Supply Chain Attacks
14 articles RSS
Microsoft Ties Mastra npm Supply-Chain Attack to North Korea's Sapphire Sleet as 'easy-day-js' Typosquat Poisons 140-Plus AI Packages
Microsoft attributes the June 17 compromise of 140-plus Mastra npm packages to North Korean state actor Sapphire Sleet, which used a hijacked maintainer account to inject a malicious dayjs typosquat called easy-day-js.
Miasma Worm Forges SLSA Provenance and Hides in binding.gyp as It Hits Red Hat, Vapi, and Leo Platform npm Packages
A self-spreading npm worm called Miasma published Trojanized packages carrying valid-looking SLSA provenance, beginning with 32 @redhat-cloud-services releases on June 1.
IronWorm, a Rust-Based npm Infostealer, Hides Behind an eBPF Rootkit and Tor C2 While Self-Propagating Through Stolen Credentials
JFrog disclosed IronWorm, a self-propagating npm worm written in Rust that uses an eBPF rootkit, Tor command-and-control, and stolen credentials to spread.
Laravel-Lang Supply Chain Attack Poisons Over 700 Package Versions via Packagist Tag Hijack, Deploying Cross-Platform Credential Stealer
Attackers rewrote Git tags across four Laravel localization packages to point to malicious forks, poisoning hundreds of versions and deploying a credential stealer targeting cloud keys, SSH, and crypto wallets.
Checkmarx Jenkins AST Plugin Backdoored for 31 Hours as TeamPCP Returns Weeks After the KICS Compromise
A malicious build of Checkmarx's Jenkins AST plugin was live on the Jenkins Marketplace from May 9 at 01:25 UTC to May 10 at 08:47 UTC, the latest TeamPCP intrusion against Checkmarx weeks after the April KICS wave.
Bitwarden CLI Npm Package Backdoored for 90 Minutes as Shai-Hulud Worm Resurfaces Through Checkmarx Breach
A malicious build of @bitwarden/cli@2026.4.0 was live on npm for roughly 93 minutes on April 22 after attackers used credentials stolen from Checkmarx to push a self-propagating worm that harvests cloud, Git, and AI tooling credentials.
CPUID Website Hijacked to Distribute STX RAT Through Trojanized CPU-Z and HWMonitor Downloads
Attackers compromised CPUID's backend API and replaced download links for four popular hardware tools with malware-laden installers, infecting over 150 users across multiple countries.
Trivy Supply-Chain Compromise Spawns CanisterWorm, the First npm Worm to Use Blockchain for Command and Control
Attackers hijacked 75 of 76 version tags in the widely used trivy-action GitHub Action to steal CI/CD credentials, then deployed a self-propagating npm worm that uses the Internet Computer Protocol as an untakeable-down command-and-control channel.
GlassWorm Supply-Chain Attack Hijacks 72 VS Code Extensions and 151 GitHub Repositories to Steal Developer Credentials
A coordinated supply-chain campaign abused Open VSX extension dependencies and invisible Unicode payloads to compromise developer environments across VS Code and GitHub.
Claude Code Vulnerabilities Let Attackers Run Arbitrary Commands and Steal API Keys by Cloning a Repository
Check Point Research disclosed two CVEs in Anthropic's Claude Code that turned project configuration files into attack vectors, enabling remote code execution and API key exfiltration before users could approve a trust dialog.
Prompt Injection in AI Issue Triage Bot Led to Cline CLI Supply Chain Attack, Affecting Thousands of Developers
A security researcher's disclosure of a prompt injection flaw in Cline's AI-powered GitHub issue bot was weaponized eight days later to steal npm publish tokens and install unauthorized software on developer machines.
npm, PyPI, and Crates.io Cannot Afford Basic Security as Malware Costs Devour Thin Budgets, Alpha-Omega Audit Reveals
An audit of the world's largest open source package registries finds they spend 12 percent of their budgets fighting malware and just 2 percent on new features, with no path to sustainable security funding.