Upwind Finds Coordinated Supply Chain Campaign Compromising Multiple AsyncAPI npm Packages

Upwind links compromised AsyncAPI npm packages to a coordinated supply chain attack spanning repositories, publishing pipelines, and developer systems at risk.

·

AsyncAPI, Cyber Attack, cybersecurity, npm, Security, Supply Chain, Upwind, vulnerability

¶¶¶¶¶

Siggen Backdoor Hits Windows Developers Via Infected Visual Studio Projects

Dr.Web details Siggen Windows backdoor that uses Steam for C2, steals credentials and crypto data and infects Visual Studio projects to spread among developers.

·

backdoor, cryptocurrency, cybersecurity, Malware, SCAM, Security, Siggen, Steam, Supply Chain, TROJAN, Visual Studio

¶¶¶¶¶

‘Cordyceps’ CI/CD Flaw Exposes Microsoft, Google, Apache Repos to Pipeline Hijacking

Novee Security reveals Cordyceps, a CI/CD vulnerability in GitHub Actions workflows that let anonymous users poison builds and expose tokens across major projects today.

·

CI/CD, Cordyceps, cybersecurity, GitHub, Novee, Security, Supply Chain, vulnerability

¶¶¶¶¶

Salesforce Disables Klue Integration After OAuth Token Theft Hits Customer Data

Icarus extortion group used a legacy Klue Battlecards credential to bypass security and steal bulk Salesforce records from affected companies.

·

Cyber Attack, cybersecurity, Data Breach, Data Breaches, Klue, Salesforce, Security, Supply Chain, vulnerability

¶¶¶¶¶

5,561 GitHub Repositories Hit by Megalodon Supply Chain Attack in Six Hours

SafeDep uncovered the Megalodon attack targeting 5,561 GitHub repositories with malicious CI workflows and cloud credential theft.

·

Cyber Attack, Cyber-Attacks, cybersecurity, GitHub, Malware, Megalodon, SafeDep, Security, Supply Chain

¶¶¶¶¶

TeamPCP Claims Sale of Mistral AI Repositories Amid Mini Shai-Hulud Attack

TeamPCP claims to be selling alleged Mistral AI repositories on a hacker forum after the Mini Shai-Hulud attack targeted npm and PyPI ecosystems.

·

AI, Cyber Attack, Cyber Crime, cybersecurity, Data Breaches, Mistral AI, npm, PyPI, Security, Supply Chain, TeamPCP

¶¶¶¶¶

TeamPCP Used Mini Shai-Hulud Worm to Poison Over 400 npm and PyPI Packages

Research reveals that TeamPCP hijacked OIDC tokens to poison hundreds of TanStack, Mistral AI, and UiPath packages with the self-propagating Mini Shai-Hulud worm.

·

Cyber Attack, Malware, Mini Shai-Hulud, npm, PyPI, Security, Supply Chain, TeamPCP

¶¶¶¶¶

Hackers Poison Axios npm Package with 100 Million Weekly Downloads

Axios npm Package compromised in a supply chain attack, exposing developers to malware, data theft, and full system takeover risks worldwide.

·

Axios, Cyber Attack, cybersecurity, Malware, npm, Security, Supply Chain

¶¶¶¶¶

TeamPCP Uses Fake Ringtone File in Tainted Telnyx SDK to Steal Credentials

Telnyx issues an urgent alert after hackers TeamPCP uploaded malicious versions (4.87.1 & 4.87.2) of its Python SDK to steal cloud and crypto credentials.

·

Cyber Attack, Cyber-Attacks, cybersecurity, Malware, Security, Supply Chain, TeamPCP, Telnyx, Trivy

¶¶¶¶¶

TeamPCP Hits Trivy, Checkmarx, and LiteLLM in Credential Theft Campaign

Hackers compromised Trivy, Checkmarx, and LiteLLM in a supply chain attack, stealing cloud credentials, tokens, and crypto wallet data from developers.

·

Checkmarx, Cyber Attack, Cyber-Attacks, cybersecurity, LAPSUS$, Malware, Security, Supply Chain, TeamPCP, Trivy

¶¶¶¶¶

1010.cx

1010.cx

Category: Supply Chain