Cyber CrimeGhostAction Returns, Hits 340+ Maintainer Repos
A credential-theft campaign has compromised two open-source maintainer accounts to push malicious GitHub Actions workflows into more than 340 repositories.
> Search
12 results for “supply chain attack”
Cyber Crime
Cyber CrimeThird-Party App Key Opens Door to BigCommerce Data Theft
Attackers used a compromised credential from the Ribon app to pull customer data from hundreds of online stores, exposing a soft spot in e-commerce supply chains.
Cyber CrimeProvenance Fails as npm Supply Chain Attack Hits
CloudSEK reports attackers abused npm trusted publishing to ship GHAPPIER loader, exposing limits of provenance attestations.
Cyber CrimeCrowdSec Ties Code Theft to TanStack Flaw
CrowdSec says about 300 repositories were hit and links the theft to a May 2026 TanStack supply chain attack.
Cyber CrimeBrevo Breach Turns CDN Edge Into Attack Path
A hardcoded Cloudflare key let attackers rewrite Brevo's sites and customer scripts for hours, pushing ClickFix malware at scale.
SecurityGoogle Warns on AI Coding Tool Threats
Google Threat Intelligence Group warns AI coding tools are prime targets for supply chain attacks.
SecurityBrowser extensions turn into supply chain risk
Attackers buy legitimate Chrome, Edge extensions and push malware via updates, Socket reports.
Cyber CrimeRust Supply Chain Attack Tied to North Korea
Wiz links a crates.io compromise to Sapphire Sleet, warning of broad developer exposure.
Cyber CrimeCeva Breach Reverberates Through Client Ecosystem
A Ceva Logistics data breach affecting European clients shows how supply chain attacks ripple outward.
SecurityAI Agents Vulnerable to AgentBaiting
A campaign dubbed FakeGit uses 7,600 fake GitHub repositories to trick AI agents into installing the SmartLoader malware family.
SecurityAsyncAPI Breach Exposes CI/CD Pipeline Risk
A sophisticated supply chain attack used legitimate GitHub pipelines to push malicious code via the AsyncAPI npm namespace.
SecurityTrusted Browser Tool Becomes Vector for Hidden Data Exfiltration
A widely used extension for developers and testers was found harboring spyware that sent user traffic data to remote servers.