Supply Chain Security

Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility

Black Kite, report, supply chain, Supply Chain Security, Vulnerabilities, vulnerability /

Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility 2026-05-21 at 11:40 By Kevin Townsend New vulnerabilities are being discovered too fast, the time-to-exploitation is too short, and our visibility into them is largely lacking. The post Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility appeared first on SecurityWeek. This article is […]

Supply Chain Security Crisis: Too Many Vulnerabilities, Too Little Visibility Read More »

Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack

Malware & Threats, Mini Shai-Hulud, supply chain attack, Supply Chain Security, TeamPCP /

Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack 2026-05-20 at 14:21 By Ionut Arghire A compromised maintainer account was used to publish malicious package versions across the @antv namespace. The post Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack appeared first on SecurityWeek. This article is an

Over 320 NPM Packages Hit by Fresh Mini Shai-Hulud Supply Chain Attack Read More »

OpenAI Hit by TanStack Supply Chain Attack

AI, Artificial Intelligence, certificates, OpenAI, supply chain attack, Supply Chain Security, TanStack /

OpenAI Hit by TanStack Supply Chain Attack 2026-05-15 at 14:32 By Ionut Arghire Two employee devices were compromised in the attack, and credential material was stolen from OpenAI code repositories. The post OpenAI Hit by TanStack Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

OpenAI Hit by TanStack Supply Chain Attack Read More »

TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code

Malware, Malware & Threats, Shai-Hulud, source code, Supply Chain Security, TeamPCP, worm /

TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code 2026-05-15 at 14:32 By Ionut Arghire The hacking group is encouraging miscreants to use the code in supply chain attacks, promising monetary rewards. The post TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View

TeamPCP Ups the Game, Releases Shai-Hulud Worm’s Source Code Read More »

TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack

Featured, Malware & Threats, Mini Shai-Hulud, supply chain attack, Supply Chain Security, TeamPCP /

TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack 2026-05-12 at 13:20 By Ionut Arghire Over 400 malicious versions of 170 packages were published as part of the new Mini Shai-Hulud campaign. The post TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from

TanStack, Mistral AI, UiPath Hit in Fresh Supply Chain Attack Read More »

Build Application Firewalls Aim to Stop the Next Supply Chain Attack

supply chain, Supply Chain Security, Vulnerabilities /

Build Application Firewalls Aim to Stop the Next Supply Chain Attack 2026-05-11 at 17:12 By Kevin Townsend Rather than scanning code alone, Build Application Firewalls inspect runtime behavior inside the software build pipeline. The post Build Application Firewalls Aim to Stop the Next Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt

Build Application Firewalls Aim to Stop the Next Supply Chain Attack Read More »

Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack

Checkmarx, Jenkins, supply chain attack, Supply Chain Security, TeamPCP, Trivy /

Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack 2026-05-11 at 13:57 By Ionut Arghire A malicious version of the plugin was published to the Jenkins Marketplace late last week. The post Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Checkmarx Jenkins AST Plugin Compromised in Supply Chain Attack Read More »

AI Coding Agents Could Fuel Next Supply Chain Crisis

Artificial Intelligence, Claude Code, Featured, supply chain, Supply Chain Security /

AI Coding Agents Could Fuel Next Supply Chain Crisis 2026-05-07 at 17:33 By Kevin Townsend “TrustFall” attack shows how AI coding agents can be manipulated into launching stealthy supply chain compromises. The post AI Coding Agents Could Fuel Next Supply Chain Crisis appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original

AI Coding Agents Could Fuel Next Supply Chain Crisis Read More »

Vendor Says Daemon Tools Supply Chain Attack Contained

Daemon Tools, Malware, Malware & Threats, supply chain attack, Supply Chain Security /

Vendor Says Daemon Tools Supply Chain Attack Contained 2026-05-07 at 17:33 By Ionut Arghire The software developer has identified the impacted systems, removed potentially compromised files, and validated installation packages. The post Vendor Says Daemon Tools Supply Chain Attack Contained appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Vendor Says Daemon Tools Supply Chain Attack Contained Read More »

Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack

Daemon Tools, Malware & Threats, supply chain attack, Supply Chain Security /

Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack 2026-05-06 at 12:03 By Ionut Arghire While trojanized Daemon Tools versions were installed worldwide, a sophisticated backdoor was dropped only on a dozen systems. The post Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt

Government, Scientific Entities Hit via Daemon Tools Supply Chain Attack Read More »

1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom

Intercomp, Lightning, Mini Shai-Hulud, NPM, SAP, Shai-Hulud, supply chain attack, Supply Chain Security /

