Over 1,800 developers were affected by the Mini Shai-Hulud supply chain attack that hit the PyPi, NPM, and PHP ecosystems over the past two days. Attributed to the TeamPCP hacking group, the campaign was first spotted on April 29, after… Read More "1,800 Hit in Mini Shai-Hulud Attack on SAP, Lightning, Intercom"
Four SAP NPM packages have been injected with malicious code as part of a new supply chain attack, security researchers warn. The campaign, referred to as Mini Shai-Hulud, is targeting packages linked to the SAP Cloud Application Programming (CAP) ecosystem… Read More "SAP NPM Packages Targeted in Supply Chain Attack"
A critical remote code execution vulnerability was recently discovered by researchers in Gemini CLI, an open source AI agent designed to provide lightweight access to Gemini directly from a terminal. The vulnerability, patched by Google in both Gemini CLI and… Read More "Critical Gemini CLI Flaw Enabled Host Code Execution, Supply Chain Attacks"
Checkmarx on Tuesday confirmed that last month’s supply chain attack targeting its KICS open source project also resulted in data theft. The compromise was a result of the Trivy supply chain attack and allowed the attackers to hijack dozens of… Read More "Checkmarx Confirms Data Stolen in Supply Chain Attack"
The Bitwarden command-line interface (CLI) NPM package was compromised in a supply chain attack that appears tied to previous campaigns against the open source software (OSS) ecosystem. One of the most popular open source password management platforms, with over 250,000… Read More "Bitwarden NPM Package Hit in Supply Chain Attack"
