Tag

software supply chain attacks

15 articles

Latest in software supply chain attacks

Blogs

Two GitHub Campaigns, One Weak Point: Stolen Developer Credentials

Two separate GitHub attack campaigns, Gheist and Testmetest, exploited stolen developer credentials to steal secrets, compromise workflows and target software supply chains. The attacks reveal dangerous blind spots in GitHub Actio…

Oct 30, 20263 min

All software supply chain attacks Articles

Showing 1–15 of 15

Oct21

Blogs

GitHub Puts a Firewall Between npm and Your CI Runners

GitHub’s new package firewall puts enterprise security policies between npm registries and the developers, CI runners and AI coding agents consuming packages. With malware detectio…

3 min

Sep22

Blogs

New npm Threat Bypasses Install Script Protections

A malicious npm package that has been downloaded millions of times comes with a new way of spreading the malware that makes it easier to bypass security protections, say researcher…

3 min

Aug21

Blogs

Hackers Target Popular arrayref Rust Crate in Supply-Chain Attack

Security researchers are sorting through a complex, stealthy, and fast-moving supply-chain attack aimed at pushing information-stealing malware by compromising the account of the m…

3 min

Aug03

N. Korea Group Behind Multiple Open Source Supply-Chain Attacks: Amazon

Amazon’s recent report attributing a series of compromises of open source software libraries to a North Korea-backed threat group encapsulates many of the expanding cyber risks inc…

3 min

Jun05

CI/CD

IronWorm Malware Shares Shai-Hulud Traits, Takes Threat to ‘Next Level’

Open source software developers continue to come under attack, with the latest threat being a custom malware that shares many of the attributes of the notorious Shai-Hulud self-pro…

3 min

Apr21

Blogs

Critical Microsoft GitHub Flaw Highlights Dangers to CI/CD Pipelines: Tenable

A critical vulnerability in a popular Microsoft GitHub repository could allow a threat actor to easily exploit its CI/CD infrastructure to run arbitrary code in the repository and…

3 min

Apr06

DevSecOps

Bad Actor Drops 36 Malicious Packages in npm, Targets Guardarian Users

The npm code repository is again being used by a bad actor to launch a supply chain attack that includes three dozen malicious packages that appear as Strapi CMS plugins but delive…

3 min

Jan01

Best of 2025

Best of 2025: GitHub Action Compromise Risks Data Leaks for 23,000 Repositories

The attacker introduced malicious Python code that would expose secrets like authentication credentials in public repositories.

3 min

Dec19

Blogs

Three Encryption Resolutions for DevSecOps in 2026

As supply chain attacks surge and AI-powered threats grow, DevSecOps teams must strengthen CI/CD security. Learn why PKI, code signing, and certificate automation are critical in t…

3 min

Mar17

DevSecOps

GitHub Action Compromise Risks Data Leaks for 23,000 Repositories

The attacker introduced malicious Python code that would expose secrets like authentication credentials in public repositories.

3 min

Feb05

Blogs

Typosquat Supply Chain Attack Targets Go Developers

A backdoor that impersonates a widely used database module in the popular Go programming language can give hackers control of infected systems, according to a senior threat intelli…

3 min

Jul25

Blogs

More Than 3,000 ‘Ghost’ Accounts Spreading Malware on GitHub

GitHub and similar open-source code and project repositories have become a common target of cybercriminals looking to lure developers into unknowingly downloading malicious scripts…

3 min

Mar31

Blogs

npm is Scam-Spam Cesspool ¦ Google in Microsoft Antitrust Thrust

In this week’s #TheLongView: The npm registry suffers spam infestation, and Microsoft makes Google sad.

3 min

Mar15

Blogs

Addressing Software Supply Chain Security

It’s essential for organizations to learn more about the software supply chains they rely on and the steps needed to secure them. In just the past few years, we have seen a major u…

3 min