Extension Served in Cursor Supply Chain Attack

Cursor, extension, Malware & Threats, supply chain attack, Supply Chain Security /

Malicious Claude Code Extension Served in Cursor Supply Chain Attack 2026-11-02 at 13:29 By Ionut Arghire The extension performed host reconnaissance and attempted to create a reverse SSH tunnel. The post Malicious Claude Code Extension Served in Cursor Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Malicious Claude Code Extension Served in Cursor Supply Chain Attack Read More »

Nobody Trusts the Security Questionnaire. We Rely on It Anyway.

Compliance, GRC, Risk Management, Supply Chain Security /

Nobody Trusts the Security Questionnaire. We Rely on It Anyway. 2026-10-28 at 12:30 By Sravish Sridhar The process that gates nearly every B2B deal is a self-assessment the sender distrusts and the receiver accepts. There is finally a better basis for trust between companies. The post Nobody Trusts the Security Questionnaire. We Rely on It […]

Nobody Trusts the Security Questionnaire. We Rely on It Anyway. Read More »

LiteLLM Compromised in Fresh Supply Chain Attack

AI, Artificial Intelligence, Featured, LiteLLM, supply chain attack, Supply Chain Security /

LiteLLM Compromised in Fresh Supply Chain Attack 2026-10-23 at 11:10 By Ionut Arghire Hackers used compromised GitHub CLI OAuth tokens to push and approve malicious packages on PyPI and Docker. The post LiteLLM Compromised in Fresh Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

LiteLLM Compromised in Fresh Supply Chain Attack Read More »

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign

AOMEI, Malware, supply chain attack, Supply Chain Security /

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign 2026-10-20 at 16:51 By Ionut Arghire Across multiple short compromise windows, users were served a downloader for the ShinyRoad modular backdoor framework. The post AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

AOMEI Backupper Compromised in Short-Burst Supply Chain Campaign Read More »

Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack

Rank Math, supply chain attack, Supply Chain Security, WordPress /

Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack 2026-10-19 at 18:20 By Ionut Arghire Hackers injected malware into Rank Math PRO version 3.0.123 packages distributed between October 15 and October 16. The post Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from […]

Rank Math PRO WordPress Plugin Compromised in Supply Chain Attack Read More »

$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant

Cryptocurrency, cryptocurrency heist, Hardware supply chain, Ledger, supply chain attack, Supply Chain Security /

$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant 2026-10-13 at 13:36 By Ionut Arghire A small circuit board hidden under the signers’ screens read user data and transmitted it to the attackers. The post $86 Million Crypto Heist Linked to Ledger Signer Hardware Implant appeared first on SecurityWeek. This article is an excerpt […]

$86 Million Crypto Heist Linked to Ledger Signer Hardware Implant Read More »

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads

Malware, Malware & Threats, NPM, supply chain attack, Supply Chain Security /

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads 2026-10-06 at 13:34 By Ionut Arghire Since August 2023, attackers have published eight malicious packages as part of the MALFEX supply chain campaign. The post Long-Running NPM Malware Campaign Accumulates 40,000 Downloads appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Long-Running NPM Malware Campaign Accumulates 40,000 Downloads Read More »

BigCommerce Data Stolen via Ribon Apps Hack

BigCommerce, data breach, Data Breaches, Ribon, supply chain attack, Supply Chain Security /

BigCommerce Data Stolen via Ribon Apps Hack 2026-09-22 at 20:58 By Ionut Arghire The attackers used a compromised BigCommerce application key held by Ribon to access customer data. The post BigCommerce Data Stolen via Ribon Apps Hack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

BigCommerce Data Stolen via Ribon Apps Hack Read More »

Malicious B-tree NPM Package Accumulates Millions of Downloads

Application Security, NPM, supply chain attack, Supply Chain Security /

Malicious B-tree NPM Package Accumulates Millions of Downloads 2026-09-22 at 14:33 By Ionut Arghire Posing as the legitimate sorted-btree package, indexed-btree hides a malware trigger in its prototype method. The post Malicious B-tree NPM Package Accumulates Millions of Downloads appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Malicious B-tree NPM Package Accumulates Millions of Downloads Read More »

Rust Team Members and Popular Crate Owners Targeted via Video Calls

North Korea, rust, supply chain attack, Supply Chain Security /

Rust Team Members and Popular Crate Owners Targeted via Video Calls 2026-09-21 at 14:57 By Eduard Kovacs It’s unclear if the attacks are part of previous campaigns against Rust, but the techniques used by the attackers match those used by North Korea. The post Rust Team Members and Popular Crate Owners Targeted via Video Calls […]

Rust Team Members and Popular Crate Owners Targeted via Video Calls Read More »

CrowdSec Confirms Source Code Stolen in Supply Chain Attack

CrowdSec, data breach, Data Breaches, source code, supply chain attack, Supply Chain Security /

CrowdSec Confirms Source Code Stolen in Supply Chain Attack 2026-09-21 at 13:55 By Ionut Arghire The cybersecurity firm believes the data breach was the result of the May 2026 TanStack supply chain attack. The post CrowdSec Confirms Source Code Stolen in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek […]

CrowdSec Confirms Source Code Stolen in Supply Chain Attack Read More »

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites

Brevo, ClickFix, Featured, Malware, Malware & Threats, supply chain attack, Supply Chain Security, WordPress /

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites 2026-09-18 at 12:46 By Ionut Arghire Hackers used a compromised API key to deploy a Cloudflare worker that injected malicious scripts. The post Brevo Supply Chain Attack Injects Malware Into 100,000 Websites appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Brevo Supply Chain Attack Injects Malware Into 100,000 Websites Read More »

Rust Supply Chain Attack Linked to North Korean Hackers

Arrayref, Malware & Threats, North Korea, rust, supply chain attack, Supply Chain Security /

Rust Supply Chain Attack Linked to North Korean Hackers 2026-08-21 at 12:23 By Ionut Arghire Hackers pushed a poisoned arrayref version that added a dependency to fetch a malicious payload from a remote server. The post Rust Supply Chain Attack Linked to North Korean Hackers appeared first on SecurityWeek. This article is an excerpt from […]

Rust Supply Chain Attack Linked to North Korean Hackers Read More »

Trivy, Not LiteLLM Behind the 2,500 Org Compromise

LiteLLM, supply chain, supply chain attack, Supply Chain Security, Trivy /

Trivy, Not LiteLLM Behind the 2,500 Org Compromise 2026-08-14 at 14:35 By Ionut Arghire Over 95% of the affected companies were exposed before the malicious LiteLLM packages were published. The post Trivy, Not LiteLLM Behind the 2,500 Org Compromise appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Trivy, Not LiteLLM Behind the 2,500 Org Compromise Read More »

Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds

Application Security, Supply Chain Security /

Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds 2026-08-10 at 17:19 By Kevin Townsend The startup analyzes subtle telemetry signals to detect attacks that traditional security tools cannot see inside accelerator-powered AI infrastructure. The post Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds appeared first on SecurityWeek. This article is an […]

Stealthium Targets Security Blind Spots in AI Accelerators and Neo-Clouds Read More »

Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack

ChainDrop, Malware, Malware & Threats, Mini Shai-Hulud, NPM, Shai-Hulud, supply chain attack, Supply Chain Security /

Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack 2026-08-05 at 11:56 By Ionut Arghire The malware was designed to steal and exfiltrate secrets, and to propagate itself via stolen NPM and GitHub credentials. The post Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack appeared first on SecurityWeek. This article is an […]

Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack Read More »

Scroll to Top