Tag: supply chain attack

Security researchers have uncovered malicious npm packages linked to North Korea that impersonate Rollup polyfill tools to deliver remote access malware and steal developer credentials and sensitive data.

CISA has added the critical Joomla JCE vulnerability CVE 2026 48907 to its Known Exploited Vulnerabilities catalog following reports of active exploitation, while researchers also uncover large scale attacks targeting WordPress websites through supply chain compromises and malicious plugins.

A new supply chain attack called Miasma has compromised Red Hat npm packages to steal credentials, target CI/CD environments, and deploy a self propagating malware campaign affecting developers and cloud systems.

Researchers uncover a malicious npm package targeting Claude AI user directories to steal files and upload them to attacker controlled GitHub repositories.

A Mini Shai Hulud worm linked to TeamPCP has compromised npm and PyPI packages across TanStack, Mistral AI, Guardrails AI and others, deploying credential stealers, CI/CD exploits, and cross ecosystem propagation techniques.

Security researchers identified 73 fake Microsoft VS Code extensions on Open VSX tied to GlassWorm v2 malware campaign targeting developers through supply chain attacks and sleeper packages.

Security researchers report malicious Docker images and VS Code extensions tied to Checkmarx supply chain compromise, exposing developer credentials, cloud tokens, and CI/CD secrets through multi-stage malware and npm propagation.

A compromised Smart Slider 3 Pro update distributed via Nextend servers delivered a backdoored version affecting WordPress and Joomla sites, enabling remote access and persistence.

A supply chain attack linked to Trivy has led to the spread of CanisterWorm malware across dozens of npm packages, exploiting tokens and decentralized infrastructure.

Security researchers report an expanded GlassWorm campaign using malicious Open VSX extensions and hidden Unicode code to target developers and steal sensitive data.

Researchers uncover a malicious Go module impersonating golang.org/x/crypto that steals terminal passwords, installs SSH persistence, and deploys the Rekoobe Linux backdoor.

A compromised npm publish token was used to release Cline CLI version 2.3.0, triggering unauthorized installation of OpenClaw on developer systems during an eight hour supply chain attack window.