Supply Chain Attack RSS Feeds

Directory0 supply chain attack feeds · 13 articlesShow all languages →

Latest

Supply Chain Attack articles

How malware hidden in a Tailwind CSS config file led to a production breach

I found a malware hiding in my tailwindcss config file. I almost closed the file without reading it. Three days later I was killing processes in production at 2am, rotating every credential I own …

Insighttechnologysecurityprogramming

infosecwriteups.com·Hacker News: Front Page·12d ago·14 min read

Klue supply chain attack: OAuth token theft in Salesforce and Gong environments

Insighttechnologysecurity

Shared by @securitylabs.datadoghq.com ↗

securitylabs.datadoghq.com24d ago

axios npm Package Compromised: Versions 1.14.1 and 0.30.4 Contain RAT Malware

Newstechnologysecurity

Shared by @bilaltariq01.bsky.social ↗

cstu.io1mo ago

Red Hat NPM accounts compromised in supply-chain attack pushing credential-stealing worm

Newstechnologysecurity

Shared by @arstechnica.com ↗

arstechnica.com1mo ago

Megalodon Attack: Malicious GitHub Actions Workflows Compromise Over 5,500 Open-Source Repositories

A forged commit. A workflow file disguised as a routine CI optimization. Within 6 hours, 5,561 GitHub repositories were backdoored. Cloud credentials harvested. SSH keys stolen. OIDC tokens minted and exfiltrated before any runner finished. The attacker n

Newstechnologysecuritydevops

stepsecurity.io·Tech by Flipboard·1mo ago·4 min read

North Korean Chollima Group Targets PHP Developers via Malicious Packagist Package

Security researchers discovered obfuscated JavaScript hidden inside a Packagist development version of the legitimate Laravel package

Newstechnologysecurityprogramming

cyberpress.org·Tech by Flipboard·1mo ago·4 min read

Malicious npm package "Codex" stole developer credentials for a month before detection

The npm package had an active GitHub repository and about 29,000 weekly downloads while providing a remote web UI for OpenAI Codex. For about a month, each invocation silently read ~/.codex/auth.json and sent access tokens, refresh tokens, ID tokens, and

Newstechnologysecurityprogramming