supply-chain

JFrog disclosed IronWorm, a self-propagating npm worm written in Rust that uses an eBPF rootkit, Tor command-and-control, and stolen credentials to spread.

Qcells began making solar cells at its Cartersville, Georgia plant, the first US factory to produce ingots, wafers, cells and modules under one roof.

A patched SQL injection in Ghost CMS (versions 3.24.0–6.19.0) has been exploited at scale to compromise 700+ websites, including Harvard and Oxford, turning them into ClickFix malware distribution points.

Socket researchers discovered TrapDoor, a supply chain attack spanning 34 packages and 384+ versions across three registries, with a novel technique that embeds hidden instructions in AI coding assistant config files to trigger credential exfiltration.

Apple and Intel have struck a preliminary agreement for Intel to manufacture some Apple chips, ending a six-year split and handing Intel Foundry its most consequential customer win yet.

The Department of Energy selected eight U.S. companies for $94 million in Tier 2 awards targeting site permitting and domestic supply chain gaps for Gen III+ small modular reactors.

Attackers rewrote Git tags across four Laravel localization packages to point to malicious forks, poisoning hundreds of versions and deploying a credential stealer targeting cloud keys, SSH, and crypto wallets.

A new Linux Foundation working group--backed by Sonatype, the Rust Foundation, OpenSSF, and a dozen registry operators--aims to close the funding and governance gap before AI-driven download volumes overwhelm critical open source infrastructure.

TeamPCP's May 11 supply-chain attack abused a pull_request_target workflow, GitHub Actions cache poisoning, and OIDC token theft to ship 84 malicious TanStack versions and spread to Mistral AI, UiPath and others.

World's largest electronics manufacturer acknowledges cyberattack claimed by Nitrogen ransomware group on North American factories; attackers allege 8 TB data theft including confidential schematics for Apple, Nvidia, Google and others, with production now resuming.

Debian's release team has switched on a migration block for any package that fails to build reproducibly, with 98.29% of architecture-independent packages already passing.

A malicious build of Checkmarx's Jenkins AST plugin was live on the Jenkins Marketplace from May 9 at 01:25 UTC to May 10 at 08:47 UTC, the latest TeamPCP intrusion against Checkmarx weeks after the April KICS wave.