#supply-chain-attack tag

1 day ago

Privacy technologies

Supply-chain attacks on open source software are getting out of hand

6 days ago

Information security

Malware Injected into 6 npm Packages After Maintainer Tokens Stolen in Phishing Attack

fromCSO Online

2 days ago

JavaScript

Supply chain attack compromises npm packages to spread backdoor malware

1 day ago

Privacy technologies

Supply-chain attacks on open source software are getting out of hand

6 days ago

Information security

Malware Injected into 6 npm Packages After Maintainer Tokens Stolen in Phishing Attack

Typosquatted packages delivering malware to Linux and macOS systems

A malicious campaign using typosquatted Go packages is targeting Linux and macOS systems to deliver malware.

Growth hacking

Seven Malicious Go Packages Found Deploying Malware on Linux and macOS Systems

Ongoing campaign targets Go ecosystem with typosquatted modules deploying malware on Linux and macOS.

Software development

fromInfoQ

3 months ago

Google Go Module Mirror Served Backdoor for 3+ Years

Research uncovered a major supply chain attack in the Go ecosystem involving a backdoored package.

The attack exploited caching in the Go Module Proxy, emphasizing security vulnerabilities in module management.

DevOps

fromTheregister

Separate supply chain attack tied to 23K pwned GitHub repos

The GitHub supply chain attack was likely initiated through a compromised GitHub Action, reviewdog/action-setup, leading to extensive data breaches.

Information security

1 month ago

DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer Endpoints

DragonForce ransomware exploited vulnerabilities in a Managed Service Provider's SimpleHelp tool for data exfiltration and ransomware deployment.

E-Commerce

2 months ago

Hundreds of e-commerce sites hacked in supply-chain attack

A supply-chain attack compromised hundreds of e-commerce sites, allowing malware to steal payment information from visitors.

Malware that had been dormant for six years is now actively stealing sensitive data from e-commerce customers.

Software development

fromSecuritymagazine

Typosquatted packages delivering malware to Linux and macOS systems

A malicious campaign using typosquatted Go packages is targeting Linux and macOS systems to deliver malware.

Growth hacking

Seven Malicious Go Packages Found Deploying Malware on Linux and macOS Systems

Ongoing campaign targets Go ecosystem with typosquatted modules deploying malware on Linux and macOS.

Software development

fromInfoQ

3 months ago

Google Go Module Mirror Served Backdoor for 3+ Years

Research uncovered a major supply chain attack in the Go ecosystem involving a backdoored package.

The attack exploited caching in the Go Module Proxy, emphasizing security vulnerabilities in module management.

DevOps

fromTheregister

Separate supply chain attack tied to 23K pwned GitHub repos

The GitHub supply chain attack was likely initiated through a compromised GitHub Action, reviewdog/action-setup, leading to extensive data breaches.

Information security

1 month ago

DragonForce Exploits SimpleHelp Flaws to Deploy Ransomware Across Customer Endpoints

DragonForce ransomware exploited vulnerabilities in a Managed Service Provider's SimpleHelp tool for data exfiltration and ransomware deployment.

E-Commerce