1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom 2026-05-01 at 10:33 By Ionut Arghire The compromised Lightning and Intercom packages have a combined monthly download count of nearly 10 million. The post 1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom appeared first on SecurityWeek. This article is an excerpt from SecurityWeek

1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom Read More »

SAP NPM Packages Targeted in Supply Chain Attack

Malware & Threats, NPM, SAP, Shai-Hulud, supply chain attack, Supply Chain Security, TeamPCP /

SAP NPM Packages Targeted in Supply Chain Attack 2026-04-30 at 17:35 By Ionut Arghire The Mini Shai-Hulud attack introduced a preinstall hook to fetch and execute a Bun binary and bypass security monitoring. The post SAP NPM Packages Targeted in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View

SAP NPM Packages Targeted in Supply Chain Attack Read More »

Bitwarden NPM Package Hit in Supply Chain Attack

Bitwarden, NPM, Shai-Hulud, supply chain attack, Supply Chain Security, TeamPCP /

Bitwarden NPM Package Hit in Supply Chain Attack 2026-04-24 at 11:27 By Ionut Arghire Tied to a fresh Checkmarx supply chain attack claimed by TeamPCP, the incident references the Shai-Hulud worm. The post Bitwarden NPM Package Hit in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Bitwarden NPM Package Hit in Supply Chain Attack Read More »

Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM Data

SBOM, supply chain, Supply Chain Security, VEX /

Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM Data 2026-04-22 at 14:47 By Kevin Townsend Researcher says the missing piece is a governance-driven intelligence layer that turns SBOM and VEX data into explainable security decisions. The post Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM

Are SBOMs Failing? Supply Chain Attacks Rise as Security Teams Struggle With SBOM Data Read More »

CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads

CPU-Z, CPUID, Featured, Malware, Malware & Threats, STX RAT, supply chain attack, Supply Chain Security, watering hole /

CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads 2026-04-13 at 15:44 By Eduard Kovacs Download links were replaced by a Russian-speaking threat actor to distribute a recently emerged malware named STX RAT. The post CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads appeared first on SecurityWeek. This article is an excerpt from SecurityWeek

CPUID Hacked to Serve Trojanized CPU-Z and HWMonitor Downloads Read More »

OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack

Artificial Intelligence, Axios, certificate, North Korea, OpenAI, supply chain attack, Supply Chain Security /

OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack 2026-04-13 at 15:44 By Eduard Kovacs The AI giant is taking action after determining that a macOS code signing certificate may have been compromised. The post OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek

OpenAI Impacted by North Korea-Linked Axios Supply Chain Hack Read More »

Guardarian Users Targeted With Malicious Strapi NPM Packages

Malware & Threats, NPM, Strapi, supply chain attack, Supply Chain Security /

Guardarian Users Targeted With Malicious Strapi NPM Packages 2026-04-06 at 15:32 By Ionut Arghire Hackers published 36 NPM packages posing as Strapi plugins to execute shells, escape containers, and harvest credentials. The post Guardarian Users Targeted With Malicious Strapi NPM Packages appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Guardarian Users Targeted With Malicious Strapi NPM Packages Read More »

North Korean Hackers Target High-Profile Node.js Maintainers

Node.js, North Korea, supply chain attack, Supply Chain Security /

North Korean Hackers Target High-Profile Node.js Maintainers 2026-04-06 at 14:12 By Ionut Arghire The threat actor behind the Axios supply chain attack has been aiming at other maintainers in its social engineering campaign. The post North Korean Hackers Target High-Profile Node.js Maintainers appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original

North Korean Hackers Target High-Profile Node.js Maintainers Read More »

Mercor Hit by LiteLLM Supply Chain Attack

AI, data breach, Featured, LiteLLM, Mercor, supply chain attack, Supply Chain Security, TeamPCP /

Mercor Hit by LiteLLM Supply Chain Attack 2026-04-02 at 13:45 By Ionut Arghire The AI recruiting firm is investigating the incident as Lapsus$ claimed the theft of 4TB of Mercor data. The post Mercor Hit by LiteLLM Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Mercor Hit by LiteLLM Supply Chain Attack Read More »

Axios NPM Package Breached in North Korean Supply Chain Attack

Application Security, Axios, Featured, North Korea, NPM, supply chain attack, Supply Chain Security /

Axios NPM Package Breached in North Korean Supply Chain Attack 2026-04-01 at 11:46 By Ionut Arghire A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored package versions. The post Axios NPM Package Breached in North Korean Supply Chain Attack appeared first on SecurityWeek. This article

Axios NPM Package Breached in North Korean Supply Chain Attack Read More »

Scroll to Top