supply chain attack

2 articles · newest first

the tool built to catch security bugs got hacked — and quietly leaked into 2,500 companies' pipelines

A poisoned vulnerability scanner sat inside a widely-trusted build pipeline for five days before anyone noticed, and Cisco, S&P Global and the European Commission are on the list of who it touched.

Lena Fischer · Aug 18 · 7 min

A terminal window showing npm package install output, representing the compromised JavaScript package ecosystem

Software

a hacked github account just turned npm into a credential-stealing worm

One compromised maintainer account, ten trojanized packages, two billion downloads a month — and the malware is specifically hunting for your Claude and Cursor configs.

Priya Nair · Aug 9 · 6 min