Signal
57 articles covering "supply-chain"
Aikido and StepSecurity say stolen GitHub credentials have pushed a CI secret stealer since November 10; their counts differ and no cited source says how the credentials were obtained.
A comparison of how uv, pip, CPython, the AWS CLI and the Azure CLI handled the compromised eMudhra intermediate CAs, drawing on release notes, pull requests, Mozilla and Cloudflare.
A GitHub advisory says kaniko before v1.25.20 can send an Entra ID token to a lookalike registry host named in a Dockerfile; the Go vulnerability database lists no fixed version of the upstream helper.
Reporting on the Brotli decoder flaw CVE-2026-111497 shows fixes, scanner coverage and exploitation status differing across Node.js, .NET, Python packages and others.
Pluto Security counts 31 malicious Hugging Face repositories in two waves that abuse trust_remote_code to run a miner; the second-wave flagship model scanned clean and reached 28,412 downloads.
LiteLLM's root-cause analysis says an Agent Platform master key committed on May 27 and never revoked led to the 1.107.0 compromise, replacing its earlier log-leak theory; GitHub commits show exfiltration workflows on October 10 and 12.
Sources describe package-install delays appearing in pnpm, pip, Bundler, Dependabot and GitHub's firewall with differing defaults, alongside an LWN-reported dispute over cooldowns versus upload queues.
LiteLLM 1.107.0 on PyPI and Docker carried a credential stealer and backdoor; the project says attackers used stolen GitHub CLI tokens and a lookalike repository to publish it.
Comparing three October 2026 cases, GhostAction, the OVHcloud CLI release swap and npm's SlugFest trusted-publishing gap, on how accounts, names and release settings were exploited.
An attacker replaced download archives on five OVHcloud CLI releases on October 19; a customer's pinned SHA-256 caught it, and OVHcloud had not enabled GitHub's release immutability.
An account named marchos1as uploaded typosquatted yay and paru lookalikes to the AUR; their install scriptlets ran a downloaded script as root before maintainers banned the account.
GitHub's October 12 changelog adds an Anonymous option for organization-level Dependabot private registries; two docs pages read October 13 still list Token, Username and password, and OIDC.