North Korean threat actors are employing advanced, multi-stage social engineering campaigns to compromise critical open-source projects and siphon millions from decentralized finance platforms. These incidents highlight severe supply chain vulnerabilities and the escalating threat landscape.
Recent reports highlight advanced state-sponsored cyberattacks targeting prominent open-source maintainers and a multi-million dollar crypto heist, alongside a controversial domestic IP blocking policy and an 'AI unicorn' under intense ethical scrutiny. The tech industry navigates increasingly complex security challenges and ethical dilemmas.
A malicious package masquerading as a legitimate dependency compromised Axios, impacting millions. Learn how the attack unfolded and what developers can do to protect their projects.
A severe supply chain attack has hit PyPI, distributing malicious versions of the popular LiteLLM library. The malware, capable of deep system compromise and automatic execution, threatens extensive credential theft across the Python and AI development community.
A sophisticated supply chain attack has compromised the widely-used Axios JavaScript library, deploying a remote access Trojan (RAT) to developer machines and CI/CD servers. Urgent action is advised for users running affected versions due to potential credential theft and data exfiltration.
A developer narrowly avoided a sophisticated supply chain attack involving hidden Unicode characters and a multi-stage `eval` payload within a trusted pull request. Learn how the `ignore-scripts` configuration became a crucial defense.
A widely used npm package was compromised, silently installing the powerful AI agent OpenClaw on developer systems. This incident highlights critical supply chain vulnerabilities and the dangers of AI agents with broad system access.
A sophisticated supply chain attack, dubbed Shai Hulud, has compromised over 500 npm packages, leveraging GitHub Actions vulnerabilities to exfiltrate secrets and propagate malicious code. This incident marks a critical shift from theoretical threats to confirmed real-world impact across major tech vendors.