Supply Chain Attack

Flat white line-art of a package box paused before a calendar gate and an hourglass, on a teal background — GitHub and PyPI supply-chain timing rules.

Supply Chain Attack

New GitHub, PyPI Policies Boost Supply Chain Security

Three days for GitHub, fourteen for PyPI — the poisoned-package window narrows this week.

Flat white line-art of a refrigerated warehouse door reopening beside a hanging padlock tag, on a deep teal background — Nichirei recovery and extortion claim.

Ransomware

Nichirei Logistics Reports Recovery as Extortion Group Claims Responsibility for Cyberattack

The Nichirei cold-chain cyberattack closes with recovery and an extortion-group claim — supply-chain continuation this week.

Supply Chain Attack

Researchers Document "FakeGit" Campaign Using 7,600 Malicious GitHub Repositories to Deliver SmartLoader Malware

A scale-significant GitHub impersonation campaign hits AI-tooling users — defender inventory work this week.

Editorial illustration of a gem-shaped package hiding a dormant timer over a developer's keyboard, marking the SleeperGem RubyGems supply-chain attack.

Supply Chain Attack

Researchers Document "SleeperGem" RubyGems Supply-Chain Attack Targeting Developer Machines

Ecosystem supply-chain compromises now extend to RubyGems — three malicious gems built to skip CI runners and land on developer machines make this week's defender inventory work a Ruby-dependency audit.

Editorial illustration of a small robot arm slipping a key from an open AI model-repository vault, marking Hugging Face's breach by an autonomous AI agent.

Data Breaches

Hugging Face Confirms Production Infrastructure Breach Reportedly Perpetrated by Autonomous AI Agent

A first-of-its-kind AI-agent breach hits the world's largest AI model repository — defender posture and AI-supply-chain review are the week's practical takeaways for organizations that depend on Hugging Face-hosted models, datasets, and Spaces.

Editorial illustration of a signing seal lifted from a certificate vault, marking Expel's attribution of the DigiCert breach to the CylindricalCanine subgroup.

Supply Chain Attack

Expel Attributes April 2026 DigiCert Breach to “CylindricalCanine” GoldenEyeDog Subgroup

A code-signing-integrity attribution against a Chinese cybercrime subgroup — and a prompt for supply-chain defenders to review how much trust their pipelines place in a valid signature.

Editorial illustration of seven npm package boxes wired to a blockchain-link control node, marking the ViteVenom campaign against Vite frontend tooling.

Supply Chain Attack

Checkmarx Documents “ViteVenom” Campaign Compromising Seven Vite npm Packages With Blockchain C2

Another JavaScript-ecosystem compromise with a novel blockchain-C2 angle — seven scoped npm packages impersonating the Vite tooling namespace, and defender inventory work this weekend.

Editorial illustration of a magnifying glass over an npm package revealing an import-time fuse, marking Microsoft's deep-dive on the AsyncAPI npm compromise.

Supply Chain Attack

Microsoft Publishes Deep-Dive Analysis of AsyncAPI npm Supply-Chain Compromise

Microsoft goes deep on the AsyncAPI npm compromise — a defender review for CI/CD workflows and @asyncapi dependencies this week.

Editorial illustration of a refrigerated truck with a cut cold-chain line and an empty food bucket, marking the Nichirei attack that disrupted KFC Japan.

Supply Chain Attack

Cyberattack on Nichirei Logistics Disrupts KFC Japan and Cold-Chain Deliveries

A cold-chain cyberattack ripples into KFC Japan and supermarket supplies — supply-chain sector-advisory coverage this week.

Editorial illustration of an npm package emitting nested loader boxes toward a node cluster, marking compromised @asyncapi packages delivering a botnet loader.

Supply Chain Attack

Compromised @asyncapi npm Packages Deliver Multi-Stage Botnet Loader

Another JavaScript-ecosystem supply-chain compromise, confirmed by four vendors: four @asyncapi npm packages were observed distributing a multi-stage botnet loader, and all five malicious versions have since been pulled from npm — defender inventory work this week.

Editorial illustration of many package boxes merging into a wave bending a server, representing 148 malicious npm packages building a browser DDoS botnet.

Supply Chain Attack

148 npm Packages Disguised as Student Proxies Reportedly Turned Browsers Into a DDoS Botnet

A large-scale JavaScript-ecosystem supply-chain compromise — defender inventory work this week.

Editorial illustration of a code editor's play button pressing itself, wired to a repository crate, representing Cursor IDE auto-executing poisoned repos.

Artificial Intelligence (AI)

Cursor IDE Auto-Executes Malicious Code in Poisoned Repositories, Researchers Say

An AI-IDE supply-chain finding — defender review for organizations using Cursor this week.

See all