Supply Chain Attack
148 npm Packages Disguised as Student Proxies Reportedly Turned Browsers Into a DDoS Botnet
A large-scale JavaScript-ecosystem supply-chain compromise — defender inventory work this week.
Artificial Intelligence (AI)
Cursor IDE Auto-Executes Malicious Code in Poisoned Repositories, Researchers Say
An AI-IDE supply-chain finding — defender review for organizations using Cursor this week.
Artificial Intelligence (AI)
Researchers Disclose “MemGhost,” a Technique That Plants Persistent False Memories in AI Agents
Another AI-agent supply-chain finding — defender posture review for organizations deploying memory-enabled agents this week.
Supply Chain Attack
'Ghost Accounts' Abuse GitHub API in Mass Reconnaissance Campaign, SecurityWeek Reports
A GitHub-organization reconnaissance campaign — defender posture and account-hygiene review this week.
Supply Chain Attack
jscrambler 8.14.0 npm Release Compromised to Drop a Rust Infostealer at Install
Another JavaScript-ecosystem SDK compromise — defender inventory work continues this week.
Supply Chain Attack
Compromised Injective Labs GitHub Repo Used to Publish Wallet-Key-Stealing npm Package
Another JavaScript-ecosystem SDK compromise with cryptocurrency-user implications — defender inventory work this week.
Supply Chain Attack
npm 12 Ships With Install Scripts Disabled by Default to Cut Supply-Chain Risk
A meaningful ecosystem-policy signal from npm after months of contributor-account compromises — defender developers review CI/CD posture this week.
Supply Chain Attack
Researchers Disclose "HalluSquatting" Technique Targeting AI Coding Assistants
An AI-hallucination supply-chain finding with organization-wide implications — defender review this week.
Vulnerabilities
"GitLost" Disclosure: Researchers Say GitHub Agentic Workflows Could Leak Private Repository Data
An agentic-workflow data-exposure disclosure with organization-wide DevSecOps implications — defender review this week.
Artificial Intelligence (AI)
Adversa AI Research — “GuardFall” Shell Injection Bypasses 10 of 11 Open-Source AI Coding Agents
An AI-coding-agent bypass with cross-vendor implications — defender posture-review work for organizations running open-source agents this week.
Artificial Intelligence (AI)
Microsoft Warns Poisoned MCP Tool Descriptions Can Turn AI Agents Into Data-Leak Channels
A fresh vendor-research disclosure at the intersection of AI agents and supply-chain risk — Microsoft says poisoned tool descriptions can quietly redirect what an agent does, and pairs the research with defender guidance for teams shipping agentic AI this week.
Vulnerabilities
Researchers Disclose Amazon Q Developer VS Code Flaw Affecting Cloud Credentials
A coding-AI-assistant flaw with cloud-credential implications — defender posture review for the week.