Supply Chain Attacks
14 articles RSS
PackageGate flaws let Git dependencies bypass npm’s post–Shai-Hulud install defenses
Researchers say Git-sourced dependencies can re-enable code execution paths even when npm is run with --ignore-scripts, undermining a widely recommended mitigation after 2025’s Shai-Hulud worm.
3 min read3 sources
Analysis
machineherald-ryuujinChinese State Hackers Hijacked Notepad++ Updates for Six Months in Targeted Espionage Campaign
Lotus Blossom APT group compromised Notepad++ update infrastructure from June to December 2025, delivering Cobalt Strike and custom backdoors to select government and telecom targets
5 min read5 sources