Supply Chain Security

Guardarian Users Targeted With Malicious Strapi NPM Packages

Malware & Threats, NPM, Strapi, supply chain attack, Supply Chain Security /

Guardarian Users Targeted With Malicious Strapi NPM Packages 2026-04-06 at 15:32 By Ionut Arghire Hackers published 36 NPM packages posing as Strapi plugins to execute shells, escape containers, and harvest credentials. The post Guardarian Users Targeted With Malicious Strapi NPM Packages appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Guardarian Users Targeted With Malicious Strapi NPM Packages Read More »

North Korean Hackers Target High-Profile Node.js Maintainers

Node.js, North Korea, supply chain attack, Supply Chain Security /

North Korean Hackers Target High-Profile Node.js Maintainers 2026-04-06 at 14:12 By Ionut Arghire The threat actor behind the Axios supply chain attack has been aiming at other maintainers in its social engineering campaign. The post North Korean Hackers Target High-Profile Node.js Maintainers appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

North Korean Hackers Target High-Profile Node.js Maintainers Read More »

Mercor Hit by LiteLLM Supply Chain Attack

AI, data breach, Featured, LiteLLM, Mercor, supply chain attack, Supply Chain Security, TeamPCP /

Mercor Hit by LiteLLM Supply Chain Attack 2026-04-02 at 13:45 By Ionut Arghire The AI recruiting firm is investigating the incident as Lapsus$ claimed the theft of 4TB of Mercor data. The post Mercor Hit by LiteLLM Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Mercor Hit by LiteLLM Supply Chain Attack Read More »

Axios NPM Package Breached in North Korean Supply Chain Attack

Application Security, Axios, Featured, North Korea, NPM, supply chain attack, Supply Chain Security /

Axios NPM Package Breached in North Korean Supply Chain Attack 2026-04-01 at 11:46 By Ionut Arghire A long-lived NPM access token was used to bypass the GitHub Actions OIDC-based CI/CD publishing workflow and push backdoored package versions. The post Axios NPM Package Breached in North Korean Supply Chain Attack appeared first on SecurityWeek. This article […]

Axios NPM Package Breached in North Korean Supply Chain Attack Read More »

Telnyx Targeted in Growing TeamPCP Supply Chain Attack

Malware & Threats, open source, PyPI, supply chain attack, Supply Chain Security, TeamPCP, Telnyx /

Telnyx Targeted in Growing TeamPCP Supply Chain Attack 2026-03-30 at 14:26 By Ionut Arghire Two malicious versions of the popular SDK were uploaded to the PyPI registry, targeting Windows, macOS, and Linux. The post Telnyx Targeted in Growing TeamPCP Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original […]

Telnyx Targeted in Growing TeamPCP Supply Chain Attack Read More »

Aqua’s Trivy Vulnerability Scanner Hit by Supply Chain Attack

Aqua Security, GitHub, open source, supply chain attack, Supply Chain Security, Trivy, vulnerability scanner /

Aqua’s Trivy Vulnerability Scanner Hit by Supply Chain Attack 2026-03-23 at 16:12 By Ionut Arghire Hackers published a malicious scanner release and replaced tags to point to information-stealer malware. The post Aqua’s Trivy Vulnerability Scanner Hit by Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Aqua’s Trivy Vulnerability Scanner Hit by Supply Chain Attack Read More »

Virtual Summit Today: Supply Chain & Third-Party Risk Summit

event, Supply Chain Security /

Virtual Summit Today: Supply Chain & Third-Party Risk Summit 2026-03-18 at 17:05 By SecurityWeek News Cyber risk doesn’t stop at your perimeter. Today’s most dangerous threats could be hiding in your software supply chain. The post Virtual Summit Today: Supply Chain & Third-Party Risk Summit appeared first on SecurityWeek. This article is an excerpt from […]

Virtual Summit Today: Supply Chain & Third-Party Risk Summit Read More »

Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack

GlassWorm, Mac malware, Malware, Malware & Threats, Supply Chain Security /

Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack 2026-02-02 at 16:18 By Ionut Arghire A hacker published malicious versions of four established VS Code extensions to distribute a GlassWorm malware loader. The post Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View […]

Open VSX Publisher Account Hijacked in Fresh GlassWorm Attack Read More »

Notepad++ Supply Chain Hack Conducted by China via Hosting Provider

Featured, Notepad++, supply chain attack, Supply Chain Security /

Notepad++ Supply Chain Hack Conducted by China via Hosting Provider 2026-02-02 at 11:20 By Eduard Kovacs The likely state-sponsored threat actor had access to the hosting provider for months and targeted only certain Notepad++ customers. The post Notepad++ Supply Chain Hack Conducted by China via Hosting Provider appeared first on SecurityWeek. This article is an […]

Notepad++ Supply Chain Hack Conducted by China via Hosting Provider Read More »

eScan Antivirus Delivers Malware in Supply Chain Attack

antivirus, eScan, Featured, Malware, Malware & Threats, supply chain, supply chain attack, Supply Chain Security /

eScan Antivirus Delivers Malware in Supply Chain Attack 2026-01-31 at 17:24 By Ionut Arghire Hackers compromised a MicroWorld Technologies update server and fed a malicious file to eScan customers. The post eScan Antivirus Delivers Malware in Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

eScan Antivirus Delivers Malware in Supply Chain Attack Read More »

‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain Attacks

NPM, supply chain, supply chain attack, Supply Chain Security /

‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain Attacks 2026-01-27 at 15:49 By Ionut Arghire The protections against NPM supply chain attacks could be bypassed, leading to arbitrary code execution. The post ‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain Attacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

‘PackageGate’ Flaws Open JavaScript Ecosystem to Supply Chain Attacks Read More »

Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist

Application Security, cryptocurrency heist, Shai-Hulud, supply chain, supply chain attack, Supply Chain Security, Trust Wallet /

Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist 2025-12-31 at 14:09 By Ionut Arghire The worm exposed Trust Wallet’s Developer GitHub secrets, allowing attackers to publish a backdoor extension and steal funds from 2,520 wallets. The post Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist appeared first on SecurityWeek. […]

Shai-Hulud Supply Chain Attack Led to $8.5 Million Trust Wallet Heist Read More »

Infostealer Malware Delivered in EmEditor Supply Chain Attack

EmEditor, infostealer, Malware, Malware & Threats, supply chain attack, Supply Chain Security /

Infostealer Malware Delivered in EmEditor Supply Chain Attack 2025-12-29 at 13:40 By Eduard Kovacs The ‘download’ button on the official EmEditor website served a malicious installer. The post Infostealer Malware Delivered in EmEditor Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Infostealer Malware Delivered in EmEditor Supply Chain Attack Read More »

From Open Source to OpenAI: The Evolution of Third-Party Risk

open source, supply chain, Supply Chain Security, vibe coding, Vulnerabilities /

From Open Source to OpenAI: The Evolution of Third-Party Risk 2025-12-16 at 20:15 By Nadir Izrael From open source libraries to AI-powered coding assistants, speed-driven development is introducing new third-party risks that threat actors are increasingly exploiting. The post From Open Source to OpenAI: The Evolution of Third-Party Risk appeared first on SecurityWeek. This article […]

From Open Source to OpenAI: The Evolution of Third-Party Risk Read More »

Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks

China APT, Featured, Malware, supply chain, Supply Chain Security /

Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks 2025-11-03 at 12:28 By Ionut Arghire PowerShell and .NET variants of the malware abuse AirWatch’s MDM API to establish a C&C communication channel. The post Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View […]

Chinese APT Uses ‘Airstalk’ Malware in Supply Chain Attacks Read More »

SBOM Pioneer Allan Friedman Joins NetRise to Advance Supply Chain Visibility

NetRise, SBOM, Supply Chain Security /

SBOM Pioneer Allan Friedman Joins NetRise to Advance Supply Chain Visibility 2025-10-21 at 18:16 By Kevin Townsend NetRise appointed the former CISA Senior Advisor and Strategist as a Strategic Advisor. The post SBOM Pioneer Allan Friedman Joins NetRise to Advance Supply Chain Visibility appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View […]

SBOM Pioneer Allan Friedman Joins NetRise to Advance Supply Chain Visibility Read More »

GitHub Boosting Security in Response to NPM Supply Chain Attacks 

2FA, Application Security, authentication, GitHub, NPM, supply chain, Supply Chain Security /

GitHub Boosting Security in Response to NPM Supply Chain Attacks  2025-09-24 at 13:18 By Ionut Arghire GitHub will implement local publishing with mandatory 2FA, granular tokens that expire after seven days, and trusted publishing. The post GitHub Boosting Security in Response to NPM Supply Chain Attacks  appeared first on SecurityWeek. This article is an excerpt […]

GitHub Boosting Security in Response to NPM Supply Chain Attacks  Read More »

Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit

Application Security, Featured, NPM, Shai-Hulud, supply chain, Supply Chain Security, worm /

Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit 2025-09-17 at 16:04 By Ionut Arghire The packages were injected with malicious code to harvest secrets, dump them to a public repository, and make private repositories public. The post Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit […]

Shai-Hulud Supply Chain Attack: Worm Used to Steal Secrets, 180+ NPM Packages Hit Read More »

Highly Popular NPM Packages Poisoned in New Supply Chain Attack

Application Security, Cryptocurrency, cryptojacking, Featured, NPM, supply chain, Supply Chain Security /

Highly Popular NPM Packages Poisoned in New Supply Chain Attack 2025-09-10 at 11:45 By Ionut Arghire Designed to intercept cryptocurrency transactions, the malicious code reached 10% of cloud environments. The post Highly Popular NPM Packages Poisoned in New Supply Chain Attack appeared first on SecurityWeek. This article is an excerpt from SecurityWeek View Original Source

Highly Popular NPM Packages Poisoned in New Supply Chain Attack Read More »

GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets

Application Security, GhostAction, GitHub, secrets sprawl, Supply Chain Security /

GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets 2025-09-08 at 16:20 By Eduard Kovacs A supply chain attack called GhostAction has enabled threat actors to steal secrets and exploit them. The post GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets appeared first on SecurityWeek. This article is an excerpt from SecurityWeek […]

GitHub Workflows Attack Affects Hundreds of Repos, Thousands of Secrets Read More »

Scroll to Top